Add security context

[MinerYang]

No description provided.

[Kajot-dev]

I have one comment. As far as I can see, database and redis use different uids and gids from the rest of the components, so I guess global values.containerSecurityContext would have to either:

• not include runAsUser and fsGroup and these would be hardcoded in the manifests
• in case of database/redis use helm's omit like this omit "runAsUser" "fsGroup" and only have hardcoded uids/gids in in redis/database

[MinerYang]

Hi @Kajot-dev ,

Thanks for your review and sorry for the late response since i just came back from holidays.

We don't expose runAsUser and fsGroup in values.yaml and it is hardcoded in the manifest
And indeed, none of our containers are running as root, however we need explicitly claim this runAsNonRoot: true to meet our restricted pod security standards. https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted

What I initially want to write in values.yaml is a empty yaml looks like below and users could configure it on demand. Current version is just filled with a common template for convenience.

containerSecurityContext: {}

[MinerYang]

relevant PRs:

• Add support to run in the restricted psa policy #1539
• Add securityContext definitions on container level #1673
• Add option to configure securityContext on both pods and containers #1666
• Add containerSecurityContext to components #1304

Thanks @Kajot-dev , @rgarcia89 @dwagelaar , @funkypenguin for all of the contributions!

Let's focus on review this PR to meet several requirements.

[wy65701436]

lgtm

[rgarcia89]

lgtm

[Kajot-dev]

Just one thing in core-pre-upgrade job, the rest looks good to me