From 442f5ec99873a162c9a05330bb4f32c4d731fecc Mon Sep 17 00:00:00 2001 From: "v.oleynikov" Date: Sat, 4 Jul 2026 12:20:43 +0300 Subject: [PATCH 1/2] Revert "[feature] Add appArmor config values in securityContext (#200)" This reverts commit 9f8a1ab6da2d3e424af44ed9cbf08f019a1fcf8c. --- charts/helm_lib/Chart.yaml | 2 +- charts/helm_lib/README.md | 8 ++--- .../_application_security_context.tpl | 19 +--------- .../templates/_module_security_context.tpl | 19 +--------- ...s_restricted_flexible_apparmor_custom.yaml | 1 - ...restricted_flexible_apparmor_disabled.yaml | 1 - ...ation_container_security_context_test.yaml | 6 +--- ..._context_pss_restricted_flexible_test.yaml | 36 ------------------- ...ricted_flexible_test_seccomp_disabled.yaml | 17 +++++++++ .../helm_lib_module_init_container_test.yaml | 2 -- 10 files changed, 23 insertions(+), 88 deletions(-) delete mode 100644 tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml delete mode 100644 tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml create mode 100644 tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test_seccomp_disabled.yaml diff --git a/charts/helm_lib/Chart.yaml b/charts/helm_lib/Chart.yaml index 370672d..d4230a7 100644 --- a/charts/helm_lib/Chart.yaml +++ b/charts/helm_lib/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 type: library name: deckhouse_lib_helm -version: 1.72.6 +version: 1.72.5 description: "Helm utils template definitions for Deckhouse modules." diff --git a/charts/helm_lib/README.md b/charts/helm_lib/README.md index 592f9f6..befff6d 100644 --- a/charts/helm_lib/README.md +++ b/charts/helm_lib/README.md @@ -311,12 +311,10 @@ list: .uid – int, runAsUser/runAsGroup (default 64535) .runAsNonRoot – bool, run as Deckhouse user when true, root when false (default true) .seccompProfile – bool, disable seccompProfile when false (default true) - .appArmorProfile – string, appArmorProfile.type, set to empty string to disable (default RuntimeDefault) - .appArmorProfileLocalhost – string, appArmorProfile.localhostProfile, used only when appArmorProfile is "Localhost" (default empty) #### Usage -`include "helm_lib_application_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") ` +`include "helm_lib_application_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) ` @@ -1251,12 +1249,10 @@ list: .uid – int, runAsUser/runAsGroup (default 64535) .runAsNonRoot – bool, run as Deckhouse user when true, root when false (default true) .seccompProfile – bool, disable seccompProfile when false (default true) - .appArmorProfile – string, appArmorProfile.type, set to empty string to disable (default RuntimeDefault) - .appArmorProfileLocalhost – string, appArmorProfile.localhostProfile, used only when appArmorProfile is "Localhost" (default empty) #### Usage -`include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") ` +`include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) ` diff --git a/charts/helm_lib/templates/_application_security_context.tpl b/charts/helm_lib/templates/_application_security_context.tpl index 9ab9910..fd21083 100644 --- a/charts/helm_lib/templates/_application_security_context.tpl +++ b/charts/helm_lib/templates/_application_security_context.tpl @@ -76,9 +76,7 @@ securityContext: {{- /* .uid – int, runAsUser/runAsGroup (default 64535) */ -}} {{- /* .runAsNonRoot – bool, run as Deckhouse user when true, root when false (default true) */ -}} {{- /* .seccompProfile – bool, disable seccompProfile when false (default true) */ -}} -{{- /* .appArmorProfile – string, appArmorProfile.type, set to empty string to disable (default RuntimeDefault) */ -}} -{{- /* .appArmorProfileLocalhost – string, appArmorProfile.localhostProfile, used only when appArmorProfile is "Localhost" (default empty) */ -}} -{{- /* Usage: include "helm_lib_application_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") */ -}} +{{- /* Usage: include "helm_lib_application_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) */ -}} {{- define "helm_lib_application_container_security_context_pss_restricted_flexible" -}} {{- $ro := true -}} {{- if hasKey . "ro" -}} @@ -88,14 +86,6 @@ securityContext: {{- if hasKey . "seccompProfile" -}} {{- $seccompProfile = .seccompProfile -}} {{- end -}} -{{- $appArmorProfile := "RuntimeDefault" -}} -{{- if hasKey . "appArmorProfile" -}} - {{- $appArmorProfile = .appArmorProfile -}} -{{- end -}} -{{- $appArmorProfileLocalhost := "" -}} -{{- if hasKey . "appArmorProfileLocalhost" -}} - {{- $appArmorProfileLocalhost = .appArmorProfileLocalhost -}} -{{- end -}} {{- $caps := default (list) .caps -}} {{- $uid := default 64535 .uid -}} {{- $runAsNonRoot := true -}} @@ -122,13 +112,6 @@ securityContext: seccompProfile: type: RuntimeDefault {{- end }} -{{- if $appArmorProfile }} - appArmorProfile: - type: {{ $appArmorProfile }} -{{- if and (eq $appArmorProfile "Localhost") $appArmorProfileLocalhost }} - localhostProfile: {{ $appArmorProfileLocalhost }} -{{- end }} -{{- end }} {{- end }} diff --git a/charts/helm_lib/templates/_module_security_context.tpl b/charts/helm_lib/templates/_module_security_context.tpl index 3501e89..1f51081 100644 --- a/charts/helm_lib/templates/_module_security_context.tpl +++ b/charts/helm_lib/templates/_module_security_context.tpl @@ -76,9 +76,7 @@ securityContext: {{- /* .uid – int, runAsUser/runAsGroup (default 64535) */ -}} {{- /* .runAsNonRoot – bool, run as Deckhouse user when true, root when false (default true) */ -}} {{- /* .seccompProfile – bool, disable seccompProfile when false (default true) */ -}} -{{- /* .appArmorProfile – string, appArmorProfile.type, set to empty string to disable (default RuntimeDefault) */ -}} -{{- /* .appArmorProfileLocalhost – string, appArmorProfile.localhostProfile, used only when appArmorProfile is "Localhost" (default empty) */ -}} -{{- /* Usage: include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") */ -}} +{{- /* Usage: include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) */ -}} {{- define "helm_lib_module_container_security_context_pss_restricted_flexible" -}} {{- $ro := true -}} {{- if hasKey . "ro" -}} @@ -88,14 +86,6 @@ securityContext: {{- if hasKey . "seccompProfile" -}} {{- $seccompProfile = .seccompProfile -}} {{- end -}} -{{- $appArmorProfile := "RuntimeDefault" -}} -{{- if hasKey . "appArmorProfile" -}} - {{- $appArmorProfile = .appArmorProfile -}} -{{- end -}} -{{- $appArmorProfileLocalhost := "" -}} -{{- if hasKey . "appArmorProfileLocalhost" -}} - {{- $appArmorProfileLocalhost = .appArmorProfileLocalhost -}} -{{- end -}} {{- $caps := default (list) .caps -}} {{- $uid := default 64535 .uid -}} {{- $runAsNonRoot := true -}} @@ -122,13 +112,6 @@ securityContext: seccompProfile: type: RuntimeDefault {{- end }} -{{- if $appArmorProfile }} - appArmorProfile: - type: {{ $appArmorProfile }} -{{- if and (eq $appArmorProfile "Localhost") $appArmorProfileLocalhost }} - localhostProfile: {{ $appArmorProfileLocalhost }} -{{- end }} -{{- end }} {{- end }} diff --git a/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml b/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml deleted file mode 100644 index d664912..0000000 --- a/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml +++ /dev/null @@ -1 +0,0 @@ -{{ include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") }} diff --git a/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml b/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml deleted file mode 100644 index 7d5d4a7..0000000 --- a/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml +++ /dev/null @@ -1 +0,0 @@ -{{ include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "appArmorProfile" "") }} diff --git a/tests/tests/helm_lib_application_container_security_context_test.yaml b/tests/tests/helm_lib_application_container_security_context_test.yaml index 6cd2d74..06fac31 100644 --- a/tests/tests/helm_lib_application_container_security_context_test.yaml +++ b/tests/tests/helm_lib_application_container_security_context_test.yaml @@ -18,13 +18,11 @@ tests: securityContext: readOnlyRootFilesystem: true allowPrivilegeEscalation: false - appArmorProfile: - type: RuntimeDefault capabilities: drop: - ALL runAsUser: 64535 - runAsGroup: 64535 + runAsGroup: 64535 privileged: false runAsNonRoot: true @@ -45,8 +43,6 @@ tests: runAsNonRoot: true seccompProfile: type: RuntimeDefault - appArmorProfile: - type: RuntimeDefault - it: read_only_root_filesystem default options asserts: diff --git a/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test.yaml b/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test.yaml index 9e9b6d3..802b8ae 100644 --- a/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test.yaml +++ b/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test.yaml @@ -1,12 +1,8 @@ suite: helm_lib_module_container_security_context_pss_restricted_flexible templates: - helm_lib_module_container_security_context_pss_restricted_flexible.yaml - - helm_lib_module_container_security_context_pss_restricted_flexible_seccomp_disabled.yaml - - helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml - - helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml tests: - it: default options - template: helm_lib_module_container_security_context_pss_restricted_flexible.yaml asserts: - equal: path: securityContext @@ -22,35 +18,3 @@ tests: runAsNonRoot: true seccompProfile: type: RuntimeDefault - appArmorProfile: - type: RuntimeDefault - - it: seccompProfile disabled still has appArmorProfile - template: helm_lib_module_container_security_context_pss_restricted_flexible_seccomp_disabled.yaml - asserts: - - equal: - path: securityContext - value: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - runAsUser: 64535 - runAsGroup: 64535 - privileged: false - runAsNonRoot: true - appArmorProfile: - type: RuntimeDefault - - it: custom appArmorProfile value - template: helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml - asserts: - - equal: - path: securityContext.appArmorProfile - value: - type: Localhost - localhostProfile: k8s-apparmor-example-deny-write - - it: disable appArmorProfile with empty string - template: helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml - asserts: - - notExists: - path: securityContext.appArmorProfile diff --git a/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test_seccomp_disabled.yaml b/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test_seccomp_disabled.yaml new file mode 100644 index 0000000..6b96afd --- /dev/null +++ b/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test_seccomp_disabled.yaml @@ -0,0 +1,17 @@ +suite: helm_lib_module_container_security_context_pss_restricted_flexible +templates: + - helm_lib_module_container_security_context_pss_restricted_flexible_seccomp_disabled.yaml +tests: + - it: seccompProfile disabled + asserts: + - equal: + path: securityContext + value: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsUser: 64535 + runAsGroup: 64535 + runAsNonRoot: true diff --git a/tests/tests/helm_lib_module_init_container_test.yaml b/tests/tests/helm_lib_module_init_container_test.yaml index ff0942e..d058bf7 100644 --- a/tests/tests/helm_lib_module_init_container_test.yaml +++ b/tests/tests/helm_lib_module_init_container_test.yaml @@ -99,8 +99,6 @@ tests: ephemeral-storage: 50Mi securityContext: allowPrivilegeEscalation: false - appArmorProfile: - type: RuntimeDefault capabilities: drop: - ALL From 2537ecaab9298aa55be7a89c4925b1fa4b962b4b Mon Sep 17 00:00:00 2001 From: "v.oleynikov" Date: Sat, 4 Jul 2026 12:21:06 +0300 Subject: [PATCH 2/2] chore: bump chart version to 1.72.7 --- charts/helm_lib/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/helm_lib/Chart.yaml b/charts/helm_lib/Chart.yaml index d4230a7..80d1e96 100644 --- a/charts/helm_lib/Chart.yaml +++ b/charts/helm_lib/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 type: library name: deckhouse_lib_helm -version: 1.72.5 +version: 1.72.7 description: "Helm utils template definitions for Deckhouse modules."