set securityContext for http-add-on chart

http-add-on/Chart.yaml

@@ -11,7 +11,7 @@ kubeVersion: ">=v1.23.0-0"
 # to the chart and its templates, including the app version. This is incremented at chart release time and does not need
 # to be included in any PRs to main.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.0
+version: 0.7.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

http-add-on/templates/interceptor/deployment.yaml

@@ -21,6 +21,13 @@ spec:
       imagePullSecrets: 
         {{- toYaml .Values.interceptor.imagePullSecrets | nindent 8 }}
       serviceAccountName: {{ .Chart.Name }}-interceptor
+      {{- if .Values.podSecurityContext.interceptor }}
+      securityContext:
+      {{- toYaml .Values.podSecurityContext.interceptor | nindent 8 }}
+      {{- else }}
+      securityContext:
+      {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- end }}
       containers:
       - args:
         image: "{{ .Values.images.interceptor }}:{{ .Values.images.tag | default .Chart.AppVersion }}"
@@ -60,6 +67,13 @@ spec:
           name: inter-proxy
         resources:
           {{- toYaml .Values.interceptor.resources | nindent 10 }}
+        {{- if .Values.securityContext.interceptor }}
+        securityContext:
+        {{- toYaml .Values.securityContext.interceptor | nindent 10 }}
+        {{- else }}
+        securityContext:
+        {{- toYaml .Values.securityContext | nindent 10 }}
+        {{- end }}
       terminationGracePeriodSeconds: 10
       nodeSelector:
         kubernetes.io/os: linux

http-add-on/templates/operator/deployment.yaml

@@ -21,21 +21,35 @@ spec:
       imagePullSecrets: 
         {{- toYaml .Values.operator.imagePullSecrets | nindent 8 }}
       serviceAccountName: {{ .Chart.Name }}
+      {{- if .Values.podSecurityContext.operator }}
+      securityContext:
+      {{- toYaml .Values.podSecurityContext.operator | nindent 8 }}
+      {{- else }}
+      securityContext:
+      {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- end }}
       containers:
       - args:
         - --secure-listen-address=0.0.0.0:{{ .Values.operator.port | default 8443 }}
         - --upstream=http://127.0.0.1:8080/
         - --logtostderr=true
         - --v=10
         image: "{{ .Values.images.kubeRbacProxy.name }}:{{ .Values.images.kubeRbacProxy.tag }}"
+        name: kube-rbac-proxy
         resources:
             limits:
               cpu: 300m
               memory: 200Mi
             requests:
               cpu: 10m
               memory: 20Mi
-        name: kube-rbac-proxy
+        {{- if .Values.securityContext.kuberbacproxy }}
+        securityContext:
+        {{- toYaml .Values.securityContext.kuberbacproxy | nindent 10 }}
+        {{- else }}
+        securityContext:
+        {{- toYaml .Values.securityContext | nindent 10 }}
+        {{- end }}
       - args:
         - --metrics-bind-address=127.0.0.1:8080
         - --leader-elect
@@ -66,6 +80,13 @@ spec:
             port: probes
         resources:
           {{- toYaml .Values.operator.resources | nindent 10 }}
+        {{- if .Values.securityContext.operator }}
+        securityContext:
+        {{- toYaml .Values.securityContext.operator | nindent 10 }}
+        {{- else }}
+        securityContext:
+        {{- toYaml .Values.securityContext | nindent 10 }}
+        {{- end }}
       terminationGracePeriodSeconds: 10
       nodeSelector:
         kubernetes.io/os: linux

http-add-on/templates/scaler/deployment.yaml

@@ -21,6 +21,13 @@ spec:
       imagePullSecrets: 
         {{- toYaml .Values.scaler.imagePullSecrets | nindent 8 }}
       serviceAccountName: {{ .Chart.Name }}-external-scaler
+      {{- if .Values.podSecurityContext.scaler }}
+      securityContext:
+      {{- toYaml .Values.podSecurityContext.scaler | nindent 8 }}
+      {{- else }}
+      securityContext:
+      {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- end }}
       containers:
       - args:
         image: "{{ .Values.images.scaler }}:{{ .Values.images.tag | default .Chart.AppVersion }}"
@@ -48,6 +55,13 @@ spec:
           value: "{{ .Values.scaler.streamInterval }}"
         resources:
           {{- toYaml .Values.scaler.resources | nindent 10 }}
+        {{- if .Values.securityContext.scaler }}
+        securityContext:
+        {{- toYaml .Values.securityContext.scaler | nindent 10 }}
+        {{- else }}
+        securityContext:
+        {{- toYaml .Values.securityContext | nindent 10 }}
+        {{- end }}
       terminationGracePeriodSeconds: 10
       nodeSelector:
         kubernetes.io/os: linux

http-add-on/values.yaml

@@ -158,3 +158,90 @@ images:
 rbac:
   # -- Install aggregate roles for edit and view
   aggregateToDefaultRoles: false
+
+# -- [Security context] for all containers
+# @default -- [See below](#KEDA-is-secure-by-default)
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+    - ALL
+  privileged: false
+  readOnlyRootFilesystem: true
+  runAsUser: 1000
+  runAsGroup: 1000
+
+podSecurityContext:
+  fsGroup: 1000
+  supplementalGroups:
+  - 1000
+  # -- [Security context] of the operator container
+  # @default -- [See below](#KEDA-is-secure-by-default)
+  # operator:
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # allowPrivilegeEscalation: false
+    # readOnlyRootFilesystem: true
+    # seccompProfile:
+    #   type: RuntimeDefault
+  # -- [Security context] of the kuberbacproxy container
+  # @default -- [See below](#KEDA-is-secure-by-default)
+  # kuberbacproxy:
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # allowPrivilegeEscalation: false
+    # readOnlyRootFilesystem: true
+    # seccompProfile:
+    #   type: RuntimeDefault
+  # -- [Security context] of the scaler container
+  # @default -- [See below](#KEDA-is-secure-by-default)
+  # scaler:
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # allowPrivilegeEscalation: false
+    # readOnlyRootFilesystem: true
+    # seccompProfile:
+    #   type: RuntimeDefault
+  # -- [Security context] of the interceptor container
+  # @default -- [See below](#KEDA-is-secure-by-default)
+  # interceptor:
+    # capabilities:
+    #  drop:
+    #  - ALL
+    # allowPrivilegeEscalation: false
+    # readOnlyRootFilesystem: true
+    # seccompProfile:
+    #   type: RuntimeDefault
+
+# --  [Pod security context] for all pods
+# @default -- [See below](#KEDA-is-secure-by-default)
+podSecurityContext:
+  fsGroup: 1000
+  supplementalGroups:
+  - 1000
+  # -- [Pod security context] of the KEDA operator pod
+  # @default -- [See below](#KEDA-is-secure-by-default)
+  # operator:
+    # runAsNonRoot: true
+    # runAsUser: 1000
+    # runAsGroup: 1000
+    # fsGroup: 1000
+
+  # -- [Pod security context] of the KEDA scaler pod
+  # @default -- [See below](#KEDA-is-secure-by-default)
+  # scaler:
+    # runAsNonRoot: true
+    # runAsUser: 1000
+    # runAsGroup: 1000
+    # fsGroup: 1000
+
+  # -- [Pod security context] of the KEDA interceptor pod
+  # @default -- [See below](#KEDA-is-secure-by-default)
+  # interceptor:
+    # runAsNonRoot: true
+    # runAsUser: 1000
+    # runAsGroup: 1000
+    # fsGroup: 1000