add securityContext to allow running with strict PSP (#11547)

Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>

stable/kuberhealthy/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "1.0.0"
 home: https://comcast.github.io/kuberhealthy/
 description: The official Helm chart for Kuberhealthy.
 name: kuberhealthy
-version: 1.0.2
+version: 1.1.0
 maintainers:
   - name: integrii
     email: eric.greer@comcast.com

stable/kuberhealthy/README.md

@@ -54,6 +54,11 @@ deployment:
   maxUnavailable: 1
   imagePullPolicy: IfNotPresent
   namespace: kuberhealthy
+securityContext: # default container security context
+  runAsNonRoot: true
+  runAsUser: 999
+  fsGroup: 999
+  allowPrivilegeEscalation: false
 ```
 
 

stable/kuberhealthy/templates/deployment.yaml

@@ -30,6 +30,8 @@ spec:
       automountServiceAccountToken: true
       containers:
       - image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+        securityContext:
+        {{- toYaml .Values.securityContext | nindent 10 -}}
         imagePullPolicy: {{ .Values.deployment.imagePullPolicy }}
         livenessProbe:
           failureThreshold: 3

stable/kuberhealthy/values.yaml

@@ -31,6 +31,12 @@ deployment:
   maxUnavailable: 1
   imagePullPolicy: IfNotPresent
 
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 999
+  fsGroup: 999
+  allowPrivilegeEscalation: false
+
 # Please remember that changing the service type to LoadBalancer
 # will expose Kuberhealthy to the internet, which could cause
 # error messages shown by Kuberhealthy to be exposed to the