fix: apply CRD security context override to all Paperclip containers (#46)

fix: apply CRD security context override to onboard and bootstrap containers

The onboard init container and bootstrap job had hardcoded security
contexts that ignored the CRD's security.containerSecurityContext
override. This meant users could not customize security settings for
these containers, which is needed on clusters where the Paperclip image
entrypoint requires different privileges.

Extracts a shared paperclipContainerSecurityContext() helper used by all
three Paperclip-image containers (main, onboard, bootstrap) so the CRD
override applies consistently.

Ref #45

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stubbi

internal/resources/bootstrap.go

@@ -188,16 +188,7 @@ echo "Admin bootstrap finished successfully."
 							ImagePullPolicy: imagePullPolicy(instance),
 							Command:         []string{"/bin/sh", "-c"},
 							Args:            []string{script},
-							SecurityContext: &corev1.SecurityContext{
-								AllowPrivilegeEscalation: Ptr(false),
-								RunAsNonRoot:             Ptr(true),
-								SeccompProfile: &corev1.SeccompProfile{
-									Type: corev1.SeccompProfileTypeRuntimeDefault,
-								},
-								Capabilities: &corev1.Capabilities{
-									Drop: []corev1.Capability{"ALL"},
-								},
-							},
+							SecurityContext: paperclipContainerSecurityContext(instance),
 							Env: append(buildEnvVars(instance),
 								corev1.EnvVar{
 									Name:  "ADMIN_EMAIL",

internal/resources/common.go

@@ -1,6 +1,7 @@
 package resources
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	paperclipv1alpha1 "github.com/paperclipinc/paperclip-operator/api/v1alpha1"
@@ -199,3 +200,22 @@ func DatabaseSecretName(instance *paperclipv1alpha1.Instance) string {
 func SecretsMasterKeySecretName(instance *paperclipv1alpha1.Instance) string {
 	return instance.Name + "-secrets-master-key"
 }
+
+// paperclipContainerSecurityContext returns the security context for containers
+// running the Paperclip image. If the user has provided a custom security context
+// via the CRD, it is used; otherwise the restricted-PSS-compliant default is returned.
+func paperclipContainerSecurityContext(instance *paperclipv1alpha1.Instance) *corev1.SecurityContext {
+	if instance.Spec.Security.ContainerSecurityContext != nil {
+		return instance.Spec.Security.ContainerSecurityContext
+	}
+	return &corev1.SecurityContext{
+		AllowPrivilegeEscalation: Ptr(false),
+		RunAsNonRoot:             Ptr(true),
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeRuntimeDefault,
+		},
+		Capabilities: &corev1.Capabilities{
+			Drop: []corev1.Capability{"ALL"},
+		},
+	}
+}

internal/resources/resources_test.go

@@ -1387,3 +1387,101 @@ func TestNamingConventions(t *testing.T) {
 		})
 	}
 }
+
+func TestContainerSecurityContextOverrideAppliesToAllPaperclipContainers(t *testing.T) {
+	instance := newTestInstance("my-paperclip")
+	instance.Spec.Security.ContainerSecurityContext = &corev1.SecurityContext{
+		AllowPrivilegeEscalation: Ptr(false),
+		RunAsNonRoot:             Ptr(false),
+		RunAsUser:                Ptr(int64(0)),
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeRuntimeDefault,
+		},
+		Capabilities: &corev1.Capabilities{
+			Drop: []corev1.Capability{"ALL"},
+			Add:  []corev1.Capability{"SETUID", "SETGID"},
+		},
+	}
+
+	// Main container
+	sts := BuildStatefulSet(instance, nil)
+	mainContainer := sts.Spec.Template.Spec.Containers[0]
+	if *mainContainer.SecurityContext.RunAsNonRoot != false {
+		t.Error("main container: expected RunAsNonRoot=false from CRD override")
+	}
+	if *mainContainer.SecurityContext.RunAsUser != 0 {
+		t.Error("main container: expected RunAsUser=0 from CRD override")
+	}
+
+	// Onboard init container - should also use the CRD override
+	var onboard *corev1.Container
+	for i := range sts.Spec.Template.Spec.InitContainers {
+		if sts.Spec.Template.Spec.InitContainers[i].Name == "onboard" {
+			onboard = &sts.Spec.Template.Spec.InitContainers[i]
+			break
+		}
+	}
+	if onboard == nil {
+		t.Fatal("expected onboard init container")
+	}
+	if *onboard.SecurityContext.RunAsNonRoot != false {
+		t.Error("onboard: expected RunAsNonRoot=false from CRD override")
+	}
+
+	// Bootstrap job
+	instance.Spec.Auth.AdminUser = &paperclipv1alpha1.AdminUserSpec{
+		Email: "admin@test.com",
+		PasswordSecretRef: corev1.SecretKeySelector{
+			LocalObjectReference: corev1.LocalObjectReference{Name: "admin-secret"},
+			Key:                  "password",
+		},
+	}
+	job := BuildBootstrapJob(instance)
+	bootstrapContainer := job.Spec.Template.Spec.Containers[0]
+	if *bootstrapContainer.SecurityContext.RunAsNonRoot != false {
+		t.Error("bootstrap: expected RunAsNonRoot=false from CRD override")
+	}
+}
+
+func TestDefaultSecurityContextOnOnboardAndBootstrap(t *testing.T) {
+	instance := newTestInstance("my-paperclip")
+	// No CRD override - should get restricted PSS defaults
+
+	sts := BuildStatefulSet(instance, nil)
+	var onboard *corev1.Container
+	for i := range sts.Spec.Template.Spec.InitContainers {
+		if sts.Spec.Template.Spec.InitContainers[i].Name == "onboard" {
+			onboard = &sts.Spec.Template.Spec.InitContainers[i]
+			break
+		}
+	}
+	if onboard == nil {
+		t.Fatal("expected onboard init container")
+	}
+	sc := onboard.SecurityContext
+	if *sc.RunAsNonRoot != true {
+		t.Error("onboard: expected default RunAsNonRoot=true")
+	}
+	if *sc.AllowPrivilegeEscalation != false {
+		t.Error("onboard: expected default AllowPrivilegeEscalation=false")
+	}
+	if sc.Capabilities == nil || sc.Capabilities.Drop[0] != "ALL" {
+		t.Error("onboard: expected default drop ALL capabilities")
+	}
+
+	instance.Spec.Auth.AdminUser = &paperclipv1alpha1.AdminUserSpec{
+		Email: "admin@test.com",
+		PasswordSecretRef: corev1.SecretKeySelector{
+			LocalObjectReference: corev1.LocalObjectReference{Name: "admin-secret"},
+			Key:                  "password",
+		},
+	}
+	job := BuildBootstrapJob(instance)
+	bsc := job.Spec.Template.Spec.Containers[0].SecurityContext
+	if *bsc.RunAsNonRoot != true {
+		t.Error("bootstrap: expected default RunAsNonRoot=true")
+	}
+	if *bsc.AllowPrivilegeEscalation != false {
+		t.Error("bootstrap: expected default AllowPrivilegeEscalation=false")
+	}
+}

internal/resources/statefulset.go

@@ -165,20 +165,10 @@ func buildMainContainer(instance *paperclipv1alpha1.Instance) corev1.Container {
 	}
 
 	// Container security context
-	if instance.Spec.Security.ContainerSecurityContext != nil {
-		container.SecurityContext = instance.Spec.Security.ContainerSecurityContext
-	} else {
-		container.SecurityContext = &corev1.SecurityContext{
-			AllowPrivilegeEscalation: Ptr(false),
-			ReadOnlyRootFilesystem:   Ptr(false), // Paperclip needs writable filesystem for node_modules, etc.
-			RunAsNonRoot:             Ptr(true),
-			SeccompProfile: &corev1.SeccompProfile{
-				Type: corev1.SeccompProfileTypeRuntimeDefault,
-			},
-			Capabilities: &corev1.Capabilities{
-				Drop: []corev1.Capability{"ALL"},
-			},
-		}
+	container.SecurityContext = paperclipContainerSecurityContext(instance)
+	if container.SecurityContext.ReadOnlyRootFilesystem == nil {
+		container.SecurityContext = container.SecurityContext.DeepCopy()
+		container.SecurityContext.ReadOnlyRootFilesystem = Ptr(false) // Paperclip needs writable filesystem for node_modules, etc.
 	}
 
 	// Multi-replica heartbeat gating: only pod-0 runs the scheduler.
@@ -845,16 +835,7 @@ exit 1
 		Env:             buildEnvVars(instance),
 		EnvFrom:         instance.Spec.EnvFrom,
 		VolumeMounts:    buildVolumeMounts(instance),
-		SecurityContext: &corev1.SecurityContext{
-			AllowPrivilegeEscalation: Ptr(false),
-			RunAsNonRoot:             Ptr(true),
-			SeccompProfile: &corev1.SeccompProfile{
-				Type: corev1.SeccompProfileTypeRuntimeDefault,
-			},
-			Capabilities: &corev1.Capabilities{
-				Drop: []corev1.Capability{"ALL"},
-			},
-		},
+		SecurityContext: paperclipContainerSecurityContext(instance),
 	}
 }