Test that it is possible to lock down security of pods (#84)

.github/tests/lockdown/deps-values.yaml

@@ -0,0 +1,54 @@
+global:
+  telemetry:
+    prometheus:
+      enabled: true
+
+spiffe-csi-driver:
+  enabled: false
+
+spire-agent:
+  enabled: false
+
+spiffe-oidc-discovery-provider:
+  enabled: true
+  insecureScheme:
+    enabled: true
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
+
+spire-server:
+  nodeAttestor:
+    k8sPsat:
+      serviceAccountAllowList: ["lockdown:spire-agent"]
+  notifier:
+    k8sbundle:
+      namespace: lockdown
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
+  controllerManager:
+    securityContext:
+      allowPrivilegeEscalation: false
+      runAsNonRoot: true
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: [ALL]
+      seccompProfile:
+        type: RuntimeDefault

.github/tests/lockdown/pre-install.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+kubectl label namespace "$scenario" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "${scenario}-deps"
+kubectl label namespace "${scenario}-deps" pod-security.kubernetes.io/enforce=restricted
+helm install -n "${scenario}-deps" spire -f "${TEST_DIR}"/deps-values.yaml

.github/tests/lockdown/values.yaml

@@ -0,0 +1,20 @@
+global:
+  telemetry:
+    prometheus:
+      enabled: true
+
+spiffe-csi-driver:
+  enabled: true
+
+spire-agent:
+  enabled: true
+  serviceAccount:
+    name: spire-agent
+  server:
+    address: spire-server.lockdown-deps
+
+spiffe-oidc-discovery-provider:
+  enabled: false
+
+spire-server:
+  enabled: false