Add container securityContext (#1252)

Author: tuteng

charts/sn-platform-slim/templates/toolset/jwt-secret-init-job.yaml

@@ -60,8 +60,8 @@ spec:
       - name: "{{ template "pulsar.fullname" . }}-jwt-secret-init"
         image: "{{ .Values.images.toolset.repository }}:{{ .Values.images.toolset.tag }}"
         imagePullPolicy: {{ .Values.images.toolset.pullPolicy }}
-        {{- if .Values.toolset.securityContext }}
-        securityContext: {{- toYaml .Values.toolset.securityContext | nindent 10 }}
+        {{- if .Values.toolset.containerSecurityContext }}
+        securityContext: {{- toYaml .Values.toolset.containerSecurityContext | nindent 10 }}
         {{- end }}
         command: ["bash", "-c"]
         args:

charts/sn-platform-slim/templates/toolset/toolset-statefulset.yaml

@@ -110,6 +110,9 @@ spec:
         resources:
 {{ toYaml .Values.toolset.resources | indent 10 }}
       {{- end }}
+        {{- if .Values.toolset.containerSecurityContext }}
+        securityContext: {{- toYaml .Values.toolset.containerSecurityContext | nindent 10 }}
+        {{- end }}
         command: ["sh", "-c"]
         args:
         - >

charts/sn-platform-slim/values.yaml

@@ -1819,6 +1819,10 @@ toolset:
     runAsUser: 10000
     runAsGroup: 10000
     fsGroup: 10000
+  containerSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 10000
+    runAsGroup: 10000
   serviceAccount:
     # Specifies whether to use a service account to run this component
     use: true

charts/sn-platform/templates/toolset/jwt-secret-init-job.yaml

@@ -60,8 +60,8 @@ spec:
       - name: "{{ template "pulsar.fullname" . }}-jwt-secret-init"
         image: "{{ .Values.images.toolset.repository }}:{{ .Values.images.toolset.tag }}"
         imagePullPolicy: {{ .Values.images.toolset.pullPolicy }}
-        {{- if .Values.toolset.securityContext }}
-        securityContext: {{- toYaml .Values.toolset.securityContext | nindent 10 }}
+        {{- if .Values.toolset.containerSecurityContext }}
+        securityContext: {{- toYaml .Values.toolset.containerSecurityContext | nindent 10 }}
         {{- end }}
         command: ["bash", "-c"]
         args:

charts/sn-platform/templates/toolset/toolset-statefulset.yaml

@@ -110,6 +110,9 @@ spec:
         resources:
 {{ toYaml .Values.toolset.resources | indent 10 }}
       {{- end }}
+        {{- if .Values.toolset.containerSecurityContext }}
+        securityContext: {{- toYaml .Values.toolset.containerSecurityContext | nindent 10 }}
+        {{- end }}
         command: ["sh", "-c"]
         args:
         - >

charts/sn-platform/values.yaml

@@ -1899,6 +1899,10 @@ toolset:
     runAsUser: 10000
     runAsGroup: 10000
     fsGroup: 10000
+  containerSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 10000
+    runAsGroup: 10000
   serviceAccount:
     # Specifies whether to use a service account to run this component
     use: true