influxdata / influxdata/helm-charts

[influxdb] Add containerSecurityContext support to StatefulSet

Open Beginner friendly
#791 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Mustache
Stars
257
Forks
347
Avg merge
4d 20h
Merged PRs (30d)
9

Description

## Summary

The InfluxDB chart exposes pod-level `securityContext`, but does not expose a container-level `containerSecurityContext` value for the main InfluxDB container.

This makes it difficult to meet Kubernetes Restricted Pod Security requirements without using a Helm post-render patch.

## Current behavior

`charts/influxdb/values.yaml` exposes:

```yaml
securityContext: {}
```

`charts/influxdb/templates/statefulset.yaml` renders that value only at the pod level:

```yaml
spec:
template:
spec:
securityContext:
...
containers:
- name: ...
```

There is no chart value rendered to:

```yaml
spec.template.spec.containers[0].securityContext
```

## Expected behavior

The chart should support a container-level security context, for example:

```yaml
containerSecurityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
```

And render it on the InfluxDB container:

```yaml
containers:
- name: influxdb
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
```

## Use case

We deploy InfluxDB in Kubernetes clusters with Restricted Pod Security expectations. Some controls, such as `allowPrivilegeEscalation: false` and `capabilities.drop: ["ALL"]`, must be set at the container level.

Today we have to use a post-render patch:

```yaml
postRenderers:
- kustomize:
patches:
- target:
kind: StatefulSet
name: influxdb
patch: |
- op: add
path: /spec/template/spec/containers/0/securityContext
value:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
```

A native chart value would be simpler, easier to audit, and consistent with other charts that expose both pod and container security contexts.

## Proposed change

Add this to `charts/influxdb/values.yaml`:

```yaml
containerSecurityContext: {}
```

Add this to the main container in `charts/influxdb/templates/statefulset.yaml`:

```yaml
{{- if .Values.containerSecurityContext }}
securityContext:
{{ toYaml .Values.containerSecurityContext | indent 10 }}
{{- end }}
```

This should be backward compatible because the field is only rendered when set.

Contributor guide

Open the contributing guide

Research direction

Start with charts/influxdb/values.yaml and charts/influxdb/templates/statefulset.yaml, comparing the existing pod-level securityContext handling. Render the chart with containerSecurityContext set to the example values and verify the fields appear under spec.template.spec.containers[0].securityContext while the default remains backward compatible.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
85/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.