Issue 623: add security context override to operator deployment (#623)

charts/zookeeper-operator/README.md

@@ -58,8 +58,10 @@ The following table lists the configurable parameters of the zookeeper-operator
 | `image.tag` | Image tag | `0.2.15` |
 | `labels` | Operator pod labels | `{}` |
 | `nodeSelector` | Map of key-value pairs to be present as labels in the node in which the pod should run | `{}` |
+| `podSecurityContext` | Security context for the pod | `{}` |
 | `rbac.create` | Create RBAC resources | `true` |
 | `resources` | Specifies resource requirements for the container | `{}` |
+| `securityContext` | Security context for the container | `{}` |
 | `serviceAccount.create` | Create service account | `true` |
 | `serviceAccount.name` | Name for the service account | `zookeeper-operator` |
 | `tolerations` | Specifies the pod's tolerations | `[]` |

charts/zookeeper-operator/templates/operator.yaml

@@ -24,6 +24,10 @@ spec:
       {{- end }}
     spec:
       serviceAccountName: {{ .Values.serviceAccount.name }}
+      {{- if .Values.podSecurityContext }}
+      securityContext:
+{{ toYaml .Values.podSecurityContext | indent 8 }}
+      {{- end }}
       {{- if .Values.additionalVolumes }}
       volumes:
 {{- include "chart.additionalVolumes" . | indent 6 }}
@@ -32,6 +36,10 @@ spec:
       - name: {{ template "zookeeper-operator.fullname" . }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
+        {{- if .Values.securityContext }}
+        securityContext:
+{{ toYaml .Values.securityContext | indent 10 }}
+        {{- end }}
         ports:
         - containerPort: {{ int .Values.metricsPort }}
           name: metrics

charts/zookeeper-operator/values.yaml

@@ -13,8 +13,15 @@ image:
   pullPolicy: IfNotPresent
 
 securityContext: {}
+#  allowPrivilegeEscalation: false
+#  capabilities:
+#    drop:
+#    - ALL
+
+podSecurityContext: {}
 #  runAsUser: 1001
 #  runAsGroup: 1001
+#  fsGroup: 1001
 
 ## Additional labels to be added to resources
 labels: {}