From 451e4f636b1146b9cc048f1f14f365a586037523 Mon Sep 17 00:00:00 2001
From: d3adb5 <me@d3adb5.net>
Date: Sun, 5 Feb 2023 20:51:03 -0800
Subject: [PATCH] feat: set read-only root filesystem at container level

Change the securityContext field of the Reloader container if
reloader.readOnlyFilesystem is set to true. The change takes effect even
if not container securityContext is defined.

Closes #339.
---
 .../chart/reloader/templates/deployment.yaml  | 10 ++--
 .../chart/reloader/tests/deployment_test.yaml | 50 +++++++++++++++++++
 2 files changed, 57 insertions(+), 3 deletions(-)
 create mode 100644 deployments/kubernetes/chart/reloader/tests/deployment_test.yaml

diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
index 3f99c8d9..2e6546a3 100644
--- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
@@ -148,9 +148,13 @@ spec:
           periodSeconds: {{ .Values.reloader.deployment.readinessProbe.periodSeconds | default "10" }}
           successThreshold: {{ .Values.reloader.deployment.readinessProbe.successThreshold | default "1" }}
 
-      {{- with .Values.reloader.deployment.containerSecurityContext }}
-        securityContext: {{ toYaml . | nindent 10 }}
-      {{- end }}
+        {{- $containerSecurityContext := .Values.reloader.deployment.containerSecurityContext | default dict }}
+        {{- if .Values.reloader.readOnlyRootFilesystem }}
+          {{- $_ := set $containerSecurityContext "readOnlyRootFilesystem" true }}
+        {{- end }}
+
+        securityContext:
+          {{- toYaml $containerSecurityContext | nindent 10 }}
 
       {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
         volumeMounts:
diff --git a/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml b/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml
new file mode 100644
index 00000000..ef6c6e47
--- /dev/null
+++ b/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml
@@ -0,0 +1,50 @@
+suite: Deployment
+
+templates:
+  - deployment.yaml
+
+tests:
+  - it: sets readOnlyRootFilesystem in container securityContext when reloader.readOnlyRootFilesystem is true
+    set:
+      reloader:
+        readOnlyRootFilesystem: true
+        deployment:
+          containerSecurityContext:
+            readOnlyRootFilesystem: false
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+
+  - it: sets readOnlyRootFilesystem in container securityContext even if reloader.deployment.containerSecurityContext is null
+    set:
+      reloader:
+        readOnlyRootFilesystem: true
+        deployment:
+          containerSecurityContext: null
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+
+  - it: does not override readOnlyRootFilesystem in container securityContext based on reloader.readOnlyRootFilesystem
+    set:
+      reloader:
+        readOnlyRootFilesystem: false
+        deployment:
+          containerSecurityContext:
+            readOnlyRootFilesystem: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+
+  - it: template is still valid with no defined containerSecurityContext
+    set:
+      reloader:
+        readOnlyRootFilesystem: false
+        deployment:
+          containerSecurityContext: null
+    asserts:
+      - isEmpty:
+          path: spec.template.spec.containers[0].securityContext