mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
Andrew G. Dunn
020b437ec9
Following the suggestion in #22543 to have `coder.securityContext.capabilities` in `values.yaml` without a default, this adds it as a commented example, the same way `values.yaml` shows `env` and `initContainers`, and adds one line to the Kubernetes Security Reference. Existing deployments don't change on upgrade. The chart's default security context passes every Pod Security Standards `restricted` check except capabilities, so a namespace that enforces `restricted` rejects the pod. Because the example is commented out, the rendered chart is unchanged: ```console $ diff main.yaml branch.yaml && echo "renders identical ($(wc -l < branch.yaml) lines)" renders identical (208 lines) ``` Server-side dry runs of this branch's chart into a namespace labeled `pod-security.kubernetes.io/enforce=restricted` (GKE, Kubernetes 1.35), using the pod spec from the rendered Deployment, as is and with the example uncommented: ```console $ kubectl create --dry-run=server -n coder -f pod-branch.json Error from server (Forbidden): error when creating "pod-branch.json": pods "pss-main-branch" is forbidden: violates PodSecurity "restricted:latest": unrestricted capabilities (container "coder" must set securityContext.capabilities.drop=["ALL"]) $ kubectl create --dry-run=server -n coder -f pod-branch-drop.json pod/pss-main-branch-drop created (server dry run) ``` A v2.37.3 deployment with the value set runs in a `restricted` namespace, ready with no restarts. AI involvement: I used an AI assistant to draft this change, and verified it with the commands above against a running cluster.