Make operator security contexts configurable and restricted Pod Security compliant

helm/mysql-operator/templates/deployment.yaml

@@ -39,8 +39,10 @@ spec:
       labels:
 {{- include "mysql-operator.deployment.podLabels" . | nindent 8 }}
     spec:
+      {{- with .Values.podSecurityContext }}
       securityContext:
-        runAsNonRoot: true
+{{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.image.pullSecrets.enabled }}
       imagePullSecrets:
       - name: {{ .Values.image.pullSecrets.secretName }}
@@ -120,15 +122,10 @@ spec:
           resources:
 {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with .Values.containerSecurityContext }}
           securityContext:
-            capabilities:
-              drop:
-              - ALL
-            runAsUser: 2
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
+{{- toYaml . | nindent 12 }}
+          {{- end }}
       volumes:
         - name: mysqlsh-home
           emptyDir: {}

helm/mysql-operator/values.yaml

@@ -17,6 +17,27 @@ envs:
 
 replicas: 1
 
+# Pod-level security context for the mysql-operator Pod.
+# Required for Kubernetes restricted Pod Security Standard.
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+# Container-level security context for the mysql-operator container.
+# Required for Kubernetes restricted Pod Security Standard.
+containerSecurityContext:
+  capabilities:
+    drop:
+      - ALL
+  runAsUser: 2
+  allowPrivilegeEscalation: false
+  privileged: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
 #deployment:
   #name: mysql-operator
   ## deployment.name is part of the operator's persistent identity.