From 21087aaddc69bac237d823d8ab26027137136b94 Mon Sep 17 00:00:00 2001
From: Ruins He <lyhypacm@gmail.com>
Date: Sun, 12 Dec 2021 15:24:22 +0800
Subject: [PATCH 1/2] feat(kubernetes/chart): add container security context
 support for Helm chart

Signed-off-by: Ruins He <lyhypacm@gmail.com>
---
 .../kubernetes/chart/reloader/templates/deployment.yaml   | 4 ++++
 deployments/kubernetes/chart/reloader/values.yaml         | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
index 7b89f078..fb5828bd 100644
--- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
@@ -114,6 +114,10 @@ spec:
           periodSeconds: {{ .Values.reloader.deployment.readinessProbe.periodSeconds | default "10" }}
           successThreshold: {{ .Values.reloader.deployment.readinessProbe.successThreshold | default "1" }}
 
+      {{- with .Values.reloader.deployment.containerSecurityContext }}
+        securityContext: {{ toYaml . | nindent 10 }}
+      {{- end }}
+
       {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
         volumeMounts:
           - mountPath: /tmp/
diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml
index b7c7e406..debdab17 100644
--- a/deployments/kubernetes/chart/reloader/values.yaml
+++ b/deployments/kubernetes/chart/reloader/values.yaml
@@ -41,6 +41,14 @@ reloader:
       runAsNonRoot: true
       runAsUser: 65534
 
+    containerSecurityContext: {}
+      # capabilities:
+      #   drop:
+      #     - ALL
+      # allowPrivilegeEscalation: false
+      # readOnlyRootFilesystem: true
+
+
     # A list of tolerations to be applied to the Deployment.
     # Example:
     #   tolerations:

From fa75df8e96fb89b3e59eea4577cf68cf81fb2473 Mon Sep 17 00:00:00 2001
From: Ruins He <lyhypacm@gmail.com>
Date: Mon, 3 Jan 2022 18:22:43 +0800
Subject: [PATCH 2/2] feat(kubernetes/chart): add container security context
 configuration into values.yaml.tpl

Signed-off-by: Ruins He <lyhypacm@gmail.com>
---
 deployments/kubernetes/chart/reloader/values.yaml       | 1 -
 deployments/kubernetes/templates/chart/values.yaml.tmpl | 7 +++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml
index debdab17..88e43f82 100644
--- a/deployments/kubernetes/chart/reloader/values.yaml
+++ b/deployments/kubernetes/chart/reloader/values.yaml
@@ -48,7 +48,6 @@ reloader:
       # allowPrivilegeEscalation: false
       # readOnlyRootFilesystem: true
 
-
     # A list of tolerations to be applied to the Deployment.
     # Example:
     #   tolerations:
diff --git a/deployments/kubernetes/templates/chart/values.yaml.tmpl b/deployments/kubernetes/templates/chart/values.yaml.tmpl
index 084661ba..0c1c34e7 100644
--- a/deployments/kubernetes/templates/chart/values.yaml.tmpl
+++ b/deployments/kubernetes/templates/chart/values.yaml.tmpl
@@ -40,6 +40,13 @@ reloader:
       runAsNonRoot: true
       runAsUser: 65534
 
+    containerSecurityContext: {}
+      # capabilities:
+      #   drop:
+      #     - ALL
+      # allowPrivilegeEscalation: false
+      # readOnlyRootFilesystem: true
+
     # A list of tolerations to be applied to the Deployment.
     # Example:
     #   tolerations: