Allow to specify securityContext for vaultConfigurer container

[msg-gregor]

Preflight Checklist

• I have searched the issue tracker for an issue that matches the one I want to file, without success.
• I agree to follow the Code of Conduct.

Problem Description

Vault operator does not allow to specify securityContext for the vaultConfigurer pod container, it only allows to specify the podSecurityContext for the whole pod

This is not sufficient in all cases. For example, we deploy in a managed rancher kubernetes cluster with strict security policies. All containers are forced to have the following security profile or they won't be scheduled:

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ "ALL" ]
  seccompProfile:
    type: RuntimeDefault

Some but not all of them can be set by using the pods security context on a pod level, however, e.g., allowPrivilegeEscalation and capabilities can only be set on a container level

This missing feature prevents us from using bank-vaults operator, because it is impossible for us to deploy the vaultConfigurer pod

Proposed Solution

Add a vaultConfigurerContainerSpec that allows to configure/extend container spec for vaultConfigurer - similar to the already existing vaultContainerSpec - to the VaultSpec API

Alternatives Considered

No response

Additional Information

No response

[ghost]

@ramizpolic any news on this? :) I think @msg-gregor is not the only one (we are at least 2 haha) to not be able to use bank-vaults in prod because of vaultConfigurerContainerSpec missing in a restricted environment. Would be amazing if faisable :)

[ramizpolic]

@fakeNews-jpg (cool nickname btw), yes, we will focus on this in the upcoming weeks, will share more details once we start working on it

[justinwalz]

Along the same lines... feature request to also add it to the config-templating initContainer too, please.