feat(helm): setting container securityContext, automountServiceAccountToken, serviceAccountName

[lukashankeln]

We are applying some strict rules to the pods that we deploy in our cluster.
For example we enforce setting pod.spec.containers.securityContext.capabilities.drop[0].all

Currently we are only able to set pod.spec.securityContext via the helm chart.

Furthermore we are restricting automountServiceAccountToken and do not allow the default serviceAccount to be used.

Adding:

• pod.spec.initContainers.securityContext
  • check-db-migrator-run
  • checkDbIsReady
• pod.spec.containers.securityContext
  • db-migrator-install/upgrade
  • hub
  • tracker
• serviceAccountName
  • db-migrator-install/upgrade
  • tracker
• automountServiceAccountToken
  • db-migrator-install/upgrade

automountServiceAccountToken & serviceAccountName are beeing set to their respective defaults to not introduce a breaking change

[tegioz]

Thanks for your PR @lukashankeln 🙂

[tegioz]

@lukashankeln could you also rebase from master and bump the chart version to 1.21.0-2? (otherwise the chart linter will complain) Thanks!

[lukashankeln]

Good catch thank you.

• Added the missing default values
• while at it adapted the scanner template to also be able to set these values
• rebased to current master

[tegioz]

Thanks @lukashankeln 👍

[tegioz]

Can you take a look at this warning @lukashankeln? I missed it during the review 😅 Thanks!

[lukashankeln]

Confused the two different spec sections....

#4221

Thank you @tegioz

[tegioz]

No problem, thanks for the quick fix!