connect-helm-charts icon indicating copy to clipboard operation
connect-helm-charts copied to clipboard

Added configurable `securityContext` and follow `restricted` PSS

Open applejag opened this issue 1 year ago • 2 comments

Hello! We want to be able to control the securityContext of the 1Password Connect pods to follow our own set of guidelines. Such as we want our pods to use a specific UID.

I've also changed it to follow the restricted Pod Security Standard by default, so people can use the 1Password Connect operator when they have the pod-security.kubernetes.io/enforce: restricted namespace label.

Changes:

  • Added securityContext settings to connect chart
  • Added securityContext settings to secrets-injector chart
  • Changed securityContext to follow restricted Pod Security Standard by default
  • Added pre-upgrade to secrets-injector to also update on upgrades
  • Added emptyDir for /tmp to secrets-injector as I'm setting securityContext.readOnlyRootFilesystem: true and the glog library requires it to write logs into (changing -alsologtostderr to -logtostderr didn't help)

I've tested this by installing into a test cluster and running the acceptance tests.

Closes #192

applejag avatar Sep 27 '24 11:09 applejag

Anything I'm missing or that I can help with to get this PR reviewed and merged?

applejag avatar Nov 13 '24 12:11 applejag

We also need this, as several security policies currently prevent pod creation.

@applejag you probably need to rebase your changed again @edif2008 bump :D

RuriRyan avatar Feb 06 '25 15:02 RuriRyan

Could you kindly review this PR? It's a requirement for most of the Kubernetes clusters.

bump: @bo0tzz @edif2008 @volodymyrZotov cc: @applejag

parsa97 avatar Jul 30 '25 09:07 parsa97

Why did you tag me @parsa97? I have no permissions on this repo.

bo0tzz avatar Jul 30 '25 13:07 bo0tzz

Hi, we could also use this change to actually make use of the application.

bump: @edif2008 @volodymyrZotov

ProbstenHias avatar Aug 09 '25 09:08 ProbstenHias