feat(mysql): drop root init-containers, add PSA-restricted securityContext

[saadqbal]

Summary

• Removes the two runAsUser: 0 init-containers that were chowning /var/lib/mysql and /var/log/mysql to UID 999. The pod-level fsGroup: 999 + fsGroupChangePolicy: OnRootMismatch already achieves the same effect, so the init-containers were redundant — and the last remaining PSA-restricted blocker on the release namespace.
• Adds a container-level securityContext with the six fields PSA restricted requires: runAsNonRoot, runAsUser: 999, runAsGroup: 999, allowPrivilegeEscalation: false, drop all capabilities, seccompProfile: RuntimeDefault.
• Scope: client chart only (the universal chart covering eks/aks/bm/oc variants).

Why

Tier A item in the training-pod hardening plan: promote pod-security.kubernetes.io/{warn,audit}: restricted (added in #43) to enforce: restricted. That was blocked on MySQL being the only remaining non-compliant workload in the release namespace.

Behavior change for existing installs

• Existing PVCs: already owned 999:999 from the prior init-container chown. OnRootMismatch sees correct root ownership and skips the recursive chgrp — mount is instant, no user-visible behavior change.
• Fresh installs: kubelet applies fsGroup to the PVC and emptyDir before the main container starts.
• mysql:5.7.41 entrypoint: detects it's already running as UID 999 and skips its root→mysql gosu re-exec, running mysqld directly as 999.

CSI caveat

fsGroup requires a CSI driver declaring fsGroupPolicy: File or ReadWriteOnceWithFSType. Supported: EBS, AzureDisk, GCE-PD, CephRBD, local-path. Not supported: NFS v3 and some object-backed drivers. Chart NOTES.txt warning is a follow-up.

Deferred to a separate PR

• readOnlyRootFilesystem: true on the mysql container — needs emptyDir mounts for /tmp, /run/mysqld, /var/lib/mysql-files; real regression risk that deserves its own test cycle.

Test plan

• helm template client/ --set storageClass.provisioner=kubernetes.io/no-provisioner renders cleanly with no init-container and the container-level securityContext present
• Fresh install on AKS (cgroup v2, Azure Disk CSI) — mysql pod reaches Ready, mysqladmin ping passes
• Upgrade-in-place on an existing cluster with data-bearing PVC — no restart loops, OnRootMismatch skips rechown, data preserved
• Apply pod-security.kubernetes.io/enforce: restricted label to release namespace — pod still admits
• kubectl exec mysql-client-* -- id returns uid=999(mysql) gid=999(mysql)
• kubectl exec mysql-client-* -- ls -la /var/lib/mysql | head -3 shows 999 999 ownership

Related

• Add optional Namespace resource with Pod Security Admission labels #43 — PSA labels (warn/audit) merged
• Add consolidated docs/SECURITY.md #44 — SECURITY.md consolidated
• [training-pod hardening plan §6 Tier A]

---

Note

Medium Risk
Changes MySQL pod startup/permissions by removing root-based init work in most cases and enforcing non-root, restricted PSA settings; misconfigured storage drivers or existing volume ownership could cause startup failures.

Overview
Updates the mysql-client Deployment to comply with Pod Security Admission (restricted) by running the main container as non-root (runAsUser/runAsGroup: 999), disabling privilege escalation, dropping all capabilities, and enabling seccompProfile: RuntimeDefault.

Reworks volume ownership bootstrapping by removing the log chown init-container and making the remaining /var/lib/mysql chown init-container conditional on hostPath.enabled (assuming CSI-backed volumes rely on fsGroup/OnRootMismatch instead).

^{Reviewed by Cursor Bugbot for commit 097ce50. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8184c64. Configure here.}