Add recommendation for securityContext and podSecurityContext (#125)

Co-authored-by: Marco Franssen <[email protected]>

charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml

@@ -33,11 +33,11 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
       securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+        {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
+            {{- include "spire-lib.securitycontext" . | nindent 12 }}
           image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
@@ -76,7 +76,7 @@ spec:
         {{- if .Values.insecureScheme.enabled }}
         - name: nginx
           securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
+            {{- include "spire-lib.securitycontext" . | nindent 12 }}
           image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
           ports:
@@ -98,7 +98,7 @@ spec:
         {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
         - name: nginx-exporter
           securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
+            {{- include "spire-lib.securitycontext" . | nindent 12 }}
           image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
           args:

charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml

@@ -59,11 +59,11 @@ spec:
       restartPolicy: Never
       serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
       securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+        {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
       containers:
       - name: pre-delete-job
         securityContext:
-          {{- toYaml .Values.securityContext | nindent 10 }}
+          {{- include "spire-lib.securitycontext" . | nindent 10 }}
         image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
         args:
           - delete

charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml

@@ -14,26 +14,26 @@ metadata:
     "helm.sh/hook": test
 spec:
   securityContext:
-    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+    {{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
   containers:
     - name: curl-service-name
       image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
       command: ['curl']
       args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
+        {{- include "spire-lib.securitycontext" . | nindent 8 }}
     - name: curl-service-name-namespace
       image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
       command: ['curl']
       args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
+        {{- include "spire-lib.securitycontext" . | nindent 8 }}
     - name: curl-service-name-namespace-svc-cluster-local
       image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
       command: ['curl']
       args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
+        {{- include "spire-lib.securitycontext" . | nindent 8 }}
     {{- if .Values.ingress.enabled }}
     - name: curl-ingress
       image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
@@ -53,7 +53,7 @@ spec:
       args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration']
       {{- end }}
       securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
+        {{- include "spire-lib.securitycontext" . | nindent 8 }}
     {{- end }}
   {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
   hostAliases:

charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml

@@ -8,10 +8,8 @@ metadata:
   annotations:
     "helm.sh/hook": test
 spec:
-  {{- with .Values.podSecurityContext }}
   securityContext:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
   serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
   initContainers:
     - name: static-busybox
@@ -22,10 +20,8 @@ spec:
         - |
           cp /bin/busybox /data/busybox
           chmod +x /data/busybox
-      {{- with .Values.securityContext }}
       securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- include "spire-lib.securitycontext" . | nindent 8 }}
       volumeMounts:
         - name: data-volume
           mountPath: /data
@@ -41,10 +37,8 @@ spec:
             [ $? -eq 0 ] && break
             sleep 1
           done
-      {{- with .Values.securityContext }}
       securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- include "spire-lib.securitycontext" . | nindent 8 }}
       volumeMounts:
         - name: data-volume
           mountPath: /data
@@ -69,10 +63,8 @@ spec:
           {{- (.Files.Get "files/test/jwt-decode.sh") | nindent 10 }}
           EOF
           bash /data/jwt-decode.sh "${URL}"/keys "${JWT}"
-      {{- with .Values.securityContext }}
       securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- include "spire-lib.securitycontext" . | nindent 8 }}
       volumeMounts:
       - mountPath: /data
         name: data-volume