Skip to content

S-124908-24.3.x Enable executor pod security context #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jberta-agency04 wants to merge 3 commits into
base: 24.3.x-maintenance
Choose a base branch
from
Open

S-124908-24.3.x Enable executor pod security context #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d43b239
S-124908 Enable executor security context
jberta-agency04 Oct 8, 2025
08127de
S-124908 Refine executorSecurityContext variable setup
jberta-agency04 Oct 8, 2025
efb6c34
Remove duplicate executorSecurityContext section
jberta-agency04 Oct 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@ kubectl delete namespace runner
| `runner.truststorePassword` | the truststore password | `nil` |
| `runner.restClientCa` | the certificates base64 encoded value | `nil` |
| `runner.config` | Map configuration variables that are set in the config map and used as environment | `{}` |
| `runner.kubernetes.passedSaAnnotations` | comma separated list of annotations to pass from the runner to the executor ServiceAccount | `""` |

### Digital.ai Release parameters

Expand Down Expand Up @@ -183,6 +184,13 @@ kubectl delete namespace runner
| `containerSecurityContext.enabled` | Enabled Digital.ai Release Runner containers' Security Context | `false` |
| `containerSecurityContext.runAsUser` | Set Digital.ai Release Runner containers' Security Context runAsUser | `1001` |
| `containerSecurityContext.runAsNonRoot` | Set Digital.ai Release Runner container's Security Context runAsNonRoot | `true` |
| `executorSecurityContext.enabled` | Enable security context for executor pods | `false` |
| `executorSecurityContext.runAsUser` | User ID for executor pods | `1001` |
| `executorSecurityContext.runAsGroup` | Group ID for executor pods | `1001` |
| `executorSecurityContext.fsGroup` | Filesystem group for executor pods | `1001` |
| `executorSecurityContext.runAsNonRoot` | Force executor pods to run as non-root user | `true` |
| `executorSecurityContext.allowPrivilegeEscalation` | Allow privilege escalation in executor pods | `false` |
| `executorSecurityContext.readOnlyRootFilesystem` | Make root filesystem read-only in executor pods | `false` |
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` |
| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` |
| `hostAliases` | Deployment pod host aliases | `[]` |
Expand Down
18 changes: 18 additions & 0 deletions templates/statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,24 @@ spec:
- name: RELEASE_RUNNER_REST_CLIENT_CA
value: "/workspace/ca.pem"
{{- end}}
- name: RELEASE_RUNNER_KUBERNETES_PASSED_SA_ANNOTATIONS
value: {{ .Values.runner.kubernetes.passedSaAnnotations }}
{{- if .Values.executorSecurityContext }}
- name: RELEASE_RUNNER_EXECUTOR_SECURITY_CONTEXT_ENABLED
value: "{{ .Values.executorSecurityContext.enabled }}"
- name: RELEASE_RUNNER_EXECUTOR_SECURITY_CONTEXT_RUN_AS_USER
value: "{{ .Values.executorSecurityContext.runAsUser }}"
- name: RELEASE_RUNNER_EXECUTOR_SECURITY_CONTEXT_RUN_AS_GROUP
value: "{{ .Values.executorSecurityContext.runAsGroup }}"
- name: RELEASE_RUNNER_EXECUTOR_SECURITY_CONTEXT_FS_GROUP
value: "{{ .Values.executorSecurityContext.fsGroup }}"
- name: RELEASE_RUNNER_EXECUTOR_SECURITY_CONTEXT_RUN_AS_NON_ROOT
value: "{{ .Values.executorSecurityContext.runAsNonRoot }}"
- name: RELEASE_RUNNER_EXECUTOR_SECURITY_CONTEXT_ALLOW_PRIVILEGE_ESCALATION
value: "{{ .Values.executorSecurityContext.allowPrivilegeEscalation }}"
- name: RELEASE_RUNNER_EXECUTOR_SECURITY_CONTEXT_READ_ONLY_ROOT_FILESYSTEM
value: "{{ .Values.executorSecurityContext.readOnlyRootFilesystem }}"
{{- end }}
{{- if .Values.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
Expand Down
24 changes: 24 additions & 0 deletions values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,9 @@ runner:
restClientCA:
## @param runner.config [object] Map configuration variables that are set in the config map and used as environment
config:
## @param runner.kubernetes.passedSaAnnotations comma separated list of annotations to pass from the runner to the executor ServiceAccount
kubernetes:
passedSaAnnotations: ""


## @section Digital.ai Release parameters
Expand Down Expand Up @@ -195,6 +198,27 @@ podSecurityContext:
runAsUser: 1001
fsGroup: 1001

## @section Executor Pod Security Context
##
## @param executorSecurityContext [object] Security context configuration for executor pods created by the runner
## These settings control the security context of pods that the runner creates to execute tasks
##
executorSecurityContext:
## @param executorSecurityContext.enabled Enable security context for executor pods
enabled: false
## @param executorSecurityContext.runAsUser User ID for executor pods
runAsUser: 1001
## @param executorSecurityContext.runAsGroup Group ID for executor pods
runAsGroup: 1001
## @param executorSecurityContext.fsGroup Filesystem group for executor pods
fsGroup: 1001
## @param executorSecurityContext.runAsNonRoot Force executor pods to run as non-root user
runAsNonRoot: true
## @param executorSecurityContext.allowPrivilegeEscalation Allow privilege escalation in executor pods
allowPrivilegeEscalation: false
## @param executorSecurityContext.readOnlyRootFilesystem Make root filesystem read-only in executor pods
readOnlyRootFilesystem: false

## @param containerSecurityContext.enabled Enabled Digital.ai Release Runner containers' Security Context
## @param containerSecurityContext.runAsUser Set Digital.ai Release Runner containers' Security Context runAsUser
## @param containerSecurityContext.runAsNonRoot Set Digital.ai Release Runner container's Security Context runAsNonRoot
Expand Down