Skip to content

Commit 3c36729

Browse files
bencmbrookbencmbrook
authored
Support for optional pod-level and container-level securityContext configuration (#22)
2 parents 126dd71 + 3338af6 commit 3c36729

File tree

10 files changed

+114
-11
lines changed

10 files changed

+114
-11
lines changed

‎charts/sombra/CHANGELOG.md‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,20 @@
4949
## 0.6.4
5050

5151
* Added support for specifying an optional service account name in the chart's values
52-
* Added optional serviceAccount configuration section (commented out by default)
53-
* Created serviceaccount.yaml template for conditional service account creation
54-
* Updated deployment to conditionally use the specified service account
55-
* **Non-breaking change**: Service account functionality is completely opt-in and disabled by default
52+
* Added optional serviceAccount configuration section (commented out by default)
53+
* Created serviceaccount.yaml template for conditional service account creation
54+
* Updated deployment to conditionally use the specified service account
55+
* **Non-breaking change**: Service account functionality is completely opt-in and disabled by default
5656

5757
## 0.6.5
5858

5959
* Added support for client-managed secrets via `envFrom` configuration
60-
* Allow loading environment variables from ConfigMaps and Secrets using the `envFrom` field
61-
* **Non-breaking change**: `envFrom` functionality is completely opt-in and disabled by default
60+
* Allow loading environment variables from ConfigMaps and Secrets using the `envFrom` field
61+
* **Non-breaking change**: `envFrom` functionality is completely opt-in and disabled by default
62+
63+
## 0.6.6
64+
65+
* Added support for pod-level and container-level [securityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) configuration
66+
* Allow users to configure security contexts for enhanced security and compliance
67+
* Added `podSecurityContext` and `containerSecurityContext` options in values.yaml for all charts (sombra, llm-classifier, pathfinder)
68+
* **Non-breaking change**: Security context functionality is completely opt-in and disabled by default

‎charts/sombra/Chart.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@ apiVersion: v2
22
name: sombra
33
description: A Helm chart to deploy Sombra and its dependent services in a Kubernetes cluster
44
type: application
5-
version: 0.6.5
5+
version: 0.6.6
66
maintainers:
77
- name: Transcend
88
email: dev@transcend.io
99
dependencies:
1010
- name: llm-classifier
1111
condition: llm-classifier.enabled
12-
version: "0.2.1"
12+
version: "0.2.2"
1313
- name: pathfinder
1414
condition: pathfinder.enabled
15-
version: "0.2.1"
15+
version: "0.2.2"

‎charts/sombra/charts/llm-classifier/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ apiVersion: v2
22
name: llm-classifier
33
description: A Helm chart to deploy the LLM Classifier in a Kubernetes cluster
44
type: application
5-
version: 0.2.1
5+
version: 0.2.2

‎charts/sombra/charts/llm-classifier/templates/deployment.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,18 @@ spec:
2929
imagePullSecrets:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
32+
{{- with .Values.podSecurityContext }}
33+
securityContext:
34+
{{- toYaml . | nindent 8 }}
35+
{{- end }}
3236
containers:
3337
- name: {{ .Chart.Name }}
3438
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
3539
imagePullPolicy: {{ .Values.image.pullPolicy }}
40+
{{- with .Values.containerSecurityContext }}
41+
securityContext:
42+
{{- toYaml . | nindent 12 }}
43+
{{- end }}
3644
{{- if .Values.envFrom }}
3745
envFrom:
3846
{{- toYaml .Values.envFrom | nindent 12 }}

‎charts/sombra/charts/llm-classifier/values.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,30 @@ podAnnotations: {}
2727
# Define lables for sombra pod
2828
podLabels: {}
2929

30+
# Security context configuration
31+
# Pod-level security context
32+
podSecurityContext: {}
33+
# fsGroup: 1000
34+
# runAsNonRoot: true
35+
# runAsUser: 1000
36+
# runAsGroup: 1000
37+
# supplementalGroups: []
38+
# seccompProfile:
39+
# type: RuntimeDefault
40+
41+
# Container-level security context
42+
containerSecurityContext: {}
43+
# runAsNonRoot: true
44+
# runAsUser: 1000
45+
# runAsGroup: 1000
46+
# allowPrivilegeEscalation: false
47+
# capabilities:
48+
# drop:
49+
# - ALL
50+
# readOnlyRootFilesystem: true
51+
# seccompProfile:
52+
# type: RuntimeDefault
53+
3054
# Define llm-classifier networking
3155
service:
3256
type: ClusterIP

‎charts/sombra/charts/pathfinder/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ apiVersion: v2
22
name: pathfinder
33
description: A Helm chart to deploy Pathfinder in a Kubernetes cluster
44
type: application
5-
version: 0.2.1
5+
version: 0.2.2

‎charts/sombra/charts/pathfinder/templates/deployment.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,17 @@ spec:
2929
imagePullSecrets:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
32+
{{- with .Values.podSecurityContext }}
33+
securityContext:
34+
{{- toYaml . | nindent 8 }}
35+
{{- end }}
3236
containers:
3337
- name: {{ .Chart.Name }}
3438
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
39+
{{- with .Values.containerSecurityContext }}
40+
securityContext:
41+
{{- toYaml . | nindent 12 }}
42+
{{- end }}
3543
{{- if .Values.envFrom }}
3644
envFrom:
3745
{{- toYaml .Values.envFrom | nindent 12 }}

‎charts/sombra/charts/pathfinder/values.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,30 @@ podAnnotations: {}
2727
# Define lables for sombra pod
2828
podLabels: {}
2929

30+
# Security context configuration
31+
# Pod-level security context
32+
podSecurityContext: {}
33+
# fsGroup: 1000
34+
# runAsNonRoot: true
35+
# runAsUser: 1000
36+
# runAsGroup: 1000
37+
# supplementalGroups: []
38+
# seccompProfile:
39+
# type: RuntimeDefault
40+
41+
# Container-level security context
42+
containerSecurityContext: {}
43+
# runAsNonRoot: true
44+
# runAsUser: 1000
45+
# runAsGroup: 1000
46+
# allowPrivilegeEscalation: false
47+
# capabilities:
48+
# drop:
49+
# - ALL
50+
# readOnlyRootFilesystem: true
51+
# seccompProfile:
52+
# type: RuntimeDefault
53+
3054
# Define Pathfinder networking
3155
service:
3256
type: ClusterIP

‎charts/sombra/templates/deployment.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ spec:
2929
imagePullSecrets:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
32+
{{- with .Values.podSecurityContext }}
33+
securityContext:
34+
{{- toYaml . | nindent 8 }}
35+
{{- end }}
3236
{{- if .Values.serviceAccount }}
3337
{{- if or .Values.serviceAccount.create .Values.serviceAccount.name }}
3438
serviceAccountName: {{ include "sombra-chart.serviceAccountName" . }}
@@ -38,6 +42,10 @@ spec:
3842
- name: {{ .Chart.Name }}
3943
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
4044
imagePullPolicy: {{ .Values.image.pullPolicy }}
45+
{{- with .Values.containerSecurityContext }}
46+
securityContext:
47+
{{- toYaml . | nindent 12 }}
48+
{{- end }}
4149
{{- if .Values.envFrom }}
4250
envFrom:
4351
{{- toYaml .Values.envFrom | nindent 12 }}

‎charts/sombra/values.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,30 @@ podAnnotations: {}
5757
# Define labels for the Sombra pod
5858
podLabels: {}
5959

60+
# Security context configuration
61+
# Pod-level security context
62+
podSecurityContext: {}
63+
# fsGroup: 1000
64+
# runAsNonRoot: true
65+
# runAsUser: 1000
66+
# runAsGroup: 1000
67+
# supplementalGroups: []
68+
# seccompProfile:
69+
# type: RuntimeDefault
70+
71+
# Container-level security context
72+
containerSecurityContext: {}
73+
# runAsNonRoot: true
74+
# runAsUser: 1000
75+
# runAsGroup: 1000
76+
# allowPrivilegeEscalation: false
77+
# capabilities:
78+
# drop:
79+
# - ALL
80+
# readOnlyRootFilesystem: true
81+
# seccompProfile:
82+
# type: RuntimeDefault
83+
6084
########### Sombra Architecture ###############
6185
# @see https://docs.transcend.io/docs/security/end-to-end-encryption/deploying-sombra
6286
#

0 commit comments

Comments
 (0)