influxdata / influxdata/helm-charts
[influxdb] Add containerSecurityContext support to StatefulSet
- Dominant language
- Mustache
- Stars
- 257
- Forks
- 347
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 9
Description
## Summary
The InfluxDB chart exposes pod-level `securityContext`, but does not expose a container-level `containerSecurityContext` value for the main InfluxDB container.
This makes it difficult to meet Kubernetes Restricted Pod Security requirements without using a Helm post-render patch.
## Current behavior
`charts/influxdb/values.yaml` exposes:
```yaml
securityContext: {}
```
`charts/influxdb/templates/statefulset.yaml` renders that value only at the pod level:
```yaml
spec:
template:
spec:
securityContext:
...
containers:
- name: ...
```
There is no chart value rendered to:
```yaml
spec.template.spec.containers[0].securityContext
```
## Expected behavior
The chart should support a container-level security context, for example:
```yaml
containerSecurityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
```
And render it on the InfluxDB container:
```yaml
containers:
- name: influxdb
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
```
## Use case
We deploy InfluxDB in Kubernetes clusters with Restricted Pod Security expectations. Some controls, such as `allowPrivilegeEscalation: false` and `capabilities.drop: ["ALL"]`, must be set at the container level.
Today we have to use a post-render patch:
```yaml
postRenderers:
- kustomize:
patches:
- target:
kind: StatefulSet
name: influxdb
patch: |
- op: add
path: /spec/template/spec/containers/0/securityContext
value:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
```
A native chart value would be simpler, easier to audit, and consistent with other charts that expose both pod and container security contexts.
## Proposed change
Add this to `charts/influxdb/values.yaml`:
```yaml
containerSecurityContext: {}
```
Add this to the main container in `charts/influxdb/templates/statefulset.yaml`:
```yaml
{{- if .Values.containerSecurityContext }}
securityContext:
{{ toYaml .Values.containerSecurityContext | indent 10 }}
{{- end }}
```
This should be backward compatible because the field is only rendered when set.
Contributor guide
Research direction
Start with charts/influxdb/values.yaml and charts/influxdb/templates/statefulset.yaml, comparing the existing pod-level securityContext handling. Render the chart with containerSecurityContext set to the example values and verify the fields appear under spec.template.spec.containers[0].securityContext while the default remains backward compatible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 85/100