Add container level security context for task and web deployments
SUMMARY
The security context settings offered today only provide the option to set pod level security context for web and task deployments. This PR adds the option to allow container level security context for all of the containers under web and task deployments.
fixes: #1413 fixes: #890 fixes: #571 fixes: #383
This change doesn't dictate the values and let the users decide and configure the values on need basis. This makes it a safer approach to implement without breaking any functionality
ISSUE TYPE
- New or Enhanced Feature
ADDITIONAL INFORMATION
Two of the existing variable settings will become irrelevant after this change:
-
redis_capabilitiescan be covered underredis_security_context_settingsafter this change -
task_privilegedcan be covered undertask_security_context_settingsafter this change
@gdasson Looks like this PR follows the plan laid out in this comment:
- https://github.com/ansible/awx-operator/pull/1425#issuecomment-1854578532 Continuing the work there.
Changes suggested before merge:
- I think
_settingsat the end of each of these is redundant and can be removed, what do you think? Otherwise, I think this approach will work for v1beta1. - Unfortunately, we have to provide backwards compatibility for the existing securityContext settings,
- Can you also mark the task_privileged, postgres_security_context_settings and redis_capabilities parameters as Deprecated? (for example)
Note: We may re-write this to be settings nested under each component when we make a v2 CRD schema, but that is down the line and it would be good to give users a way to configure this now.
@rooftopcellist : Thanks for the review and feedback. I have now incorporated your review comments. Thanks.
@rooftopcellist or other reviewers : Any updates on this please?
cc: @bharathdevopz
Hello @gdasson, Would you mind rebasing this and resolving any conflicts?
Quality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
Hello, Any updates on this please?