Skip to content

Commit 23f6128

Browse files
Blink AIkylecarbs
Blink AI
and
kylecarbs
committed
feat(helm): add pod securityContext and enhanced probe configuration
This commit adds two important security and operational enhancements to the Coder Helm chart: 1. **Pod-level securityContext support**: Adds configuration to allow setting pod-level security settings like . This is essential for proper file permissions when mounting TLS certificates for mTLS PostgreSQL connections. Example usage for mTLS PostgreSQL: 2. **Enhanced probe configuration**: Extends readiness and liveness probe configuration beyond just to include: - : How often to perform the probe - : Probe timeout duration - : Required consecutive successes - : Allowed consecutive failures This provides fine-grained control over probe behavior for production deployments. These changes maintain backward compatibility while enabling secure mTLS database connections and better operational control over health checking. Fixes: Security requirements for mTLS PostgreSQL deployments Closes: Enhanced probe configuration request Co-authored-by: kylecarbs <7122116+kylecarbs@users.noreply.github.com>
1 parent bb83071 commit 23f6128

File tree

3 files changed

+79
-0
lines changed

3 files changed

+79
-0
lines changed

‎helm/coder/templates/_coder.tpl

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,10 +101,34 @@ readinessProbe:
101101
port: "http"
102102
scheme: "HTTP"
103103
initialDelaySeconds: {{ .Values.coder.readinessProbe.initialDelaySeconds }}
104+
{{- with .Values.coder.readinessProbe.periodSeconds }}
105+
periodSeconds: {{ . }}
106+
{{- end }}
107+
{{- with .Values.coder.readinessProbe.timeoutSeconds }}
108+
timeoutSeconds: {{ . }}
109+
{{- end }}
110+
{{- with .Values.coder.readinessProbe.successThreshold }}
111+
successThreshold: {{ . }}
112+
{{- end }}
113+
{{- with .Values.coder.readinessProbe.failureThreshold }}
114+
failureThreshold: {{ . }}
115+
{{- end }}
104116
livenessProbe:
105117
httpGet:
106118
path: /healthz
107119
port: "http"
108120
scheme: "HTTP"
109121
initialDelaySeconds: {{ .Values.coder.livenessProbe.initialDelaySeconds }}
122+
{{- with .Values.coder.livenessProbe.periodSeconds }}
123+
periodSeconds: {{ . }}
124+
{{- end }}
125+
{{- with .Values.coder.livenessProbe.timeoutSeconds }}
126+
timeoutSeconds: {{ . }}
127+
{{- end }}
128+
{{- with .Values.coder.livenessProbe.successThreshold }}
129+
successThreshold: {{ . }}
130+
{{- end }}
131+
{{- with .Values.coder.livenessProbe.failureThreshold }}
132+
failureThreshold: {{ . }}
133+
{{- end }}
110134
{{- end }}

‎helm/coder/values.yaml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,33 @@ coder:
116116
# coder.serviceAccount.disableCreate -- Whether to create the service account or use existing service account.
117117
disableCreate: false
118118

119+
# coder.podSecurityContext -- Fields related to the pod's security context.
120+
# This is useful for setting fsGroup to ensure proper file permissions for
121+
# mounted volumes (e.g., for mTLS certificates). See:
122+
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#podsecuritycontext-v1-core
123+
#
124+
# Example for mTLS PostgreSQL with mounted certificates:
125+
# podSecurityContext:
126+
# fsGroup: 1000 # Ensures coder user (1000) can read mounted TLS certs
127+
# runAsNonRoot: true
128+
# runAsUser: 1000
129+
# runAsGroup: 1000
130+
#
131+
# When mounting TLS certificates for PostgreSQL mTLS, you should also set
132+
# the volume defaultMode to 0640:
133+
# volumes:
134+
# - name: postgres-certs
135+
# secret:
136+
# secretName: postgres-tls-certs
137+
# defaultMode: 0640
138+
podSecurityContext: {}
139+
# fsGroup: 1000
140+
# runAsNonRoot: true
141+
# runAsUser: 1000
142+
# runAsGroup: 1000
143+
# seccompProfile:
144+
# type: RuntimeDefault
145+
119146
# coder.securityContext -- Fields related to the container's security
120147
# context (as opposed to the pod). Some fields are also present in the pod
121148
# security context, in which case these values will take precedence.
@@ -211,12 +238,36 @@ coder:
211238
# coder.readinessProbe.initialDelaySeconds -- Number of seconds after the container
212239
# has started before readiness probes are initiated.
213240
initialDelaySeconds: 0
241+
# coder.readinessProbe.periodSeconds -- How often (in seconds) to perform the probe.
242+
# Default to 10 seconds. Minimum value is 1.
243+
# periodSeconds: 10
244+
# coder.readinessProbe.timeoutSeconds -- Number of seconds after which the probe times out.
245+
# Defaults to 1 second. Minimum value is 1.
246+
# timeoutSeconds: 1
247+
# coder.readinessProbe.successThreshold -- Minimum consecutive successes for the probe
248+
# to be considered successful after having failed. Defaults to 1.
249+
# successThreshold: 1
250+
# coder.readinessProbe.failureThreshold -- When a probe fails, Kubernetes will
251+
# try failureThreshold times before giving up. Defaults to 3.
252+
# failureThreshold: 3
214253

215254
# coder.livenessProbe -- Liveness probe configuration for the Coder container.
216255
livenessProbe:
217256
# coder.livenessProbe.initialDelaySeconds -- Number of seconds after the container
218257
# has started before liveness probes are initiated.
219258
initialDelaySeconds: 0
259+
# coder.livenessProbe.periodSeconds -- How often (in seconds) to perform the probe.
260+
# Default to 10 seconds. Minimum value is 1.
261+
# periodSeconds: 10
262+
# coder.livenessProbe.timeoutSeconds -- Number of seconds after which the probe times out.
263+
# Defaults to 1 second. Minimum value is 1.
264+
# timeoutSeconds: 1
265+
# coder.livenessProbe.successThreshold -- Minimum consecutive successes for the probe
266+
# to be considered successful after having failed. Defaults to 1. Must be 1 for liveness.
267+
# successThreshold: 1
268+
# coder.livenessProbe.failureThreshold -- When a probe fails, Kubernetes will
269+
# try failureThreshold times before giving up. Defaults to 3.
270+
# failureThreshold: 3
220271

221272
# coder.certs -- CA bundles to mount inside the Coder pod.
222273
certs:

‎helm/libcoder/templates/_coder.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ spec:
4848
topologySpreadConstraints:
4949
{{- toYaml . | nindent 8 }}
5050
{{- end }}
51+
{{- with .Values.coder.podSecurityContext }}
52+
securityContext:
53+
{{- toYaml . | nindent 8 }}
54+
{{- end }}
5155
{{- with .Values.coder.initContainers }}
5256
initContainers:
5357
{{ toYaml . | nindent 8 }}

0 commit comments

Comments
 (0)