Container level securityContext is not applied for Vault Configurer.

[gaurang1609]

Hi All,

There are restrictions on our Kubernetes cluster namespaces with Pod Security Admission

• https://kubernetes.io/docs/concepts/security/pod-security-admission
• https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted

Due to this reason, we can't install Vault as per [this guidelines] (https://bank-vaults.dev/docs/operator/#ha-setup-with-raft).

So, I have made few modifications to [CR.yml] (https://[raw.githubusercontent.com/bank-vaults/vault-operator/v1.21.2/deploy/examples/cr-raft.yaml) to add SecurityContext as per our need as follows:

## This is a Pod level Security Context
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
    runAsGroup: 3000
    runAsUser: 1000

### This is Pod and container level security context for vault configurer
  vaultConfigurerPodSpec:
    securityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: vault-configurer
        securityContext:
          allowPrivilegeEscalation: false
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop:
              - ALL

Now after adding "securityContext" stanza, pod level securityContext is applied for Vault Conigurer deployment but container level securityContext is not applied.

Partial contents of Custom Resource:

apiVersion: "vault.banzaicloud.com/v1alpha1"
kind: "Vault"
metadata:
  name: "vault"
  labels:
    app.kubernetes.io/name: vault
    vault_cr: vault
spec:
  size: 3
  image: hashicorp/vault:1.14.1
...
...
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
    runAsGroup: 3000
    runAsUser: 1000

  vaultConfigurerPodSpec:
    securityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: vault-configurer
        securityContext:
          allowPrivilegeEscalation: false
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop:
              - ALL
...
...

• Vault Operator Version: 1.21.2
• Kubernetes Version: 1.25.9
• MLock is disabled.
• Used Integrated Storage(Raft)

Can you please guide/help?

[gaurang1609]

Related Issue is created. So, closing this discussion.