feat: Add Helm configuration for container security context

[gonmmarques]

Hello there,

Saw this issue #402 marked as good first issue and decided to give it a try.

Tried to follow a contributing guide, but only found #330.

Anyways, let me know if I missed something or is something wrong.

The way it is now added, by default the fields are optional for both of the containers in the deployment, but someone can change it in the Helm installation by setting the values e.g for manager container below:

manager:
  # ...
  # manager.containerSecurityContext -- A security context defines privileges and access control settings for the container.
  containerSecurityContext: {
    "runAsNonRoot": true,
    "runAsUser": 1000,
    "runAsGroup": 1000,
    "allowPrivilegeEscalation": false,
    "seccompProfile": {
      "type": "RuntimeDefault"
    },
    "capabilities": {
      "drop": [
        "ALL"
      ]
    }
  }

Checked it by running locally the helm template and it rendered

    spec:
      containers:
        - name: manager
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault

Closes: #402

[CLAassistant]

All committers have signed the CLA.

[yorugac]

Hi @gonmmarques, thanks for working on this!
The PR LGTM, the only thing left is to run helm-docs (that will be in contributing guide for Helm additions).

However, I've just noticed that the issue didn't specify whether it was about pod's securityContext or about container's securityContext 😕 For example seccompProfile is present in both.
I.e. it could be that container's one will not be sufficient for that case. @MohanedSaad, could you please clarify that bit?

[MohanedSaad]

container's

Hi, thanks for picking this up. The container one should be enough for our case 😊

[gonmmarques]

Hello @yorugac

I will run the tool. Given the @MohanedSaad feedback, is there anything still missing?

[yorugac]

Thanks for the update @gonmmarques and for feedback, @MohanedSaad!