fix(chart): expose external scaler securityContext with seccompProfile (#3196)

[VietND96]

Fixes #3196

The KEDA external scaler Deployment introduced in chart 0.57.0 hardcodes its container securityContext and omits seccompProfile. On clusters enforcing Pod Security Admission restricted or Kyverno restrict-seccomp-strict, the deployment is rejected:

validation error: ... spec.securityContext.seccompProfile.type ... must be set to RuntimeDefault or Localhost.

Because the values were hardcoded, users had no values-level way to fix it — the only workaround was disabling the external scaler entirely (autoscaling.externalScaler.enabled: false).

Changes

• values.yaml — Add a configurable autoscaling.externalScaler.securityContext value (matching the pattern used by other chart components such as hub and the nodes). Its default preserves the previously hardened settings and adds seccompProfile: {type: RuntimeDefault}, so the chart is PSA restricted compliant out of the box.
• templates/external-scaler.yaml — Render the value via {{- with $scaler.securityContext }} instead of hardcoding, so it is fully overridable (and can be disabled by setting it to null).
• CONFIGURATION.md — Regenerated via helm-docs.

This addresses both remediation options requested in the issue: the securityContext is now configurable and compliant by default.

Verification

• helm lint passes.
• Default render now emits seccompProfile.type: RuntimeDefault alongside the existing hardening.
• Override render (e.g. --set autoscaling.externalScaler.securityContext.seccompProfile.type=Localhost) merges correctly.
• Setting the value to null cleanly omits the block for users who manage security context at the pod level.

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Helm chart: make external scaler securityContext configurable and PSA compliant

🐞 Bug fix ⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Add configurable external scaler container securityContext in values.
• Default to seccompProfile RuntimeDefault for PSA/Kyverno restricted compliance.
• Template now renders securityContext from values; regenerate configuration docs.

Diagram

graph TD
  V["values.yaml"] --> T["external-scaler.yaml template"] --> D(["External scaler Deployment"])
  D --> P{"Admission policy"} --> O(["Accepted by cluster"])

  subgraph Legend
    direction LR
    _cfg["Config/file"] ~~~ _obj(["K8s object"]) ~~~ _dec{"Decision/policy"}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Set seccompProfile at Pod securityContext level

• ➕ Applies a single seccompProfile to all containers consistently
• ➕ Can simplify values surface area for multi-container pods
• ➖ Less flexible if users want per-container securityContext overrides
• ➖ Would require additional chart wiring and may affect other containers if added broadly

2. Expose only seccompProfile as a dedicated value

• ➕ Minimal configuration surface; directly addresses policy failures
• ➕ Avoids users accidentally weakening other hardening defaults
• ➖ Still leaves other securityContext fields hardcoded and non-overridable
• ➖ Inconsistent with existing chart patterns that allow full securityContext overrides

Recommendation: Keep the PR’s approach: exposing the full container securityContext via values matches existing chart patterns and unblocks restricted clusters while preserving hardened defaults. If future issues arise around consistency across containers, consider optionally supporting a pod-level seccompProfile as a complementary setting, but it isn’t required to fix the current breakage.

Files changed (3) +15 / -7

Bug fix (1) +3 / -7

external-scaler.yamlRender external scaler securityContext from values instead of hardcoding +3/-7

Render external scaler securityContext from values instead of hardcoding

• Replaces the hardcoded container securityContext block with a values-driven rendering using a Helm 'with' clause. This makes the securityContext fully overridable and omissible when set to null.

charts/selenium-grid/templates/external-scaler.yaml

Documentation (1) +1 / -0

CONFIGURATION.mdDocument external scaler securityContext value (includes seccompProfile) +1/-0

Document external scaler securityContext value (includes seccompProfile)

• Adds the new autoscaling.externalScaler.securityContext value to the generated configuration table, including the RuntimeDefault seccompProfile default and a note about PSA/Kyverno compliance.

charts/selenium-grid/CONFIGURATION.md

Other (1) +11 / -0

values.yamlAdd autoscaling.externalScaler.securityContext defaults with RuntimeDefault seccomp +11/-0

Add autoscaling.externalScaler.securityContext defaults with RuntimeDefault seccomp

• Introduces a new autoscaling.externalScaler.securityContext value mirroring existing chart component patterns. Defaults preserve prior hardening and add 'seccompProfile.type: RuntimeDefault' for restricted policy compliance.

charts/selenium-grid/values.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can group findings by type and pick your Finding display, from Minimal to Full

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗