Skip to content

Commit 57f6afc

Browse files
MaciejKarasviveksinghggits
MaciejKaras
and
viveksinghggits
authored
CLOUDP-323936 - re-add securityContext settings to HelmCharts (#500)
# Summary This PR re-introduces missing `securityContext` and `podSecurityContext` operator values that were previously available for MCO operator. Resolves #168 ## Proof of Work Passing new `operator_security_context_test` helmchart test. ## Checklist - [x] Have you linked a jira ticket and/or is the ticket in the title? - [x] Have you checked whether your jira ticket required DOCSP changes? - [x] https://jira.mongodb.org/browse/DOCSP-54487 - [x] Have you added changelog file? - use `skip-changelog` label if not needed - refer to [Changelog files and Release Notes](https://github.com/mongodb/mongodb-kubernetes/blob/master/CONTRIBUTING.md#changelog-files-and-release-notes) section in CONTRIBUTING.md for more details --------- Co-authored-by: Vivek Singh <vsingh.ggits.2010@gmail.com>
1 parent d3a93a2 commit 57f6afc

File tree

4 files changed

+161
-4
lines changed

4 files changed

+161
-4
lines changed

‎changelog/20251007_feature_reintroduce_securitycontext_operator_setting_in.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
kind: feature
3+
date: 2025-10-07
4+
---
5+
6+
* **Helm Chart**: Introduced two new helm fields `operator.podSecurityContext` and `operator.securityContext` that can be used to configure `securityContext` for Operator deployment through Helm Chart.

‎helm_chart/templates/operator.yaml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,10 @@ spec:
3232
{{- end }}
3333
spec:
3434
serviceAccountName: {{ .Values.operator.name }}
35-
{{- if not .Values.managedSecurityContext }}
35+
{{- if and (not .Values.managedSecurityContext) .Values.operator.podSecurityContext }}
3636
securityContext:
37-
runAsNonRoot: true
38-
runAsUser: 2000
39-
{{- end }}
37+
{{- toYaml .Values.operator.podSecurityContext | nindent 8 }}
38+
{{- end }}
4039
{{- if .Values.registry.imagePullSecrets}}
4140
imagePullSecrets:
4241
- name: {{ .Values.registry.imagePullSecrets }}
@@ -74,6 +73,10 @@ spec:
7473
requests:
7574
cpu: {{ .Values.operator.resources.requests.cpu }}
7675
memory: {{ .Values.operator.resources.requests.memory }}
76+
{{- if and (not .Values.managedSecurityContext) .Values.operator.securityContext }}
77+
securityContext:
78+
{{- toYaml .Values.operator.securityContext | nindent 12 }}
79+
{{- end }}
7780
env:
7881
- name: OPERATOR_ENV
7982
value: {{ .Values.operator.env }}

‎helm_chart/tests/operator_security_context_test.yaml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
suite: test operator security context settings for values.yaml
2+
templates:
3+
- operator.yaml
4+
tests:
5+
- it: default values are properly set
6+
asserts:
7+
- exists:
8+
path: spec.template.spec.securityContext
9+
- equal:
10+
path: spec.template.spec.securityContext.runAsNonRoot
11+
value: true
12+
- equal:
13+
path: spec.template.spec.securityContext.runAsUser
14+
# noinspection YAMLIncompatibleTypes
15+
value: 2000
16+
- notExists:
17+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].securityContext
18+
- it: drop podSecurityContext and securityContext completely
19+
set:
20+
operator.podSecurityContext:
21+
operator.securityContext:
22+
asserts:
23+
- notExists:
24+
path: spec.template.spec.securityContext
25+
- notExists:
26+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].securityContext
27+
- it: drop podSecurityContext and securityContext completely when managedSecurityContext is true
28+
set:
29+
managedSecurityContext: true
30+
asserts:
31+
- notExists:
32+
path: spec.template.spec.securityContext
33+
- notExists:
34+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].securityContext
35+
- it: custom values are properly set
36+
set:
37+
operator.podSecurityContext.runAsNonRoot: false
38+
operator.podSecurityContext.seccompProfile.type: RuntimeDefault
39+
operator.securityContext.allowPrivilegeEscalation: false
40+
operator.securityContext.capabilities.drop: [ALL]
41+
asserts:
42+
- exists:
43+
path: spec.template.spec.securityContext
44+
- equal:
45+
path: spec.template.spec.securityContext.runAsNonRoot
46+
value: false
47+
- equal:
48+
path: spec.template.spec.securityContext.seccompProfile.type
49+
# noinspection YAMLIncompatibleTypes
50+
value: RuntimeDefault
51+
- equal:
52+
path: spec.template.spec.securityContext.runAsUser
53+
# noinspection YAMLIncompatibleTypes
54+
value: 2000
55+
- exists:
56+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].securityContext
57+
- equal:
58+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].securityContext.allowPrivilegeEscalation
59+
value: false
60+
- equal:
61+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].securityContext.capabilities.drop
62+
value: [ALL]
63+
- it: default values are properly set when managedSecurityContext is true for openShift
64+
values:
65+
- ../values-openshift.yaml
66+
asserts:
67+
- notExists:
68+
path: spec.template.spec.securityContext
69+
- notExists:
70+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].securityContext
71+
- exists:
72+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].env[?(@.name=="MANAGED_SECURITY_CONTEXT")]
73+
- equal:
74+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator")].env[?(@.name=="MANAGED_SECURITY_CONTEXT")].value
75+
# noinspection YAMLIncompatibleTypes
76+
value: "true"
77+
- it: default values are properly set for multi-cluster deployment
78+
values:
79+
- ../values-multi-cluster.yaml
80+
asserts:
81+
- exists:
82+
path: spec.template.spec.securityContext
83+
- equal:
84+
path: spec.template.spec.securityContext.runAsNonRoot
85+
value: true
86+
- equal:
87+
path: spec.template.spec.securityContext.runAsUser
88+
# noinspection YAMLIncompatibleTypes
89+
value: 2000
90+
- notExists:
91+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator-multi-cluster")].securityContext
92+
- it: drop podSecurityContext and securityContext completely for multi-cluster deployment
93+
values:
94+
- ../values-multi-cluster.yaml
95+
set:
96+
operator.podSecurityContext:
97+
operator.securityContext:
98+
asserts:
99+
- notExists:
100+
path: spec.template.spec.securityContext
101+
- notExists:
102+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator-multi-cluster")].securityContext
103+
- it: drop podSecurityContext and securityContext completely when managedSecurityContext is true for multi-cluster deployment
104+
values:
105+
- ../values-multi-cluster.yaml
106+
set:
107+
managedSecurityContext: true
108+
asserts:
109+
- notExists:
110+
path: spec.template.spec.securityContext
111+
- notExists:
112+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator-multi-cluster")].securityContext
113+
- it: custom values are properly set for multi-cluster deployment
114+
values:
115+
- ../values-multi-cluster.yaml
116+
set:
117+
operator.podSecurityContext.runAsNonRoot: false
118+
operator.podSecurityContext.seccompProfile.type: RuntimeDefault
119+
operator.securityContext.allowPrivilegeEscalation: false
120+
operator.securityContext.capabilities.drop: [ ALL ]
121+
asserts:
122+
- exists:
123+
path: spec.template.spec.securityContext
124+
- equal:
125+
path: spec.template.spec.securityContext.runAsNonRoot
126+
value: false
127+
- equal:
128+
path: spec.template.spec.securityContext.seccompProfile.type
129+
# noinspection YAMLIncompatibleTypes
130+
value: RuntimeDefault
131+
- equal:
132+
path: spec.template.spec.securityContext.runAsUser
133+
# noinspection YAMLIncompatibleTypes
134+
value: 2000
135+
- exists:
136+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator-multi-cluster")].securityContext
137+
- equal:
138+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator-multi-cluster")].securityContext.allowPrivilegeEscalation
139+
value: false
140+
- equal:
141+
path: spec.template.spec.containers[?(@.name=="mongodb-kubernetes-operator-multi-cluster")].securityContext.capabilities.drop
142+
value: [ ALL ]

‎helm_chart/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,12 @@ operator:
4747
cpu: 1100m
4848
memory: 1Gi
4949

50+
podSecurityContext:
51+
runAsNonRoot: true
52+
runAsUser: 2000
53+
54+
securityContext: {}
55+
5056
# Control how many reconciles can be performed in parallel.
5157
# It sets MaxConcurrentReconciles https://pkg.go.dev/github.com/kubernetes-sigs/controller-runtime/pkg/controller#Options).
5258
# Increasing the number of concurrent reconciles will decrease the time needed to reconcile all watched resources.

0 commit comments

Comments
 (0)