helm: Missing container security context settings in continuous_test

[stevensdavid]

Describe the bug

All microservices except continuous_test default to the container security context:

  containerSecurityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop: [ALL]

continuous_test instead defaults to only:

  containerSecurityContext:
    readOnlyRootFilesystem: true

(from operations/helm/charts/mimir-distributed/values.yaml#L4377)

This causes the continuous_test deployment to fail when running with 'pod-security.kubernetes.io/enforce': 'restricted' on the namespace (as recommended for security compliance in Mimir documentation).

To Reproduce

1. Deploy the mimir-distributed Helm chart to a namespace with label 'pod-security.kubernetes.io/enforce': 'restricted' with Helm values continuous_test.enabled = true.
2. Describe the continuous_test replicaset and view error message:

Error creating: pods "mimir-continuous-test-6f676f85d7-85xcv" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "continuous-test" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "continuous-test" must set securityContext.capabilities.drop=["ALL"])

Expected behavior

continuous_test should deploy without issues using the default security context.

Environment

• Infrastructure: [e.g., Kubernetes, bare-metal, laptop]

Kubernetes 1.30 running on AWS EKS.

• Deployment tool: [e.g., helm, jsonnet]

Helm through Terraform, provider version 2.13.2.