IGN-15040: Enhance Security Context Defaults

ignition/CHANGELOG.md

@@ -7,9 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Fixed YAML indent syntax error in certificate rotation jobs with custom Pod Security Context.
+
 ### Changed
 
 - Bumped _appVersion_ for Ignition to 8.3.4.
+- New container-level security context defaults, see _Added_ section for more details.  Also refactored pod-level security context defaults to use a shared helper template.
+
+### Added
+
+- Added `gateway.securityContext` and `gateway.preconfigure.securityContext` with new defaults to align with "restricted" Pod Security Standards profile.
 
 ## [0.2.1] - 2026-01-30
 

ignition/templates/_helpers.tpl

@@ -778,6 +778,39 @@ Render an invocation of the prepare-redundancy.sh script, adding a flag for redu
   {{- end }}
 {{- end }}
 
+{{/*
+Render a pod-level security context block
+*/}}
+{{- define "ignition.security.podSecurityContext" }}
+  {{- if not (eq . nil) }}
+    {{- printf "securityContext:" }}
+    {{- if . -}}
+      {{- toYaml . | nindent 2}}
+    {{- else }}
+  runAsNonRoot: true
+    {{- end }}
+  {{- end }}
+{{- end }}
+
+{{/*
+Render a container-level security context block
+*/}}
+{{- define "ignition.security.containerSecurityContext" }}
+  {{- if not (eq . nil) }}
+    {{- printf "securityContext:" }}
+    {{- if . -}}
+      {{- toYaml . | nindent 2}}
+    {{- else }}
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+    - ALL
+  seccompProfile:
+    type: RuntimeDefault
+    {{- end }}
+  {{- end }}
+{{- end }}
+
 {{- define "ignition.renderCommaDelimitedArray" -}}
   {{- $array := . }}
   {{- $vals := list }}

ignition/templates/jobs.yaml

@@ -17,15 +17,7 @@ spec:
     spec:
       template:
         spec:
-          securityContext:
-          {{- if .Values.podSecurityContext }}
-            {{ toYaml .Values.podSecurityContext | nindent 8 }}
-          {{- else }}
-            runAsUser: 2003
-            runAsGroup: 2003
-            fsGroup: 2003
-            runAsNonRoot: true
-          {{- end }}
+          {{- include "ignition.security.podSecurityContext" .Values.podSecurityContext | nindent 10 }}
           restartPolicy: Never
           affinity:
             podAffinity:
@@ -52,6 +44,7 @@ spec:
             - /config/scripts/invoke-args.sh
             args:
             - /config/scripts/prepare-gan-certificates.sh
+            {{- include "ignition.security.containerSecurityContext" .Values.gateway.securityContext | nindent 12 }}
             volumeMounts:
             - mountPath: /data
               name: ignition-data
@@ -102,15 +95,7 @@ spec:
     spec:
       template:
         spec:
-          securityContext:
-          {{- if .Values.podSecurityContext }}
-            {{ toYaml .Values.podSecurityContext | nindent 8 }}
-          {{- else }}
-            runAsUser: 2003
-            runAsGroup: 2003
-            fsGroup: 2003
-            runAsNonRoot: true
-          {{- end }}
+          {{- include "ignition.security.podSecurityContext" .Values.podSecurityContext | nindent 10 }}
           restartPolicy: Never
           affinity:
             podAffinity:
@@ -137,6 +122,7 @@ spec:
             - /config/scripts/invoke-args.sh
             args:
             - /config/scripts/prepare-tls-certificates.sh
+            {{- include "ignition.security.containerSecurityContext" .Values.gateway.securityContext | nindent 12 }}
             volumeMounts:
             - mountPath: /data
               name: ignition-data

ignition/templates/statefulset.yaml

@@ -42,15 +42,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "ignition.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.podSecurityContext }}
-        {{ toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- else }}
-        runAsUser: 2003
-        runAsGroup: 2003
-        fsGroup: 2003
-        runAsNonRoot: true
-      {{- end }}
+      {{- include "ignition.security.podSecurityContext" .Values.podSecurityContext | nindent 6 }}
       {{- if or .Values.affinity .Values.podAntiAffinity }}
       affinity:
         {{- with .Values.affinity }}
@@ -126,6 +118,7 @@ spec:
         {{- with .Values.gateway.envFrom }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
+        {{- include "ignition.security.containerSecurityContext" .Values.gateway.securityContext | nindent 8 }}
         volumeMounts:
         - mountPath: /usr/local/bin/ignition/data
           name: data
@@ -223,6 +216,7 @@ spec:
         {{- . | indent 8 }}
         {{- end }}
         {{- end }}
+        {{- include "ignition.security.containerSecurityContext" .Values.gateway.preconfigure.securityContext | nindent 8 }}
         volumeMounts:
         - mountPath: /data
           name: data

ignition/tests/helpers_test.yaml

@@ -142,9 +142,9 @@ tests:
       value: ignition
 - it: evaluate null content
   asserts:
-  - isSubset:
+  - equal:
       path: metadata.labels
-      content:
+      value:
         helm.sh/chart: ignition-0.0.36
         app.kubernetes.io/name: ignition
         app.kubernetes.io/instance: ignition

ignition/tests/ingress_test.yaml

@@ -76,9 +76,9 @@ tests:
     ingress.annotations:
       traefik.ingress.kubernetes.io/router.entrypoints: web
   asserts:
-  - isSubset:
+  - equal:
       path: metadata.annotations
-      content:
+      value:
         traefik.ingress.kubernetes.io/router.entrypoints: web
 # Validate Ingress TLS Configuration
 - it: Validate Ingress TLS Configuration
@@ -89,9 +89,9 @@ tests:
   - lengthEqual:
       path: spec.tls
       count: 1
-  - isSubset:
+  - equal:
       path: spec.tls[0]
-      content:
+      value:
         secretName: ignition-tls
         hosts:
         - "ignition.localtest.me"

ignition/tests/jobs_test.yaml

@@ -0,0 +1,193 @@
+suite: Jobs Tests
+release:
+  name: ignition
+  namespace: ignition-test
+templates:
+- jobs.yaml
+- configmap.yaml
+# Default configuration is GAN and TLS certificate rotation enabled
+set:
+  gateway:
+    tls:
+      enabled: true
+  certManager:
+    enabled: true
+    ganCertificate:
+      rotationEnabled: true
+    tlsCertificate:
+      rotationEnabled: true
+tests:
+# Rotation Job Existence and Kind Tests
+- it: Validate No Jobs when cert-manager is disabled
+  set:
+    certManager:
+      enabled: false
+  template: jobs.yaml
+  asserts:
+  - hasDocuments:
+      count: 0
+- it: Validate No Jobs when rotations are disabled
+  set:
+    certManager:
+      ganCertificate:
+        rotationEnabled: false
+      tlsCertificate:
+        rotationEnabled: false
+  template: jobs.yaml
+  asserts:
+  - hasDocuments:
+      count: 0
+- it: Validate TLS and GAN Rotation Jobs
+  template: jobs.yaml
+  asserts:
+  - hasDocuments:
+      count: 2
+  - containsDocument:
+      kind: CronJob
+      apiVersion: batch/v1
+      name: ignition-gateway-0-gan-cert-refresh
+    documentIndex: 0
+  - containsDocument:
+      kind: CronJob
+      apiVersion: batch/v1
+      name: ignition-gateway-0-tls-cert-refresh
+    documentIndex: 1
+- it: Validate TLS Rotation Job
+  template: jobs.yaml
+  set:
+    certManager:
+      ganCertificate:
+        rotationEnabled: false
+  asserts:
+  - hasDocuments:
+      count: 1
+  - containsDocument:
+      kind: CronJob
+      apiVersion: batch/v1
+      name: ignition-gateway-0-tls-cert-refresh
+- it: Validate Redundancy GAN Rotation Jobs (TLS disabled)
+  set:
+    gateway:
+      redundancy:
+        enabled: true
+      tls:
+        enabled: false
+    certManager:
+      enabled: true
+      ganCertificate:
+        rotationEnabled: true
+      tlsCertificate:
+        rotationEnabled: true
+  template: jobs.yaml
+  asserts:
+  - hasDocuments:
+      count: 2
+  - containsDocument:
+      kind: CronJob
+      apiVersion: batch/v1
+      name: ignition-gateway-0-gan-cert-refresh
+    documentIndex: 0
+  - containsDocument:
+      kind: CronJob
+      apiVersion: batch/v1
+      name: ignition-gateway-1-gan-cert-refresh
+    documentIndex: 1
+- it: Validate Redundancy TLS Rotation Jobs (GAN disabled)
+  set:
+    gateway:
+      redundancy:
+        enabled: true
+      tls:
+        enabled: true
+    certManager:
+      enabled: true
+      ganCertificate:
+        rotationEnabled: false
+      tlsCertificate:
+        rotationEnabled: true
+  template: jobs.yaml
+  asserts:
+  - hasDocuments:
+      count: 2
+  - containsDocument:
+      kind: CronJob
+      apiVersion: batch/v1
+      name: ignition-gateway-0-tls-cert-refresh
+    documentIndex: 0
+  - containsDocument:
+      kind: CronJob
+      apiVersion: batch/v1
+      name: ignition-gateway-1-tls-cert-refresh
+    documentIndex: 1
+# Rotation Schedule Tests
+- it: Validate Default Rotation Schedules
+  template: jobs.yaml
+  asserts:
+  - equal:
+      path: spec.schedule
+      value: "0 7 * * *"
+- it: Validate Custom Rotation Schedules
+  template: jobs.yaml
+  set:
+    certManager:
+      ganCertificate:
+        rotationFrequency: "0 1 * * *"
+      tlsCertificate:
+        rotationFrequency: "0 2 * * *"
+  asserts:
+  - equal:
+      path: spec.schedule
+      value: "0 1 * * *"
+    documentIndex: 0
+  - equal:
+      path: spec.schedule
+      value: "0 2 * * *"
+    documentIndex: 1
+# Security Context Tests
+- it: Validate Default Pod Security Context
+  template: jobs.yaml
+  asserts:
+  - equal:
+      path: spec.jobTemplate.spec.template.spec.securityContext
+      value:
+        runAsNonRoot: true
+- it: Validate Custom Pod Security Context
+  template: jobs.yaml
+  set:
+    podSecurityContext:
+      runAsUser: 1234
+  asserts:
+  - equal:
+      path: spec.jobTemplate.spec.template.spec.securityContext
+      value:
+        runAsUser: 1234
+- it: Validate Omitted Pod Security Context
+  template: jobs.yaml
+  set:
+    podSecurityContext: null
+  asserts:
+  - notExists:
+      path: spec.jobTemplate.spec.template.spec.securityContext
+- it: Validate Default Container Security Context
+  template: jobs.yaml
+  asserts:
+  - equal:
+      path: spec.jobTemplate.spec.template.spec.containers[0].securityContext
+      value:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        seccompProfile:
+          type: RuntimeDefault
+- it: Validate Custom Container Security Context
+  template: jobs.yaml
+  set:
+    gateway:
+      securityContext:
+        allowPrivilegeEscalation: true
+  asserts:
+  - equal:
+      path: spec.jobTemplate.spec.template.spec.containers[0].securityContext
+      value:
+        allowPrivilegeEscalation: true

ignition/tests/probes_test.yaml

@@ -21,9 +21,9 @@ tests:
 - it: Validate Default Readiness Probe
   template: statefulset.yaml
   asserts:
-  - isSubset:
+  - equal:
       path: spec.template.spec.containers[0].readinessProbe
-      content: *default-readiness-probe
+      value: *default-readiness-probe
 - it: Validate Default Readiness Probe with Redundancy Enabled
   template: statefulset.yaml
   set:
@@ -43,9 +43,9 @@ tests:
       failureThreshold: 3
       timeoutSeconds: 4
   asserts:
-  - isSubset:
+  - equal:
       path: spec.template.spec.containers[0].readinessProbe
-      content:
+      value:
         exec:
           command:
           - "custom-health-check.sh"