support pod securitycontext and container security context (#496)

* support pod securitycontext and container security context * fix test cases * rename securitycontext for dag service * rename security context similar to airflow components * extraEnv is a dict, not a list * Revert "extraEnv is a dict, not a list" This reverts commit 6c5f9db. * Update templates/dag-deploy/dag-server-statefulset.yaml Co-authored-by: Daniel Hoherd <[email protected]> * fixing test and securitycontexts.pod * update test * update tests * rename tests --------- Co-authored-by: Daniel Hoherd <[email protected]> Co-authored-by: Daniel Hoherd <[email protected]> Co-authored-by: Chioma Onyekpere <[email protected]> Co-authored-by: Shubham-astro <[email protected]>
astronomer · Nov 4, 2024 · 8d66d44 · 8d66d44
1 parent 113d084
commit 8d66d44
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 8 deletions.
diff --git a/templates/dag-deploy/dag-server-statefulset.yaml b/templates/dag-deploy/dag-server-statefulset.yaml
@@ -43,7 +43,7 @@ spec:
         - name: {{ template "astro.registry_secret" . }}
       {{- end }}
       serviceAccountName: {{ template "astro.dagDeploy.serviceAccountName" . }}
-      securityContext: {{ toYaml .Values.dagDeploy.securityContext | nindent 8 }}
+      securityContext: {{ toYaml .Values.dagDeploy.securityContexts.pod | nindent 8 }}
       containers:
         - name: dag-server
           image: "{{ .Values.dagDeploy.images.dagServer.repository }}:{{ .Values.dagDeploy.images.dagServer.tag }}"
@@ -59,6 +59,7 @@ spec:
           ports:
           - name: server
             containerPort: {{ .Values.dagDeploy.ports.dagServerHttp }}
+          securityContext: {{ toYaml .Values.dagDeploy.securityContexts.container | nindent 12 }}
           resources:
             {{- toYaml .Values.dagDeploy.resources | nindent 12 }}
           env:

diff --git a/tests/chart/test_dag_server_statefulset.py b/tests/chart/test_dag_server_statefulset.py
@@ -106,8 +106,23 @@ def test_dag_server_statefulset_with_resource_overrides(self, kube_version):
 
     def test_dag_server_statefulset_with_securitycontext_overrides(self, kube_version):
         """Test that dag-server statefulset are configurable with custom securitycontext."""
-        dag_serversecuritycontext = {"runAsUser": 12345, "privileged": True}
-        values = {"dagDeploy": {"enabled": True, "securityContext": dag_serversecuritycontext}}
+        dag_server_pod_securitycontext = {
+            "runAsUser": 12345,
+            "allowPrivilegeEscalation": True,
+            "runAsGroup": 1000,
+            "fsGroup": 2000,
+            "readOnlyRootFilesystem": True,
+        }
+        dag_server_container_securitycontext = {"allowPrivilegeEscalation": False}
+        values = {
+            "dagDeploy": {
+                "enabled": True,
+                "securityContexts": {
+                    "pod": dag_server_pod_securitycontext,
+                    "container": dag_server_container_securitycontext,
+                },
+            }
+        }
 
         docs = render_chart(
             kube_version=kube_version,
@@ -118,8 +133,9 @@ def test_dag_server_statefulset_with_securitycontext_overrides(self, kube_versio
         doc = docs[0]
 
         common_default_tests(doc)
-
-        assert dag_serversecuritycontext == doc["spec"]["template"]["spec"]["securityContext"]
+        spec = doc["spec"]["template"]["spec"]
+        assert dag_server_pod_securitycontext == spec["securityContext"]
+        assert dag_server_container_securitycontext == spec["containers"][0]["securityContext"]
 
     def test_dag_server_statefulset_with_custom_registry_secret(self, kube_version):
         """Test dag-server statefulset with custom registry secret."""

diff --git a/values.yaml b/values.yaml
@@ -594,9 +594,9 @@ dagDeploy:
   # when it wants to scale a node down.
   safeToEvict: true
 
-  securityContext: {}
-  #  runAsUser: 999
-  #  runAsGroup: 0
+  securityContexts:
+    pod: {}
+    container: {}
 
 gitSyncRelay:
   enabled: ~