hashicorp / hashicorp/vault-helm
Add option to configure pod and container level securityContext
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Is your feature request related to a problem? Please describe.**
It's becoming more common to restrict application namespaces with Pod Security Admission (https://kubernetes.io/docs/concepts/security/pod-security-admission/) especially with restricted Pod Security Standard (https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted).
Unfortunately currently there is no flexible option to configure `securityContext` for pods and containers (e.g. vault-agent-injector) via helm values.
**Describe the solution you'd like**
Add option to configure pod and container level `securityContext` via helm values. In order to be compliant with restricted Pod Security Standard, container's `securityContext` would need to look similar to:
```
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
```
Contributor guide
Research direction
Start by locating the Helm values and templates that render pod and container settings, including the vault-agent-injector resources. Compare the rendered manifests with the restricted Pod Security Standard requirements and use Helm rendering to verify the values. Done means both pod-level and container-level securityContext can be configured through Helm values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100