Skip to content

Commit 3fb24a8

Browse files
QuentinBissonEItanya
QuentinBisson
and
EItanya
authored
fix(agents): add podSecurityContext and securityContext to all agent charts (kagent-dev#1977)
## What Adds `podSecurityContext` and `securityContext` values to all 10 declarative agent charts and wires them through to `spec.declarative.deployment` in the rendered Agent CR. ## Why All agent chart templates currently only render `imagePullSecrets` and `resources` in the `deployment` section. The kagent controller creates Deployments from those Agent CRs, and those Deployments lack the fields required by Kubernetes restricted Pod Security Standards: - `capabilities.drop: [ALL]` - `allowPrivilegeEscalation: false` - `runAsNonRoot: true` - `seccompProfile.type: RuntimeDefault` On clusters enforcing restricted PSS via Kyverno or OPA, all declarative agent Deployments are blocked at admission. The Agent CRD v1alpha2 already supports `spec.declarative.deployment.podSecurityContext` and `spec.declarative.deployment.securityContext`. The templates just weren't passing them through. ## Changes Each of the 10 agent charts (`argo-rollouts`, `cilium-debug`, `cilium-manager`, `cilium-policy`, `helm`, `istio`, `k8s`, `kgateway`, `observability`, `promql`) gets the same change: `values.yaml` (new defaults, empty so existing deployments are unaffected): ```yaml podSecurityContext: {} securityContext: {} ``` `templates/agent.yaml` (render only when set): ```yaml {{- with .Values.podSecurityContext }} podSecurityContext: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.securityContext }} securityContext: {{- toYaml . | nindent 8 }} {{- end }} ``` ## Usage Callers can now pass the required fields: ```yaml cilium-policy: podSecurityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault securityContext: allowPrivilegeEscalation: false capabilities: drop: [ALL] seccompProfile: type: RuntimeDefault ``` --------- Signed-off-by: QuentinBisson <quentin@giantswarm.io> Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io>
1 parent 440d5fe commit 3fb24a8

30 files changed

Lines changed: 210 additions & 61 deletions

File tree

‎helm/agents/argo-rollouts/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- define "agent.deploymentSpec" -}}
2+
{{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
3+
imagePullSecrets:
4+
{{- toYaml . | nindent 2 }}
5+
{{- end }}
6+
{{- with .Values.podSecurityContext }}
7+
podSecurityContext:
8+
{{- toYaml . | nindent 2 }}
9+
{{- end }}
10+
{{- with .Values.securityContext }}
11+
securityContext:
12+
{{- toYaml . | nindent 2 }}
13+
{{- end }}
14+
resources:
15+
{{- toYaml .Values.resources | nindent 2 }}
16+
{{- end }}

‎helm/agents/argo-rollouts/templates/agent.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -187,9 +187,4 @@ spec:
187187
compaction: {{- toYaml .Values.compaction | nindent 8 }}
188188
{{- end }}
189189
deployment:
190-
{{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
191-
imagePullSecrets:
192-
{{- toYaml . | nindent 8 }}
193-
{{- end }}
194-
resources:
195-
{{- toYaml .Values.resources | nindent 8 }}
190+
{{- include "agent.deploymentSpec" . | nindent 6 }}

‎helm/agents/argo-rollouts/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,7 @@ resources:
1616

1717

1818
compaction: {}
19+
20+
podSecurityContext: {}
21+
22+
securityContext: {}

‎helm/agents/cilium-debug/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- define "agent.deploymentSpec" -}}
2+
{{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
3+
imagePullSecrets:
4+
{{- toYaml . | nindent 2 }}
5+
{{- end }}
6+
{{- with .Values.podSecurityContext }}
7+
podSecurityContext:
8+
{{- toYaml . | nindent 2 }}
9+
{{- end }}
10+
{{- with .Values.securityContext }}
11+
securityContext:
12+
{{- toYaml . | nindent 2 }}
13+
{{- end }}
14+
resources:
15+
{{- toYaml .Values.resources | nindent 2 }}
16+
{{- end }}

‎helm/agents/cilium-debug/templates/agent.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -160,9 +160,4 @@ spec:
160160
compaction: {{- toYaml .Values.compaction | nindent 8 }}
161161
{{- end }}
162162
deployment:
163-
{{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
164-
imagePullSecrets:
165-
{{- toYaml . | nindent 8 }}
166-
{{- end }}
167-
resources:
168-
{{- toYaml .Values.resources | nindent 8 }}
163+
{{- include "agent.deploymentSpec" . | nindent 6 }}

‎helm/agents/cilium-debug/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,7 @@ resources:
1515
memory: 1Gi
1616

1717
compaction: {}
18+
19+
podSecurityContext: {}
20+
21+
securityContext: {}

‎helm/agents/cilium-manager/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- define "agent.deploymentSpec" -}}
2+
{{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
3+
imagePullSecrets:
4+
{{- toYaml . | nindent 2 }}
5+
{{- end }}
6+
{{- with .Values.podSecurityContext }}
7+
podSecurityContext:
8+
{{- toYaml . | nindent 2 }}
9+
{{- end }}
10+
{{- with .Values.securityContext }}
11+
securityContext:
12+
{{- toYaml . | nindent 2 }}
13+
{{- end }}
14+
resources:
15+
{{- toYaml .Values.resources | nindent 2 }}
16+
{{- end }}

‎helm/agents/cilium-manager/templates/agent.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -432,9 +432,4 @@ spec:
432432
compaction: {{- toYaml .Values.compaction | nindent 8 }}
433433
{{- end }}
434434
deployment:
435-
{{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
436-
imagePullSecrets:
437-
{{- toYaml . | nindent 8 }}
438-
{{- end }}
439-
resources:
440-
{{- toYaml .Values.resources | nindent 8 }}
435+
{{- include "agent.deploymentSpec" . | nindent 6 }}

‎helm/agents/cilium-manager/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,7 @@ resources:
1515
memory: 1Gi
1616

1717
compaction: {}
18+
19+
podSecurityContext: {}
20+
21+
securityContext: {}

‎helm/agents/cilium-policy/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- define "agent.deploymentSpec" -}}
2+
{{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
3+
imagePullSecrets:
4+
{{- toYaml . | nindent 2 }}
5+
{{- end }}
6+
{{- with .Values.podSecurityContext }}
7+
podSecurityContext:
8+
{{- toYaml . | nindent 2 }}
9+
{{- end }}
10+
{{- with .Values.securityContext }}
11+
securityContext:
12+
{{- toYaml . | nindent 2 }}
13+
{{- end }}
14+
resources:
15+
{{- toYaml .Values.resources | nindent 2 }}
16+
{{- end }}

0 commit comments

Comments
 (0)