feat(helm): add support for podSecurityContext and containerSecurityContext configurations

[florianzwagemaker]

resolves #7014

This PR introduces security context configuration support to the helm chart, allowing pod-level and container-level security contexts to be customized.
This will allow Loculus to be deployed in k8s environments where specific security policies are enforced (such as running as a specific user, or user/group constraints).

Here we add two root-level properties in the helm chart (values.yaml and schema):

• podSecurityContext: which applies specific security contexts on a pod-level (applies to all containers in a pod)
• containerSecurityContext: applies specific security contexts on a container level (per container)

Both properties support a default entry that applies to all workloads, as well as per-component overrides (such as backend, silo, or lapis) A component specific entry will take precedence over the default entry.

Note

Regarding overrides: there is no deep merge between default and a component-specific entry. If a component has or needs its own entry, that entry is used in full and the default block will be ignored for that component. In other words, if it's required to change a field for one component, the complete security context for that component must be specified.

Example 1: Defaults applied to all components

podSecurityContext:
  default:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault

containerSecurityContext:
  default:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop: ["ALL"]

This will result in all workloads to render in the helm chart with these security contexts (for example, the silo pod):

spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 2000
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: silo
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["ALL"]

Example 2: Defaults applied, with one component needing different settings

For this example we state that the silo-importer container needs to write to the filesystem for logging purposes, as a result it cannot use the default readOnlyRootFilesystem: true.
Because there's no deep merge, we will have to specify the full security context for that component like below:

podSecurityContext:
  default:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000

containerSecurityContext:
  default:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop: ["ALL"]
  silo-importer:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: false # full block is identical except for readOnlyRootFilesystem here
    capabilities:
      drop: ["ALL"]

This will result in all containers getting the default container security context, except for silo-importer which will get its own block with a writable root filesystem.

spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 2000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: silo
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
        - name: silo-importer
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            capabilities:
              drop: ["ALL"]

A new _security-context.tpl template with loculus.podSecurityContext and loculus.containerSecurityContext helpers has been added. And all relevant deployment templates are updated to include the helpers & blocks.

The configuration blocks added to values.yaml are empty by default to retain backwards compatibility.
Currently, no security contexts will be applied unless explicitly configured.

🚀 Preview: Add preview label to enable

[Copilot]

Pull request overview

This PR extends the kubernetes/loculus Helm chart to support configurable pod-level and container-level Kubernetes securityContext settings, enabling deployments in clusters with stricter Pod Security / compliance requirements.

Changes:

• Adds new top-level Helm values + JSON schema definitions for podSecurityContext and containerSecurityContext, supporting default plus per-component overrides.
• Introduces _security-context.tpl helpers and wires them into the chart’s Deployments/CronJobs so security contexts can be rendered consistently.
• Updates loculus.configProcessor call sites to pass root .Values, enabling the config-processor initContainer to also receive a securityContext.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
kubernetes/loculus/values.yaml	Adds new top-level values placeholders for pod/container security contexts.
kubernetes/loculus/values.schema.json	Adds schema definitions + root properties for validating the new securityContext configuration blocks.
kubernetes/loculus/templates/_security-context.tpl	New helpers to render pod/container securityContext blocks based on default vs per-component override.
kubernetes/loculus/templates/taxonomy-deployment.yaml	Applies pod/container securityContext helpers to taxonomy deployment and initContainer.
kubernetes/loculus/templates/silo-deployment.yaml	Applies pod/container securityContext helpers; updates configProcessor include to pass .Values.
kubernetes/loculus/templates/minio-deployment.yaml	Applies pod/container securityContext helpers to minio deployment.
kubernetes/loculus/templates/loculus-website.yaml	Applies pod/container securityContext helpers; updates configProcessor include to pass .Values.
kubernetes/loculus/templates/loculus-preprocessing-deployment.yaml	Applies pod/container securityContext helpers to preprocessing deployment.
kubernetes/loculus/templates/loculus-database-standin.yaml	Applies pod/container securityContext helpers to database stand-in deployment.
kubernetes/loculus/templates/loculus-backend.yaml	Applies pod/container securityContext helpers; updates configProcessor include to pass .Values.
kubernetes/loculus/templates/lapis-deployment.yaml	Applies pod/container securityContext helpers; updates configProcessor include to pass .Values.
kubernetes/loculus/templates/keycloak-deployment.yaml	Applies pod/container securityContext helpers; updates configProcessor include to pass .Values.
kubernetes/loculus/templates/keycloak-database-standin.yaml	Applies pod/container securityContext helpers to keycloak DB stand-in deployment.
kubernetes/loculus/templates/ingest.yaml	Applies pod/container securityContext helpers to the ingest-trigger job.
kubernetes/loculus/templates/ena-submission-deployment.yaml	Applies pod/container securityContext helpers to ENA submission deployment + cronjob.
kubernetes/loculus/templates/docs-preview.yaml	Applies pod/container securityContext helpers to docs preview deployment.
kubernetes/loculus/templates/autoapprove-deployment.yaml	Applies pod/container securityContext helpers to autoapprove deployment.
kubernetes/loculus/templates/_ingest-pod-spec.tpl	Applies pod/container securityContext helpers to the shared ingest pod spec (init + main containers).
kubernetes/loculus/templates/_config-processor.tpl	Applies container securityContext helper to config-processor container template.

Suppressed comments (1)

kubernetes/loculus/templates/_security-context.tpl:26

• Same issue as podSecurityContext: empty maps are treated as falsey, so a component key with {} will fall back to containerSecurityContext.default instead of overriding it. This makes it impossible to opt out of the default securityContext for a specific component.

{{- if and $values.containerSecurityContext (index $values.containerSecurityContext $componentName) }}
securityContext:
{{ toYaml (index $values.containerSecurityContext $componentName) | indent 2 }}
{{- else if and $values.containerSecurityContext $values.containerSecurityContext.default }}
securityContext:
{{ toYaml $values.containerSecurityContext.default | indent 2 }}
{{- end }}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chaoran-chen]

Thanks @florianzwagemaker! (I've created a mirror of the PR to run the CI / preview: #7117)

[florianzwagemaker]

Below is a brief list of changes based on the initial claude review comments in #7117 :

1. Added groups/type metadata to the new podSecurityContext/containerSecurityContext schema properties so they render in the generated docs.
2. Removed the stale silo-importer and config-processor keys from podSecurityContextSpec as these only exist on a container level. They're kept in containerSecurityContextSpec
3. Split init-container security context includes from their app containers. So the security context for ingest-init is (and can now be) defined separately from the ingest container.
4. Added the missing security-context includes to raw-reads-processing-deployment.yaml as these were added after this initial pr.

I intentionally left out changes to the loculus.configProcessor helper as the same changes necessary are already included in #7072

I did not add any more CI coverage here now to keep the PR small, and we can propose reasonable defaults for the security contexts afterwards. I did however test the security contexts locally and as an easy example setting the values below will result in several containers and init-containers not starting because readOnlyRootFilesystem: true prevents them from writing to their filesystems.. So we can confirm that this works as intended. Setting proper defaults will require a lot more testing though.

podSecurityContext:
  default:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault

containerSecurityContext:
  default:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop: ["ALL"]