Allow securityContext and podSecurityContext to be configurable via helm parameters

[vepatel]

Proposed changes

Allow securityContext and podSecurityContext to be configurable via helm parameters, so users have the flexibility to configure k8s properties like allowPrivilegeEscalation, capabilities etc.

Defaults are same as last release but user can modify as shown below:

values.yaml

  ## The security context for the Ingress Controller pods.
  podSecurityContext:
    seccompProfile:
      type: RuntimeDefault

  ## The security context for the Ingress Controller containers.
  securityContext:  # Remove curly brackets before adding values
    allowPrivilegeEscalation: true
    readOnlyRootFilesystem: true # make sure this value is same as values.controller.readOnlyRootFilesystem
    runAsUser: 101 #nginx
    runAsNonRoot: true
    capabilities:
      drop:
      - ALL
      add:
      - NET_BIND_SERVICE

  ## The security context for the Ingress Controller init container which is used when readOnlyRootFilesystem is set to true.
  initContainerSecurityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    runAsUser: 101 #nginx
    runAsNonRoot: true
    capabilities:
      drop:
      - ALL
      add:
      - NET_BIND_SERVICE

 ~/nginx/kubernetes-ingress/charts/nginx-ingress on feat/security-context-helm ● λ k get po
NAME                                                     READY   STATUS    RESTARTS   AGE
test-release-nginx-ingress-controller-5f8cc49487-wd2m5   1/1     Running   0          2m41s

generated pod spec:

    image: nginx/nginx-ingress:edge
    imagePullPolicy: Always
    name: nginx-ingress
    ports:
    - containerPort: 80
      name: http
      protocol: TCP
    - containerPort: 443
      name: https
      protocol: TCP
    - containerPort: 9113
      name: prometheus
      protocol: TCP
    - containerPort: 8081
      name: readiness-port
      protocol: TCP
    readinessProbe:
      failureThreshold: 3
      httpGet:
        path: /nginx-ready
        port: readiness-port
        scheme: HTTP
      periodSeconds: 1
      successThreshold: 1
      timeoutSeconds: 1
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
    securityContext:
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - NET_BIND_SERVICE
        drop:
        - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 101
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /etc/nginx
      name: nginx-etc
    - mountPath: /var/cache/nginx
      name: nginx-cache
    - mountPath: /var/lib/nginx
      name: nginx-lib
    - mountPath: /var/log/nginx
      name: nginx-log
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-ghh8x
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  initContainers:
  - command:
    - cp
    - -vdR
    - /etc/nginx/.
    - /mnt/etc
    image: nginx/nginx-ingress:edge
    imagePullPolicy: Always
    name: init-nginx-ingress
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        add:
        - NET_BIND_SERVICE
        drop:
        - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 101
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /mnt/etc
      name: nginx-etc
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-ghh8x
      readOnly: true
  nodeName: <redacted>
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext:
    seccompProfile:
      type: RuntimeDefault

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• I have updated necessary documentation
• I have rebased my branch onto main
• I will ensure my PR is targeting the main branch and pulling from my branch from my own fork