Add security context for crdHook to enable security policy compliance

deploy/helm/clickhouse-operator/templates/hooks/crd-install-job.yaml

@@ -63,6 +63,10 @@ spec:
         resources:
           {{- toYaml . | nindent 10 }}
         {{- end }}
+        {{- with .Values.crdHook.containerSecurityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
       volumes:
       - name: crds
         configMap:

deploy/helm/clickhouse-operator/values.schema.json

@@ -635,6 +635,49 @@
                 }
             }
         },
+        "crdHook": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        },
+                        "pullPolicy": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "imagePullSecrets": {
+                    "type": "array"
+                },
+                "resources": {
+                    "type": "object"
+                },
+                "nodeSelector": {
+                    "type": "object"
+                },
+                "tolerations": {
+                    "type": "array"
+                },
+                "affinity": {
+                    "type": "object"
+                },
+                "annotations": {
+                    "type": "object"
+                },
+                "containerSecurityContext": {
+                    "type": "object"
+                }
+            }
+        },
         "dashboards": {
             "type": "object",
             "properties": {

deploy/helm/clickhouse-operator/values.yaml

@@ -38,6 +38,16 @@ crdHook:
   affinity: {}
   # crdHook.annotations -- additional annotations for CRD installation job
   annotations: {}
+  # crdHook.containerSecurityContext -- container security context for CRD installation job
+  # check `kubectl explain pod.spec.containers.securityContext` for details
+  containerSecurityContext: {}
+  #  allowPrivilegeEscalation: false
+  #  capabilities:
+  #    drop:
+  #      - ALL
+  #  runAsNonRoot: true
+  #  seccompProfile:
+  #    type: RuntimeDefault
 operator:
   image:
     # operator.image.registry -- optional image registry prefix (e.g. 1234567890.dkr.ecr.us-east-1.amazonaws.com)