support pod securitycontext and container security context

templates/dag-deploy/dag-server-statefulset.yaml

@@ -41,7 +41,7 @@ spec:
         - name: {{ template "astro.registry_secret" . }}
       {{- end }}
       serviceAccountName: {{ .Release.Name }}-dag-server
-      securityContext: {{ toYaml .Values.dagDeploy.securityContext | nindent 8 }}
+      securityContext: {{ toYaml .Values.dagDeploy.securityContexts.pod | nindent 8 }}
       containers:
         - name: dag-server
           image: "{{ .Values.dagDeploy.images.dagServer.repository }}:{{ .Values.dagDeploy.images.dagServer.tag }}"
@@ -50,6 +50,7 @@ spec:
           ports:
           - name: server
             containerPort: {{ .Values.dagDeploy.ports.dagServerHttp }}
+          securityContext: {{ toYaml .Values.dagDeploy.securityContexts.container  | nindent 12 }}
           resources:
             {{- toYaml .Values.dagDeploy.resources | nindent 12 }}
           env:

tests/chart/test_dag_server_statefulset.py

@@ -72,11 +72,20 @@ def test_dag_server_statefulset_with_resource_overrides(self, kube_version):
         c_by_name = get_containers_by_name(doc)
         assert c_by_name["dag-server"]["resources"] == resources
 
-    def test_dag_server_statefulset_with_securitycontext_overrides(self, kube_version):
+    def test_dag_server_statefulset_with_podsecuritycontext_overrides(
+        self, kube_version
+    ):
         """Test that dag-server statefulset are configurable with custom securitycontext."""
-        dag_serversecuritycontext = {"runAsUser": 12345, "privileged": True}
+        dag_server_pod_securitycontext = {"runAsUser": 12345, "privileged": True}
+        dag_server_container_securitycontext = {"allowPrivilegeEscalation": False}
         values = {
-            "dagDeploy": {"enabled": True, "securityContext": dag_serversecuritycontext}
+            "dagDeploy": {
+                "enabled": True,
+                "securityContexts": {
+                    "pod": dag_server_pod_securitycontext,
+                    "container": dag_server_container_securitycontext,
+                },
+            }
         }
 
         docs = render_chart(
@@ -90,9 +99,13 @@ def test_dag_server_statefulset_with_securitycontext_overrides(self, kube_versio
         assert doc["apiVersion"] == "apps/v1"
         assert doc["metadata"]["name"] == "release-name-dag-server"
         assert (
-            dag_serversecuritycontext
+            dag_server_pod_securitycontext
             == doc["spec"]["template"]["spec"]["securityContext"]
         )
+        assert (
+            dag_server_container_securitycontext
+            == doc["spec"]["template"]["spec"]["containers"][0]["securityContext"]
+        )
 
     def test_dag_server_statefulset_with_custom_registry_secret(self, kube_version):
         """Test dag-server statefulset with custom registry secret."""

values.yaml

@@ -570,9 +570,9 @@ dagDeploy:
   # when it wants to scale a node down.
   safeToEvict: true
 
-  securityContext: {}
-  #  runAsUser: 999
-  #  runAsGroup: 0
+  securityContexts:
+    pod: {}
+    container: {}
 
 gitSyncRelay:
   enabled: ~