Add recommendation for securityContext and podSecurityContext (#125)

Co-authored-by: Marco Franssen <[email protected]>

examples/openshift/openshift-values.yaml

@@ -14,34 +14,3 @@ global:
           pod-security.kubernetes.io/enforce: privileged
           pod-security.kubernetes.io/warn: privileged
           pod-security.kubernetes.io/audit: privileged
-
-spire-server:
-  podSecurityContext:
-    # These are unset so that openshift can automatically assign its own restricted uids to the pods
-    runAsUser: null
-    runAsGroup: null
-    fsGroup: null
-
-spire-agent:
-  podSecurityContext:
-    runAsUser: null
-    runAsGroup: null
-    fsGroup: null
-
-upstream-spire-agent:
-  podSecurityContext:
-    runAsUser: null
-    runAsGroup: null
-    fsGroup: null
-
-spiffe-oidc-discovery-provider:
-  podSecurityContext:
-    runAsUser: null
-    runAsGroup: null
-    fsGroup: null
-
-tornjak-frontend:
-  podSecurityContext:
-    runAsUser: null
-    runAsGroup: null
-    fsGroup: null

examples/production/values.yaml

@@ -13,29 +13,6 @@ spire-server:
   notifier:
     k8sbundle:
       namespace: spire-system
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: OnRootMismatch
-  securityContext:
-    allowPrivilegeEscalation: false
-    runAsNonRoot: true
-    readOnlyRootFilesystem: true
-    capabilities:
-      drop: [ALL]
-    seccompProfile:
-      type: RuntimeDefault
-
-  controllerManager:
-    securityContext:
-      allowPrivilegeEscalation: false
-      runAsNonRoot: true
-      readOnlyRootFilesystem: true
-      capabilities:
-        drop: [ALL]
-      seccompProfile:
-        type: RuntimeDefault
 
 spiffe-csi-driver:
   namespaceOverride: spire-system
@@ -49,63 +26,11 @@ spire-agent:
     name: spire-agent
   server:
     namespaceOverride: spire-server
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-  securityContext:
-    allowPrivilegeEscalation: false
-    runAsNonRoot: true
-    readOnlyRootFilesystem: true
-    capabilities:
-      drop: [ALL]
-    seccompProfile:
-      type: RuntimeDefault
 
 upstream-spire-agent:
   namespaceOverride: spire-system
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-  securityContext:
-    allowPrivilegeEscalation: false
-    runAsNonRoot: true
-    readOnlyRootFilesystem: true
-    capabilities:
-      drop: [ALL]
-    seccompProfile:
-      type: RuntimeDefault
 
 spiffe-oidc-discovery-provider:
   enabled: true
   insecureScheme:
     enabled: true
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: OnRootMismatch
-  securityContext:
-    allowPrivilegeEscalation: false
-    runAsNonRoot: true
-    readOnlyRootFilesystem: true
-    capabilities:
-      drop: [ALL]
-    seccompProfile:
-      type: RuntimeDefault
-
-tornjak-frontend:
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: OnRootMismatch
-  securityContext:
-    allowPrivilegeEscalation: false
-    runAsNonRoot: true
-    readOnlyRootFilesystem: true 
-    capabilities:
-      drop: [ALL]
-    seccompProfile:
-      type: RuntimeDefault