Helm-Chart does not support SecurityContext anymore

[gilberts42]

What did you do to encounter the bug?

Install mongodb-kubernetes 1.1.0 via helm chart from https://mongodb.github.io/helm-charts

What did you expect?

I need to provide a Security Context as I did with CommunityOperator. The same value is not used anymore to create the deployment:

operator:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]

What happened instead?
It is not possible to set the container securityContext anymore.

Operator Information

• mongodb-kubernetes 1.1.0

Kubernetes Cluster Information
Using RKE2 Cluster with CIS Profile enabled.

[lsierant]

Thanks for raising this!

I need to provide a Security Context as I did with CommunityOperator
Could you please explain what version of the operator did you use previously and which CR did you deploy? Is it about MongoDBCommunity?

I cannot find anything in the previous operators that supported setting security context in a way you've provided in the snippet. Please provide an example how it worked before for you.

[gilberts42]

Here are the references to the community operator helm chart:

https://github.com/mongodb/helm-charts/blob/c6b6488a2a84cb806eadac0e286b6060914082d5/charts/community-operator/values.yaml#L49

https://github.com/mongodb/helm-charts/blob/c6b6488a2a84cb806eadac0e286b6060914082d5/charts/community-operator/templates/operator.yaml#L80

[lsierant]

Thanks for explaining it! I see now where the problem is. You're right, we've missed that community settings in the helm-chart when merging both community and enterprise into MCK.

I'm thinking for a workaround for you. For openshift deployments (and generally where the security context is centrally managed) we have a top-level managedSecurityContext=false setting in the helm chart's values.yaml. We set it to true for OpenShift deployments, so the operator won't specify anything for the security context and let it be automatically managed.

Is this also possible in your case? What about the actual replicaset deployment pods? Could it also have managed security context? When the operator is deployed with managedSecurityContext=false, then the pods also won't have anything specified for the security context.

[gilberts42]

@lsierant thanks for your response! The helm chart currently only supports

1. managedSecurityContext=true: where you do not set the securityContext
2. managedSecurityContext=false: where you set a default securityContext

I think this is very limiting as you want to support many different scenarios. So I would suggest there should be a third option where the securityContext can be completely defined by the user. So in my case it would be great to have managedSecurityContext=false and still be able to define the details of the securityContext in the values.yaml

In my situation the workaround is not sufficient, as we do not have a managed securityContext within the cluster.

[lsierant]

I agree. I've raised this internally. I believe we should fix it, but can't promise any dates. Thanks for reporting it.

For the time being, would it be a feasible workaround to manually patch the deployment by adding the security context by hand?