helm: ability to specify security context for pod (kubernetes-sigs#1311)

* helm: ability to specify security context for pod * Update charts/descheduler/templates/cronjob.yaml Co-authored-by: Amir Alavi <amiralavi7@gmail.com> * Update charts/descheduler/templates/deployment.yaml Co-authored-by: Amir Alavi <amiralavi7@gmail.com> --------- Co-authored-by: Amir Alavi <amiralavi7@gmail.com>
knelasevero · Jan 26, 2024 · 910f4c1 · 910f4c1
1 parent 61b8b3a
commit 910f4c1
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 0 deletions.
diff --git a/charts/descheduler/templates/cronjob.yaml b/charts/descheduler/templates/cronjob.yaml
@@ -92,6 +92,10 @@ spec:
               volumeMounts:
                 - mountPath: /policy-dir
                   name: policy-volume
+          {{- if .Values.podSecurityContext }}
+          securityContext:
+            {{- toYaml .Values.podSecurityContext | nindent 12 }}
+          {{- end }}
           volumes:
           - name: policy-volume
             configMap:

diff --git a/charts/descheduler/templates/deployment.yaml b/charts/descheduler/templates/deployment.yaml
@@ -68,6 +68,10 @@ spec:
           volumeMounts:
             - mountPath: /policy-dir
               name: policy-volume
+      {{- if .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- end }}
       volumes:
         - name: policy-volume
           configMap:

diff --git a/charts/descheduler/values.yaml b/charts/descheduler/values.yaml
@@ -32,6 +32,10 @@ securityContext:
   runAsNonRoot: true
   runAsUser: 1000
 
+# podSecurityContext -- [Security context for pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+podSecurityContext: {}
+  # fsGroup: 1000
+
 nameOverride: ""
 fullnameOverride: ""