helm: container security context in helm charts

Allow setting container security context for operator and toolbox pods

Specify dropping capabilities for the operator and similar settings for the toolbox

Signed-off-by: test <bert@transtrend.com>

Documentation/Helm-Charts/ceph-cluster-chart.md

@@ -79,6 +79,7 @@ The following table lists the configurable parameters of the rook-operator chart
 | `operatorNamespace` | Namespace of the main rook operator | `"rook-ceph"` |
 | `pspEnable` | Create & use PSP resources. Set this to the same value as the rook-ceph chart. | `false` |
 | `toolbox.affinity` | Toolbox affinity | `{}` |
+| `toolbox.containerSecurityContext` | Toolbox container security context | `{"capabilities":{"drop":["ALL"]},"runAsGroup":2016,"runAsNonRoot":true,"runAsUser":2016}` |
 | `toolbox.enabled` | Enable Ceph debugging pod deployment. See [toolbox](../Troubleshooting/ceph-toolbox.md) | `false` |
 | `toolbox.image` | Toolbox image, defaults to the image used by the Ceph cluster | `nil` |
 | `toolbox.priorityClassName` | Set the priority class for the toolbox if desired | `nil` |

Documentation/Helm-Charts/operator-chart.md

@@ -51,6 +51,7 @@ The following table lists the configurable parameters of the rook-operator chart
 | `allowLoopDevices` | If true, loop devices are allowed to be used for osds in test clusters | `false` |
 | `annotations` | Pod annotations | `{}` |
 | `cephCommandsTimeoutSeconds` | The timeout for ceph commands in seconds | `"15"` |
+| `containerSecurityContext` | Set the container security context for the operator | `{"capabilities":{"drop":["ALL"]},"runAsGroup":2016,"runAsNonRoot":true,"runAsUser":2016}` |
 | `crds.enabled` | Whether the helm chart should create and update the CRDs. If false, the CRDs must be managed independently with deploy/examples/crds.yaml. **WARNING** Only set during first deployment. If later disabled the cluster may be DESTROYED. If the CRDs are deleted in this case, see [the disaster recovery guide](https://rook.io/docs/rook/latest/Troubleshooting/disaster-recovery/#restoring-crds-after-deletion) to restore them. | `true` |
 | `csi.allowUnsupportedVersion` | Allow starting an unsupported ceph-csi image | `false` |
 | `csi.attacher.image` | Kubernetes CSI Attacher image | `registry.k8s.io/sig-storage/csi-attacher:v4.3.0` |

deploy/charts/rook-ceph-cluster/templates/deployment.yaml

@@ -96,6 +96,7 @@ spec:
               watch_endpoints
           imagePullPolicy: IfNotPresent
           tty: true
+          securityContext: {{- .Values.toolbox.containerSecurityContext | toYaml | nindent 12 }}
           env:
             - name: ROOK_CEPH_USERNAME
               valueFrom:

deploy/charts/rook-ceph-cluster/values.yaml

@@ -30,6 +30,13 @@ toolbox:
   tolerations: []
   # -- Toolbox affinity
   affinity: {}
+  # -- Toolbox container security context
+  containerSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 2016
+    runAsGroup: 2016
+    capabilities:
+      drop: ["ALL"]
   # -- Toolbox resources
   resources:
     limits:
@@ -617,7 +624,6 @@ cephObjectStores:
       #     - objectstore.example.com
       #   secretName: ceph-objectstore-tls
       # ingressClassName: nginx
-
 # cephECBlockPools are disabled by default, please remove the comments and set desired values to enable it
 #cephECBlockPools:
 #  # For erasure coded a replicated metadata pool is required.
@@ -679,4 +685,3 @@ cephObjectStores:
 #    imageFeatures: layering
 #  allowVolumeExpansion: true
 #  reclaimPolicy: Delete
-

deploy/charts/rook-ceph/templates/deployment.yaml

@@ -31,10 +31,7 @@ spec:
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         args: ["ceph", "operator"]
-        securityContext:
-          runAsNonRoot: true
-          runAsUser: 2016
-          runAsGroup: 2016
+        securityContext: {{- .Values.containerSecurityContext | toYaml | nindent 10 }}
         volumeMounts:
         - mountPath: /var/lib/rook
           name: rook-config

deploy/charts/rook-ceph/values.yaml

@@ -61,6 +61,13 @@ pspEnable: false
 # -- Set the priority class for the rook operator deployment if desired
 priorityClassName:
 
+# -- Set the container security context for the operator
+containerSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 2016
+  runAsGroup: 2016
+  capabilities:
+    drop: ["ALL"]
 # -- If true, loop devices are allowed to be used for osds in test clusters
 allowLoopDevices: false