From f2c53f2df8fd49ab6bb2e0639b2427847323d86a Mon Sep 17 00:00:00 2001 From: Yannick Zapf Date: Tue, 12 May 2026 00:05:18 +0200 Subject: [PATCH 1/4] add PSS securityContext Signed-off-by: Yannick Zapf --- charts/flagger/values.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/charts/flagger/values.yaml b/charts/flagger/values.yaml index dd264017b..b40394bf7 100644 --- a/charts/flagger/values.yaml +++ b/charts/flagger/values.yaml @@ -52,13 +52,27 @@ ingressAnnotationsPrefix: "" # ingress class used for annotating HTTPProxy objects ingressClass: "" -# when enabled, it will add a security context for the flagger pod. You may +# when enabled, it will add a container level security context for the flagger pod. You may # need to disable this if you are running flagger on OpenShift securityContext: enabled: true context: + allowPrivilegeEscalation: false + capabilities: + drop: [ALL] + privileged: false readOnlyRootFilesystem: true + +# when enabled, it will add a pod level security context for the flagger pod. You may +# need to disable this if you are running flagger on OpenShift +podSecurityContext: + enabled: true + context: + runAsGroup: 10001 + runAsNonRoot: true runAsUser: 10001 + fsGroup: 10001 + supplementalGroups: [10001] # when specified, flagger will publish events to the provided webhook eventWebhook: "" From e6ff3105fafda3f3ef33701216f3991603a6b3da Mon Sep 17 00:00:00 2001 From: Yannick Zapf Date: Tue, 12 May 2026 00:05:27 +0200 Subject: [PATCH 2/4] add support for podSecurityContext Signed-off-by: Yannick Zapf --- charts/flagger/templates/deployment.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/charts/flagger/templates/deployment.yaml b/charts/flagger/templates/deployment.yaml index 93884ace5..28cbea743 100644 --- a/charts/flagger/templates/deployment.yaml +++ b/charts/flagger/templates/deployment.yaml @@ -189,6 +189,10 @@ spec: {{- with .Values.nodeSelector }} nodeSelector: {{ toYaml . | indent 8 }} + {{- end }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: +{{ toYaml .Values.podSecurityContext.context | indent 12 }} {{- end }} {{- with .Values.tolerations }} tolerations: From 95df388970703bf88cf4084d7d534d34a2887382 Mon Sep 17 00:00:00 2001 From: Yannick Zapf Date: Tue, 12 May 2026 14:34:44 +0200 Subject: [PATCH 3/4] restructure comments for securityContexts Signed-off-by: Yannick Zapf --- charts/flagger/values.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/flagger/values.yaml b/charts/flagger/values.yaml index b40394bf7..9b2305695 100644 --- a/charts/flagger/values.yaml +++ b/charts/flagger/values.yaml @@ -52,8 +52,8 @@ ingressAnnotationsPrefix: "" # ingress class used for annotating HTTPProxy objects ingressClass: "" -# when enabled, it will add a container level security context for the flagger pod. You may -# need to disable this if you are running flagger on OpenShift +# when enabled, it will add a container level security context for the flagger pod. +# You may need to disable this if you are running flagger on OpenShift securityContext: enabled: true context: @@ -63,8 +63,8 @@ securityContext: privileged: false readOnlyRootFilesystem: true -# when enabled, it will add a pod level security context for the flagger pod. You may -# need to disable this if you are running flagger on OpenShift +# when enabled, it will add a pod level security context for the flagger pod. +# You may need to disable this if you are running flagger on OpenShift podSecurityContext: enabled: true context: From 97e9b575243139389ad5d151fe05f80a390a5bd3 Mon Sep 17 00:00:00 2001 From: Yannick Zapf Date: Tue, 12 May 2026 16:19:58 +0200 Subject: [PATCH 4/4] fix podSecurityContext indentation Signed-off-by: Yannick Zapf --- charts/flagger/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/flagger/templates/deployment.yaml b/charts/flagger/templates/deployment.yaml index 28cbea743..eaa185d7a 100644 --- a/charts/flagger/templates/deployment.yaml +++ b/charts/flagger/templates/deployment.yaml @@ -192,7 +192,7 @@ spec: {{- end }} {{- if .Values.podSecurityContext.enabled }} securityContext: -{{ toYaml .Values.podSecurityContext.context | indent 12 }} +{{ toYaml .Values.podSecurityContext.context | indent 8 }} {{- end }} {{- with .Values.tolerations }} tolerations: