Create global container and pod security context configs

charts/sourcegraph-executor/dind/README.md

@@ -59,14 +59,19 @@ In addition to the documented values, the `executor` and `private-docker-registr
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | dind.command | list | `["dockerd"]` | Command for the dind container. |
+| dind.containerSecurityContext | object | `{}` | Override container security context for the dind container. Ignored when gVisor is enabled. |
 | dind.daemonConfig | object | `{"hosts":["tcp://127.0.0.1:2375"],"insecure-registries":["private-docker-registry:5000"],"mtu":1200,"registry-mirrors":["http://private-docker-registry:5000"],"tls":false}` | Docker daemon configuration passed as daemon.json to the dind sidecar. Learn more from: https://docs.docker.com/reference/cli/dockerd/#on-linux |
+| dind.defaultContainerSecurityContext | object | `{"privileged":true}` | Default container security context for the dind container. Ignored when gVisor is enabled. |
 | dind.gVisor.command | list | `["/bin/sh","-c","ip link del docker0 2>/dev/null || true\necho 1 > /proc/sys/net/ipv4/ip_forward\ndev=$(ip route show default | awk '{for(i=1;i<=NF;i++) if($i==\"dev\"){print $(i+1); exit}}')\naddr=$(ip addr show dev \"$dev\" | awk '/inet /{gsub(/\\/.*/, \"\", $2); print $2; exit}')\niptables-legacy -t nat -A POSTROUTING -o \"$dev\" -j SNAT --to-source \"$addr\" -p tcp || true\niptables-legacy -t nat -A POSTROUTING -o \"$dev\" -j SNAT --to-source \"$addr\" -p udp || true\nexec dockerd\n"]` | Command for the dind container when gVisor is enabled. Overrides dind.command. Prepares the network environment that gVisor does not initialise automatically before handing off to dockerd. |
 | dind.gVisor.daemonConfig | object | `{"features":{"containerd-snapshotter":false},"ip6tables":false,"iptables":false,"storage-driver":"vfs"}` | Extra daemon.json settings merged into dind.daemonConfig when gVisor is enabled. These defaults configure Docker to work within gVisor's kernel constraints. |
 | dind.gVisor.enabled | bool | `false` | Enable gVisor sandbox (GKE only). Requires the GKE node pool to have sandbox type set to gvisor. When enabled, sets runtimeClassName: gvisor on executor pods and replaces privileged: true with explicit capabilities — these are intercepted in-sandbox and never granted to the host kernel. See: https://gvisor.dev/docs/tutorials/docker-in-gvisor/ |
 | dind.gVisor.securityContext | object | `{"capabilities":{"add":["NET_ADMIN","SYS_ADMIN","AUDIT_WRITE","CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","MKNOD","NET_BIND_SERVICE","NET_RAW","SETFCAP","SETGID","SETPCAP","SETUID","SYS_CHROOT","SYS_PTRACE"]}}` | securityContext for the dind container when gVisor is enabled. Replaces privileged: true — gVisor intercepts these capabilities in-sandbox and never grants them to the host kernel. |
 | dind.image.registry | string | `"index.docker.io"` |  |
 | dind.image.repository | string | `"docker"` |  |
 | dind.image.tag | string | `"29.5.3-dind"` |  |
+| executor.containerSecurityContext | object | `{}` | Override container security context for the executor container |
+| executor.defaultContainerSecurityContext | object | `{}` | Default container security context for the executor container |
+| executor.defaultPodSecurityContext | object | `{"fsGroup":101}` | Default pod security context for executor pods. fsGroup: 101 ensures the scratch volume is writable by the sourcegraph user (uid=100, gid=101) when running in Docker mode (dind). Set to {} to disable. |
 | executor.env | object | `{}` | Extra environment variables to set on the executor container. |
 | executor.frontendExistingSecret | string | `""` | Name of existing k8s Secret to use for frontend password. The k8s Secret must contain the key EXECUTOR_FRONTEND_PASSWORD matching the site config executors.accessToken value. frontendPassword is ignored if this is set. |
 | executor.frontendPassword | string | `""` | The shared secret configured in the Sourcegraph instance site config under executors.accessToken. Required if frontendExistingSecret is not configured. |
@@ -77,7 +82,7 @@ In addition to the documented values, the `executor` and `private-docker-registr
 | executor.log.level | string | `"warn"` | Possible values are dbug, info, warn, eror, crit. |
 | executor.maximumNumJobs | int | `10` | The maximum amount of jobs that can be executed concurrently. |
 | executor.maximumRuntimePerJob | string | `"30m"` | The maximum wall time that can be spent on a single job. |
-| executor.podSecurityContext | object | `{"fsGroup":101}` | Pod-level security context applied to executor pods. fsGroup: 101 ensures the scratch volume is writable by the sourcegraph user (uid=100, gid=101) when running in Docker mode (dind). Set to {} to disable. |
+| executor.podSecurityContext | object | `{}` | Override pod security context for executor pods |
 | executor.queueName | string | `""` | The name of the queue to pull jobs from. Possible values: batches and codeintel. Either this or queueNames is required (when not using queues). |
 | executor.queueNames | list | `[]` | The names of multiple queues to pull jobs from. Possible values: batches and codeintel. Either this or queueName is required (when not using queues). |
 | executor.replicaCount | int | `1` |  |
@@ -93,6 +98,7 @@ In addition to the documented values, the `executor` and `private-docker-registr
 | privateDockerRegistry.storageSize | string | `"10Gi"` |  |
 | queues | list | `[]` | Optional list of queues to deploy as standalone Deployments. When set, the single executor Deployment is not rendered. Each entry supports:   name        (required) — used as the deployment name suffix (executor-<name>)   queueName   — sets EXECUTOR_QUEUE_NAME; defaults to name if omitted   queueNames  — sets EXECUTOR_QUEUE_NAMES (comma-joined); takes precedence over queueName when set   replicaCount, resources, env (merged with executor.env, queue overrides) |
 | sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) |
+| sourcegraph.containerSecurityContext | object | `{}` | Global container security context override applied to all containers. Merges with component defaults; component-specific overrides take precedence. |
 | sourcegraph.image.defaultTag | string | `"{{ .Chart.AppVersion }}"` | Global docker image tag |
 | sourcegraph.image.pullPolicy | string | `"IfNotPresent"` | Global docker image pull policy |
 | sourcegraph.image.repository | string | Sourcegraph's public Docker Hub registry | Global docker image registry or prefix |
@@ -103,6 +109,7 @@ In addition to the documented values, the `executor` and `private-docker-registr
 | sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) |
 | sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods |
 | sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods |
+| sourcegraph.podSecurityContext | object | `{}` | Global pod security context override applied to all pods. Merges with component defaults; component-specific overrides take precedence. |
 | sourcegraph.priorityClassName | string | `""` | Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) |
 | sourcegraph.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
 | storageClass.allowedTopologies | object | `{}` | Persistent volumes topology configuration, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies) |

charts/sourcegraph-executor/dind/templates/_helpers.tpl

@@ -181,14 +181,12 @@ spec:
         sourcegraph-resource-requires: no-cluster-admin
         app.kubernetes.io/component: executor
     spec:
-      {{- with $r.Values.executor.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- include "sourcegraph.podSecurityContext" (list $r "executor" 6) }}
       containers:
         - name: executor
           image: {{ include "sourcegraph.image" (list $r "executor") }}
           imagePullPolicy: {{ $r.Values.sourcegraph.image.pullPolicy }}
+          {{- include "sourcegraph.containerSecurityContext" (list $r "executor" 10) }}
           livenessProbe:
             httpGet:
               path: /healthz
@@ -260,12 +258,12 @@ spec:
         - name: dind
           image: "{{ $r.Values.dind.image.registry }}/{{ $r.Values.dind.image.repository }}:{{ $r.Values.dind.image.tag }}"
           imagePullPolicy: {{ $r.Values.sourcegraph.image.pullPolicy }}
+          {{- if $r.Values.dind.gVisor.enabled }}
           securityContext:
-            {{- if $r.Values.dind.gVisor.enabled }}
             {{- toYaml $r.Values.dind.gVisor.securityContext | nindent 12 }}
-            {{- else }}
-            privileged: true
-            {{- end }}
+          {{- else }}
+          {{- include "sourcegraph.containerSecurityContext" (list $r "dind" 10) }}
+          {{- end }}
           command:
             {{- if $r.Values.dind.gVisor.enabled }}
             {{- toYaml $r.Values.dind.gVisor.command | nindent 12 }}

charts/sourcegraph-executor/dind/templates/_helpers/_securityContext.tpl

@@ -0,0 +1,120 @@
+{{/*
+
+Security context helpers for container and pod security contexts.
+
+These helpers implement a 3-tier merge precedence:
+1. Component default (e.g., .Values.frontend.defaultContainerSecurityContext)
+2. Global override (e.g., .Values.sourcegraph.containerSecurityContext)
+3. Component override (e.g., .Values.frontend.containerSecurityContext)
+
+Later values override earlier ones, allowing customers to:
+- Set global security context settings that apply to all components
+- Override specific components as needed
+- Retain Sourcegraph's secure defaults when no overrides are specified
+
+Supports nested paths like "openTelemetry" "gateway" or "codeInsightsDB" "init".
+
+*/}}
+
+{{/*
+Internal: walk the component path and merge default, global, and component
+override security contexts. Returns the merged map as YAML.
+
+Parameters:
+  - $ (root context)
+  - default key, e.g. "defaultContainerSecurityContext"
+  - override key, e.g. "containerSecurityContext"; also the global key under .Values.sourcegraph
+  - component path segments (one or more strings)
+*/}}
+{{- define "sourcegraph.mergeSecurityContext" -}}
+{{- $root := index . 0 -}}
+{{- $defaultKey := index . 1 -}}
+{{- $overrideKey := index . 2 -}}
+{{- $component := $root.Values -}}
+{{- range slice . 3 -}}
+{{- $component = index $component . | default dict -}}
+{{- end -}}
+{{- $default := index $component $defaultKey | default dict -}}
+{{- $global := index $root.Values.sourcegraph $overrideKey | default dict -}}
+{{- $override := index $component $overrideKey | default dict -}}
+{{- mustMergeOverwrite (deepCopy $default) $global $override | toYaml -}}
+{{- end -}}
+
+{{/*
+Merged container security context as YAML. Pipe through fromYaml to read fields.
+
+Usage:
+  {{- $merged := include "sourcegraph.mergedContainerSecurityContext" (list . "frontend") | fromYaml }}
+
+Parameters:
+  - $ (root context)
+  - component path segments (one or more strings)
+*/}}
+{{- define "sourcegraph.mergedContainerSecurityContext" -}}
+{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultContainerSecurityContext" "containerSecurityContext") (slice . 1)) -}}
+{{- end -}}
+
+{{/*
+Merged pod security context as YAML. Pipe through fromYaml to read fields.
+
+Usage:
+  {{- $merged := include "sourcegraph.mergedPodSecurityContext" (list . "frontend") | fromYaml }}
+
+Parameters:
+  - $ (root context)
+  - component path segments (one or more strings)
+*/}}
+{{- define "sourcegraph.mergedPodSecurityContext" -}}
+{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultPodSecurityContext" "podSecurityContext") (slice . 1)) -}}
+{{- end -}}
+
+{{/*
+Internal: render a map as a "securityContext:" block, or nothing if empty.
+The output includes a leading newline for proper YAML formatting.
+
+Parameters:
+  - merged security context map
+  - indent level (integer)
+*/}}
+{{- define "sourcegraph.renderSecurityContext" -}}
+{{- $merged := index . 0 -}}
+{{- $indent := int (index . 1) -}}
+{{- if $merged }}
+{{ "securityContext:" | indent $indent }}
+{{ toYaml $merged | indent (int (add $indent 2)) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Container security context with 3-tier merge, rendered as a "securityContext:" block.
+
+Usage:
+  {{- include "sourcegraph.containerSecurityContext" (list . "frontend" 8) }}
+
+Parameters:
+  - $ (root context)
+  - component path segments (one or more strings)
+  - indent level (integer) as the last parameter
+*/}}
+{{- define "sourcegraph.containerSecurityContext" -}}
+{{- $last := sub (len .) 1 -}}
+{{- $merged := include "sourcegraph.mergedContainerSecurityContext" (slice . 0 $last) | fromYaml -}}
+{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}}
+{{- end -}}
+
+{{/*
+Pod security context with 3-tier merge, rendered as a "securityContext:" block.
+
+Usage:
+  {{- include "sourcegraph.podSecurityContext" (list . "frontend" 6) }}
+
+Parameters:
+  - $ (root context)
+  - component path segments (one or more strings)
+  - indent level (integer) as the last parameter
+*/}}
+{{- define "sourcegraph.podSecurityContext" -}}
+{{- $last := sub (len .) 1 -}}
+{{- $merged := include "sourcegraph.mergedPodSecurityContext" (slice . 0 $last) | fromYaml -}}
+{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}}
+{{- end -}}

charts/sourcegraph-executor/dind/values.yaml

@@ -33,6 +33,12 @@ sourcegraph:
   podLabels: {}
   # -- Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets)
   priorityClassName: ""
+  # -- Global container security context override applied to all containers.
+  # Merges with component defaults; component-specific overrides take precedence.
+  containerSecurityContext: {}
+  # -- Global pod security context override applied to all pods.
+  # Merges with component defaults; component-specific overrides take precedence.
+  podSecurityContext: {}
 
 
 storageClass:
@@ -131,17 +137,28 @@ executor:
     # -- StorageClass for the ephemeral volume. Only used when type is ephemeral.
     # Defaults to the cluster default StorageClass when empty.
     class: ""
-  # -- Pod-level security context applied to executor pods.
+  # -- Default pod security context for executor pods.
   # fsGroup: 101 ensures the scratch volume is writable by the sourcegraph user (uid=100, gid=101)
   # when running in Docker mode (dind). Set to {} to disable.
-  podSecurityContext:
+  defaultPodSecurityContext:
     fsGroup: 101
+  # -- Override pod security context for executor pods
+  podSecurityContext: {}
+  # -- Default container security context for the executor container
+  defaultContainerSecurityContext: {}
+  # -- Override container security context for the executor container
+  containerSecurityContext: {}
 
 dind:
   image:
     registry: index.docker.io
     repository: docker
     tag: 29.5.3-dind
+  # -- Default container security context for the dind container. Ignored when gVisor is enabled.
+  defaultContainerSecurityContext:
+    privileged: true
+  # -- Override container security context for the dind container. Ignored when gVisor is enabled.
+  containerSecurityContext: {}
   # -- Command for the dind container.
   command:
     - dockerd