feat(chart): Make the securityContext for the StatefulSet configurable #62

Merged
DaanSelen merged 4 commits from ssullivan/helm-actions:configure-pod-securitycontext into main 2025-11-03 17:43:27 +00:00
Contributor

Description of the change

This patch adds the ability to customize the SecurityContext for the statefulset of the Gitea Actions act_runner.
This allows users to configure pod-level security settings, such as fsGroup and fsGroupChangePolicy.
The patch introduces statefulset.podSecurityContext as a new configurable parameter.

Benefits

This change makes the chart more configurable for different kinds of deployment scenarios.

Possible drawbacks

Applicable issues

  • Fixes #

Additional information

  • The patch only adds the ability to customize the podSecurityContext for the statefulset. It does not modify any other security settings or introduce new features beyond this customization.
  • The default value for statefulset.podSecurityContext is an empty object {}, meaning no security context is applied unless the user explicitly defines it.

⚠ BREAKING

Checklist

  • Parameters are documented in the values.yaml and added to the README.md using readme-generator-for-helm
  • Helm templating unittests are added (required when changing anything in templates folder)
  • All added template resources MUST render a namespace in metadata
<!-- Before you open the request please review the following guidelines and tips to help it be more easily integrated: - Describe the scope of your change - i.e. what the change does. - Describe any known limitations with your change. - Please run any tests or examples that can exercise your modified code. Thank you for contributing! We will try to review, test and integrate the change as soon as we can. --> ### Description of the change <!-- Describe the scope of your change - i.e. what the change does. --> This patch adds the ability to **customize the `SecurityContext`** for the `statefulset` of the Gitea Actions `act_runner`. This allows users to configure pod-level security settings, such as `fsGroup` and `fsGroupChangePolicy`. The patch introduces `statefulset.podSecurityContext` as a new configurable parameter. ### Benefits <!-- What benefits will be realized by the code change? --> This change makes the chart more configurable for different kinds of deployment scenarios. ### Possible drawbacks <!-- Describe any known limitations with your change --> ### Applicable issues <!-- Enter any applicable Issues here (You can reference an issue using #). Please remove this section if there is no referenced issue. --> - Fixes # ### Additional information <!-- If there's anything else that's important and relevant to your pull request, mention that information here. Please remove this section if it remains empty. --> * The patch only adds the ability to customize the `podSecurityContext` for the `statefulset`. It does not modify any other security settings or introduce new features beyond this customization. * The default value for `statefulset.podSecurityContext` is an empty object `{}`, meaning no security context is applied unless the user explicitly defines it. ### ⚠ BREAKING <!-- If there's a breaking change, please shortly describe in which way users are affected and how they can mitigate it. If there are no breakings, please remove this section. --> ### Checklist <!-- [Place an '[X]' (no spaces) in all applicable fields. Please remove unrelated fields.] --> - [X] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) - [X] Helm templating unittests are added (required when changing anything in `templates` folder) - [X] All added template resources MUST render a namespace in metadata
ssullivan added 1 commit 2025-09-19 20:28:10 +00:00
feat(chart): Make the securityContext for the StatefulSet configurable
Some checks failed
commitlint / check-and-test (pull_request) Has been cancelled
Lint Shell files / shellcheck (pull_request) Has been cancelled
check-and-test / check-and-test (pull_request) Has been cancelled
0b9c3bd571
ssullivan requested review from DaanSelen 2025-09-19 20:28:10 +00:00
ssullivan requested review from volker.raschek 2025-09-19 20:28:10 +00:00
ssullivan requested review from ChristopherHX 2025-09-19 20:28:10 +00:00
DaanSelen approved these changes 2025-09-19 20:29:47 +00:00
Dismissed
Member

Seems simple enough.

Seems simple enough.
ssullivan added 1 commit 2025-09-20 16:33:25 +00:00
Revert hash
All checks were successful
Lint Shell files / shellcheck (pull_request) Successful in 18s
check-and-test / check-and-test (pull_request) Successful in 22s
5103512150
Author
Contributor

Reverted the hash in the unit test

Reverted the hash in the unit test
ChristopherHX reviewed 2025-09-20 18:27:45 +00:00
values.yaml Outdated
@@ -38,6 +39,7 @@ statefulset:
tolerations: []
affinity: {}
extraVolumes: []
podSecurityContext: {}
Member

What was the reason for the name podSecurityContext? I would have called this just securityContext, e.g. using a name that kubernetes itself is using.

I am fine merging this either way

What was the reason for the name podSecurityContext? I would have called this just securityContext, e.g. using a name that kubernetes itself is using. _I am fine merging this either way_
Author
Contributor

I am good with changing this to securityContext. I’ll make that change… puts it more inline with the k8s schema

I am good with changing this to securityContext. I’ll make that change… puts it more inline with the k8s schema
Author
Contributor

@ChristopherHX I've updated this to be securityContext

@ChristopherHX I've updated this to be securityContext
ssullivan added 1 commit 2025-09-20 23:20:43 +00:00
Change podSecurityContext to securityContext
Some checks failed
Lint Shell files / shellcheck (pull_request) Successful in 17s
check-and-test / check-and-test (pull_request) Failing after 19s
bf62a90c57
ssullivan added 1 commit 2025-09-20 23:21:44 +00:00
Update README
Some checks failed
Lint Shell files / shellcheck (pull_request) Successful in 17s
check-and-test / check-and-test (pull_request) Failing after 33s
4e4090f925
ssullivan added 1 commit 2025-09-20 23:24:08 +00:00
Update unit tests
All checks were successful
check-and-test / check-and-test (pull_request) Successful in 21s
Lint Shell files / shellcheck (pull_request) Successful in 42s
3ae1c21eeb
Member

@ssullivan Please apply the latest main branch into this, so we may merge gracefully.

@ssullivan Please apply the latest main branch into this, so we may merge gracefully.
ssullivan force-pushed configure-pod-securitycontext from 3ae1c21eeb to 79e8f90dc7 2025-09-21 18:29:01 +00:00 Compare
Author
Contributor

Just saw the changes to main. I've rebased this PR

Just saw the changes to main. I've rebased this PR
Member

Looks good.

Looks good.
DaanSelen approved these changes 2025-09-21 18:31:20 +00:00
Dismissed
ssullivan force-pushed configure-pod-securitycontext from 79e8f90dc7 to 9057b440e5 2025-09-21 21:50:16 +00:00 Compare
ssullivan force-pushed configure-pod-securitycontext from 9057b440e5 to 594e7a3e60 2025-09-22 12:54:09 +00:00 Compare
Author
Contributor

I've updated this with main again

I've updated this with main again
ssullivan force-pushed configure-pod-securitycontext from 594e7a3e60 to 88ff5d7fee 2025-09-26 11:11:24 +00:00 Compare
DaanSelen approved these changes 2025-11-03 17:43:20 +00:00
DaanSelen merged commit b91d297e32 into main 2025-11-03 17:43:27 +00:00
Sign in to join this conversation.
No description provided.