Add containerSecurityContext to components

[funkypenguin]

Hey guys,

This PR attempts to address the issue raised here : #1286

Basically, it's desirable under some circumstances to allow the user to customize .spec.container.securityContext, to meet compliance requirements (such as apply seccomp policy).

An objection raised in #1286 was that allowing custom securityContext could cause breakage, since some of the apps' UIDs are hard-coded in their docker files. To this end, I've avoided changing the pod securityContexts, and focused only on adding the ability to augment the container securityContext.

This means that in the case of core, for example, the following hard-coded securityContext still applies:

      securityContext:
        runAsUser: 10000
        fsGroup: 10000

But a user could pass this in values.yaml:

core:
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault  

.. which would greatly improve our compliance / security posture, without impacting the intended effect of the hard-coded pod securityContext.

[avthart]

Any update on this PR?

We are also interested as we need this for compliance using the pod security standard restricted profile.

[xhejtman]

Could it be merged? It would resolve also this one: #1472

[msander]

This would be really helpful, otherwise we cannot deploy in an RKE2 Cluster with CIS Mode.

[AkshayRaoSahab]

Hello, Is it ready to merge ?

[98jan]

Any update on that issue, would be really appreciated to have this soon.
As restricted profile is needed and right now we implemented it with a kustomize patch, better would be to have it integrated in the helm chart or to make the securityContext configuration configurable through values.yaml

[MinerYang]

Thanks @funkypenguin
Appreciate of your contributions, we already have a few of PRs to discuss relevant issue to meet several requirements. we will focus triage on this PR #1695.

Will close this PR and please help to review #1695