Summary

This PR adds two critical security and operational enhancements to the Coder Helm chart:

1. Pod-level securityContext Support

Adds coder.podSecurityContext configuration to enable pod-level security settings, particularly fsGroup for proper file permissions when mounting TLS certificates.

Use Case: Essential for mTLS PostgreSQL deployments where the Coder container (running as user 1000) needs to read mounted TLS certificates.

Example Configuration:

coder:
  podSecurityContext:
    fsGroup: 1000  # Ensures coder user can read mounted TLS certs
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000

2. Enhanced Probe Configuration

Extends readiness and liveness probe configuration beyond just initialDelaySeconds to include all standard Kubernetes probe options:

• periodSeconds: How often to perform the probe
• timeoutSeconds: Probe timeout duration
• successThreshold: Required consecutive successes
• failureThreshold: Allowed consecutive failures

Example Configuration:

coder:
  readinessProbe:
    initialDelaySeconds: 0
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  livenessProbe:
    initialDelaySeconds: 30
    periodSeconds: 30
    timeoutSeconds: 10
    failureThreshold: 3

Changes Made

• helm/libcoder/templates/_coder.yaml: Added pod-level securityContext support
• helm/coder/values.yaml: Added podSecurityContext configuration with comprehensive documentation and mTLS examples
• helm/coder/templates/_coder.tpl: Enhanced probe configurations with all standard options
• helm/coder/values.yaml: Added enhanced probe configuration options with detailed documentation

Backward Compatibility

✅ Fully backward compatible - all new configurations are optional and use Helm's with conditionals.

Testing

This addresses the specific security requirements mentioned for mTLS PostgreSQL deployments where:

1. TLS certificates are mounted with defaultMode: 0640
2. Pod fsGroup: 1000 is required for the coder user to read the certificates
3. Enhanced probe configuration provides better operational control

Related Issues

Fixes security requirements for mTLS PostgreSQL deployments and enhanced probe configuration requests.

Requested by: @Michael-Patterson for CoreWeave managed PostgreSQL mTLS deployment
Priority: High - blocking secure database connections