Add option to customize pod/containerSecurityContext

charts/k-rail/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 name: k-rail
 description: Kubernetes security tool for policy enforcement
 home: https://github.com/cruise-automation/k-rail
-version: v3.6.1
+version: v3.6.2
 maintainers:
   - name: cruise-automation
     url: https://cruise-automation.github.io/k-rail/

charts/k-rail/templates/deployment.yaml

@@ -83,6 +83,10 @@ spec:
         checksum/tls: {{ print $ca.Cert | sha256sum }}
     spec:
       serviceAccountName: k-rail
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: k-rail
           command: ["/k-rail", "-config=/config/config.yml", "-exemptions-path-glob=/exemptions/*.yml"]
@@ -100,8 +104,10 @@ spec:
             - name: exemptions
               mountPath: /exemptions
               readOnly: true
+        {{- with .Values.containerSecurityContext }}
           securityContext:
-            readOnlyRootFilesystem: true
+          {{- toYaml . | nindent 12 }}    
+        {{- end }}
           ports:
             - containerPort: 10250
             - containerPort: 8000

charts/k-rail/values.yaml

@@ -23,6 +23,13 @@ tolerations: []
 
 affinity: {}
 
+## securityContext to apply to the pod
+podSecurityContext: {}
+
+## securityContext to apply to the container
+containerSecurityContext:
+  readOnlyRootFilesystem: true
+
 # Set to the value (in seconds) which the mutatingwebhook should use for a timeout
 # for slower clusters (or larger workloads) this may need to be increased
 webhookTimeout: 1