Allow a security context on every pod py-app renders

charts/py-app/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
+version: 0.2.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/py-app/templates/deployment.yaml

@@ -35,6 +35,9 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.podSecurityContext }}
+      securityContext: {{ . | toYaml | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "py-app.serviceAccountName" . }}
       containers:
         - name: {{ .Chart.Name }}

charts/py-app/templates/migrators.yaml

@@ -20,6 +20,9 @@ spec:
   template:
     spec:
       restartPolicy: "Never"
+      {{- with $.Values.podSecurityContext }}
+      securityContext: {{ . | toYaml | nindent 8 }}
+      {{- end }}
       {{- with $.Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -33,6 +36,9 @@ spec:
         resources:
         {{- toYaml . | nindent 10 -}}  
         {{ end -}}
+        {{- with $.Values.securityContext }}
+        securityContext: {{ . | toYaml | nindent 10 }}
+        {{- end }}
         {{- include "py-app.envs" $ | indent 8 -}}
 {{- end }}
 {{ end -}}

charts/py-app/templates/taskiq-scheduler.yaml

@@ -30,12 +30,18 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.podSecurityContext }}
+      securityContext: {{ . | toYaml | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "py-app.serviceAccountName" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command: {{ .Values.taskiq.schedulerCmd | toYaml | nindent 10 }}
+          {{- with .Values.securityContext }}
+          securityContext: {{ . | toYaml | nindent 12 }}
+          {{- end }}
           {{- include "py-app.envs" . | indent 10 -}}
           resources:
             {{- toYaml .Values.taskiq.resources | nindent 12 }}

charts/py-app/templates/taskiq-worker.yaml

@@ -36,12 +36,18 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.podSecurityContext }}
+      securityContext: {{ . | toYaml | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "py-app.serviceAccountName" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command: {{ .Values.taskiq.workerCmd | toYaml | nindent 10 }}
+          {{- with .Values.securityContext }}
+          securityContext: {{ . | toYaml | nindent 12 }}
+          {{- end }}
           {{- include "py-app.envs" . | indent 10 -}}
           resources:
             {{- toYaml .Values.taskiq.resources | nindent 12 }}

charts/py-app/values.yaml

@@ -92,6 +92,30 @@ serviceAccount:
 
 podAnnotations: {}
 
+# Pod-level security context, applied to every workload this chart renders: the
+# web Deployment, the taskiq worker and scheduler Deployments, and the migrator
+# Jobs. runAsNonRoot belongs here rather than on a container, because that is
+# where the kubelet enforces it -- and it needs the image to declare a numeric
+# UID, since a `USER name` cannot be resolved at admission.
+podSecurityContext: {}
+  # runAsNonRoot: true
+  # runAsUser: 1000
+  # runAsGroup: 1000
+  # seccompProfile:
+  #   type: RuntimeDefault
+
+# Container-level security context, applied to the container in every workload
+# this chart renders. Takes precedence over podSecurityContext where the two
+# overlap.
+securityContext: {}
+  # allowPrivilegeEscalation: false
+  # capabilities:
+  #   drop:
+  #     - ALL
+  # readOnlyRootFilesystem is deliberately not suggested here: the Python
+  # services write to /tmp at runtime, and this chart has no volumeMounts
+  # support to give them an emptyDir there.
+
 service:
   enabled: true
   type: ClusterIP