fix(redis): Support security context

charts/plumber/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: plumber
 description: Helm chart for Plumber
 type: application
-version: "1.3.1"
-appVersion: "1.3.1"
+version: "1.3.2"
+appVersion: "1.3.2"
 home: https://github.com/getplumber/platform/
 maintainers:
   - name: devpro

charts/plumber/templates/redis-deployment.yaml

@@ -34,6 +34,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.redis.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: redis
           image: {{ include "plumber.redisImage" . }}
@@ -66,4 +70,8 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 10
           resources: {}
+          {{- with .Values.redis.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
 {{- end }}

charts/plumber/values.yaml

@@ -282,6 +282,27 @@ redis:
     # -- Pull policy for the Redis image.
     pullPolicy: IfNotPresent
 
+  # -- Security context for the Redis container.
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: [ALL]
+    privileged: false
+    runAsNonRoot: true
+    runAsUser: 999
+    runAsGroup: 999
+    seccompProfile:
+      type: RuntimeDefault
+
+  # -- Security context for the Redis pod.
+  podSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 999
+    runAsGroup: 999
+    fsGroup: 999
+    seccompProfile:
+      type: RuntimeDefault
+
   # Connection details for the Redis instance (used whether deployed by this chart or external).
   # When deploy is true and custom.host is empty, the host defaults to <release>-redis-master.
   custom: