feat: allow setting securityContext for runner pods - #1068
Conversation
Runner pods had no way to set a pod or container securityContext, either from the Helm chart or per TerraformLayer/TerraformRepository (#905). Add PodSecurityContext/SecurityContext to OverrideRunnerSpec and RunnerConfig, merged the same way as Resources/Affinity, layer overriding repository overriding the Helm-wide default.
Expose config.burrito.runner.podSecurityContext and .securityContext in values.yaml so a cluster-wide default can be set for runner pods, on top of the per-layer/repository override added in the API.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1068 +/- ##
==========================================
+ Coverage 51.38% 51.66% +0.28%
==========================================
Files 99 99
Lines 5566 5586 +20
==========================================
+ Hits 2860 2886 +26
+ Misses 2706 2700 -6 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
corrieriluca
left a comment
corrieriluca
left a comment
There was a problem hiding this comment.
The securityContext and podSecurityContext should only be set in overrideRunnerSpec, not in Burrito's config / values.
Keep securityContext/podSecurityContext for runner pods settable only through spec.overrideRunnerSpec on TerraformRepository/TerraformLayer, consistent with every other runner pod field (Resources, Affinity, Tolerations, ...). Remove the parallel Helm/config-level default that was added alongside it, per review feedback on #1068.
|
@corrieriluca Good point, thanks — pushed 52f8038 which drops |
2 participants
Summary
PodSecurityContext/SecurityContexttoOverrideRunnerSpec, settable perTerraformRepository/TerraformLayer(layer overrides repository, same precedence asAffinity/Resources).RunnerConfig, exposed via the Helm chart asconfig.burrito.runner.podSecurityContext/config.burrito.runner.securityContext, so a cluster-wide default can be set on top of which repo/layer overrides apply.Closes #905
Test plan
go build ./.../go vet ./...go test ./api/...and./internal/controllers/terraformrun/...(added cases for repo-only/layer-only/both/neither override precedence, and an envtest case asserting the pod/container securityContext is applied)helm lintandhelm templatewithconfig.burrito.runner.securityContext/podSecurityContextset, verified the ConfigMap renders the new keys