hashicorp / hashicorp/vault-helm

Add option to configure pod and container level securityContext

Open
#764 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**
It's becoming more common to restrict application namespaces with Pod Security Admission (https://kubernetes.io/docs/concepts/security/pod-security-admission/) especially with restricted Pod Security Standard (https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted).
Unfortunately currently there is no flexible option to configure `securityContext` for pods and containers (e.g. vault-agent-injector) via helm values.

**Describe the solution you'd like**
Add option to configure pod and container level `securityContext` via helm values. In order to be compliant with restricted Pod Security Standard, container's `securityContext` would need to look similar to:
```
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
```

Contributor guide

Open the contributing guide

Research direction

Start by locating the Helm values and templates that render pod and container settings, including the vault-agent-injector resources. Compare the rendered manifests with the restricted Pod Security Standard requirements and use Helm rendering to verify the values. Done means both pod-level and container-level securityContext can be configured through Helm values.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
infrastructure, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.