From b38ee241c4dab7dffcb85b8e26d4670924c59eac Mon Sep 17 00:00:00 2001
From: Ferdinand Krammer <ferdinandkrammer@yahoo.co.uk>
Date: Sun, 17 May 2026 23:51:58 +0200
Subject: [PATCH] feat!(security): addition of features to security context to
 allow for CIS complience

---
 charts/common/.helmignore                     |  2 +
 charts/common/templates/_container.yaml       |  1 +
 .../common/templates/_security_context.yaml   | 50 ++++++++++++++++++-
 3 files changed, 52 insertions(+), 1 deletion(-)

diff --git a/charts/common/.helmignore b/charts/common/.helmignore
index f0c1319..1d69dd9 100644
--- a/charts/common/.helmignore
+++ b/charts/common/.helmignore
@@ -19,3 +19,5 @@
 .project
 .idea/
 *.tmproj
+
+temp.yaml
diff --git a/charts/common/templates/_container.yaml b/charts/common/templates/_container.yaml
index e8ee9af..afafc38 100644
--- a/charts/common/templates/_container.yaml
+++ b/charts/common/templates/_container.yaml
@@ -75,6 +75,7 @@ env:
 {{ include "common.healthcheck.startup" . }}
 {{- end }}
 {{ include "common.resources" . }}
+{{ include "common.security.containerContext" . }}
 {{- if .Values.volumeMounts }}
 volumeMounts:
   {{- toYaml .Values.volumeMounts | nindent 2 }}
diff --git a/charts/common/templates/_security_context.yaml b/charts/common/templates/_security_context.yaml
index b978f2c..c193668 100644
--- a/charts/common/templates/_security_context.yaml
+++ b/charts/common/templates/_security_context.yaml
@@ -1,4 +1,8 @@
-{{- define "common.security.context" -}}
+{{/*
+Pod-level security context - called at spec.securityContext
+*/}}
+
+{{- define "common.security.podContext" -}}
 {{- $context := default (dict) .Values.securityContext -}}
 {{- $runAsUser := ternary $context.runAsUser 1001 (hasKey $context "runAsUser") -}}
 {{- $runAsGroup := ternary $context.runAsGroup $runAsUser (hasKey $context "runAsGroup") -}}
@@ -9,4 +13,48 @@ securityContext:
   runAsGroup: {{ $runAsGroup }}
   fsGroup: {{ $fsGroup }}
   runAsNonRoot: {{ $runAsNonRoot }}
+  {{- if hasKey $context "seccompProfile" }}
+  seccompProfile:
+    type: {{ $context.seccompProfile.type }}
+  {{- end }}
+{{- end -}}
+ 
+{{- define "common.security.containerContext" -}}
+{{- $pod := default (dict) .Values.securityContext -}}
+{{- $ctr := default (dict) .Values.containerSecurityContext -}}
+ 
+{{/*
+  Cascade each field: use container value if explicitly set,
+  otherwise fall back to pod value, otherwise use secure default.
+*/}}
+{{- $runAsNonRoot := ternary $ctr.runAsNonRoot (ternary $pod.runAsNonRoot true (hasKey $pod "runAsNonRoot")) (hasKey $ctr "runAsNonRoot") -}}
+{{- $runAsUser    := ternary $ctr.runAsUser    (ternary $pod.runAsUser    1001 (hasKey $pod "runAsUser"))    (hasKey $ctr "runAsUser") -}}
+{{- $seccomp := ternary $ctr.seccompProfile (ternary $pod.seccompProfile nil (hasKey $pod "seccompProfile")) (hasKey $ctr "seccompProfile") -}}
+ 
+{{/*
+  Container-only fields — no pod-level equivalent to cascade from,
+  so fall back directly to CIS-compliant secure defaults.
+*/}}
+
+{{- $allowPrivEsc := ternary $ctr.allowPrivilegeEscalation false (hasKey $ctr "allowPrivilegeEscalation") -}}
+{{- $readOnlyRoot := ternary $ctr.readOnlyRootFilesystem   true  (hasKey $ctr "readOnlyRootFilesystem") -}}
+ 
+securityContext:
+  runAsNonRoot: {{ $runAsNonRoot }}
+  runAsUser: {{ $runAsUser }}
+  allowPrivilegeEscalation: {{ $allowPrivEsc }}
+  readOnlyRootFilesystem: {{ $readOnlyRoot }}
+  {{- if and .Values.containerSecurityContext (hasKey $ctr "capabilities") }}
+  capabilities:
+    {{- toYaml $ctr.capabilities | nindent 4 }}
+  {{- end }}
+  {{- if $seccomp }}
+  seccompProfile:
+    type: {{ $seccomp.type }}
+  {{- end }}
+{{- end -}}
+ 
+{{- define "common.security.context" -}}
+{{- include "common.security.podContext" . -}}
 {{- end -}}
+