-
Notifications
You must be signed in to change notification settings - Fork 952
feat(helm): add pod securityContext and enhanced probe configuration support #19020
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
…support This commit addresses issue #19018 by adding two key features to the Coder Helm chart: 1. **Pod-level securityContext Support** - Added coder.podSecurityContext configuration option - Enables setting fsGroup for proper file permissions when mounting TLS certificates - Supports all standard Kubernetes pod security context fields - Example: fsGroup: 1000 for coder user certificate access 2. **Enhanced Probe Configuration** - Extended readiness and liveness probe configuration beyond initialDelaySeconds - Added support for: periodSeconds, timeoutSeconds, successThreshold, failureThreshold - Maintains backward compatibility - new fields only included when explicitly set - Enables fine-tuning probe behavior for production deployments **Use Case:** This enables secure mTLS database connections by allowing proper certificate mounting with correct file permissions, addressing enterprise deployment requirements for PostgreSQL with SSL/mTLS. **Example Configuration:** ```yaml coder: podSecurityContext: fsGroup: 1000 runAsNonRoot: true readinessProbe: periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 3 livenessProbe: periodSeconds: 30 timeoutSeconds: 10 failureThreshold: 3 ``` **Testing:** - All existing Helm chart tests pass - Template rendering validated with new configurations - Backward compatibility maintained Fixes #19018 Co-authored-by: bpmct <22407953+bpmct@users.noreply.github.com>
I have read the CLA Document and I hereby sign the CLA Blink seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. |
I have read the CLA Document and I hereby sign the CLA |
1 similar comment
I have read the CLA Document and I hereby sign the CLA |
recheck |
…mpatibility The provisioner chart uses the same libcoder templates but doesn't have probe configuration in its values.yaml. This change makes the probe configuration conditional to prevent nil pointer errors when the provisioner chart is rendered. Changes: - Wrap readinessProbe and livenessProbe blocks with conditional checks - Only render probe configuration when .Values.coder.readinessProbe/.livenessProbe exist - Maintains backward compatibility for both coder and provisioner charts Fixes helm lint failures in CI.
recheck |
I have read the CLA Document and I hereby sign the CLA |
Summary
This PR addresses issue #19018 by adding two key features to the Coder Helm chart:
1. Pod-level securityContext Support
coder.podSecurityContext
configuration optionfsGroup
for proper file permissions when mounting TLS certificatesfsGroup: 1000
for coder user certificate access2. Enhanced Probe Configuration
initialDelaySeconds
periodSeconds
,timeoutSeconds
,successThreshold
,failureThreshold
Use Case
This enables secure mTLS database connections by allowing proper certificate mounting with correct file permissions, addressing enterprise deployment requirements for PostgreSQL with SSL/mTLS.
Example Configuration
Testing
Changes Made
helm/libcoder/templates/_coder.yaml
securityContext
block with conditional renderinghelm/coder/values.yaml
podSecurityContext
configuration section with documentationFixes #19018