Make securityContext configurable

helm/designate-certmanager-webhook/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "0.2.18"
 description: ACME webhook Implementation for OpenStack Designate
 name: designate-certmanager-webhook
-version: "0.5.0"
+version: "0.6.0"

helm/designate-certmanager-webhook/templates/deployment.yaml

@@ -23,9 +23,13 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       serviceAccountName: {{ include "designate-certmanager-webhook.fullname" . }}
       initContainers:
         - name: wait-for-tls-secret
+          securityContext:
+            {{- toYaml .Values.alpine.securityContext | nindent 12 }}
           image: "{{ .Values.alpine.image.repository }}:{{ .Values.alpine.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           volumeMounts:
@@ -38,6 +42,8 @@ spec:
             - -c
             - "while [ ! -f /tls/tls.key ]; do sleep 5; done"
         - name: add-apiservice
+          securityContext:
+            {{- toYaml .Values.kubectl.securityContext | nindent 12 }}
           image: "{{ .Values.kubectl.image.repository }}:{{ .Values.kubectl.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           volumeMounts:
@@ -53,6 +59,8 @@ spec:
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             - --tls-cert-file=/tls/tls.crt

helm/designate-certmanager-webhook/values.yaml

@@ -9,14 +9,20 @@ image:
   tag: 0.2.18
   pullPolicy: IfNotPresent
 
+podSecurityContext: {}
+securityContext: {}
+
 alpine:
   image:
     repository: alpine
     tag: latest
+  securityContext: {}
+
 kubectl:
   image:
     repository: bitnami/kubectl
     tag: latest
+  securityContext: {}
 
 imagePullSecrets: []