Add securityContext config for Redis to helm chart

chart/templates/redis/redis-statefulset.yaml

@@ -22,6 +22,7 @@
 {{- $nodeSelector := or .Values.redis.nodeSelector .Values.nodeSelector }}
 {{- $affinity := or .Values.redis.affinity .Values.affinity }}
 {{- $tolerations := or .Values.redis.tolerations .Values.tolerations }}
+{{- $securityContext := include "localSecurityContext" .Values.redis }}
 kind: StatefulSet
 apiVersion: apps/v1
 metadata:
@@ -67,6 +68,7 @@ spec:
       imagePullSecrets:
         - name: {{ template "registry_secret" . }}
       {{- end }}
+      securityContext: {{ $securityContext | nindent 8 }}
       containers:
         - name: redis
           image: {{ template "redis_image" . }}

chart/values.schema.json

@@ -3774,6 +3774,24 @@
                             }
                         }
                     }
+                },
+                "securityContext": {
+                    "description": "Security context for the cleanup job pod. If not set, the values from `securityContext` will be used.",
+                    "type": "object",
+                    "$ref": "#/definitions/io.k8s.api.core.v1.PodSecurityContext",
+                    "default": {},
+                    "examples": [
+                        {
+                            "runAsUser": 999,
+                            "runAsGroup": 0,
+                            "fsGroup": 0
+                        }
+                    ]
+                },
+                "uid": {
+                    "description": "Redis run as user parameter.",
+                    "type": "integer",
+                    "default": 0
                 }
             }
         },

chart/values.yaml

@@ -1329,6 +1329,13 @@ redis:
   affinity: {}
   tolerations: []
 
+  # Set to 0 for backwards-compatiblity
+  uid: 0
+  # If not set, `redis.uid` will be used
+  securityContext: {}
+  #  runAsUser: 999
+  #  runAsGroup: 0
+
 # Auth secret for a private registry
 # This is used if pulling airflow images from a private registry
 registry:

tests/charts/test_security_context.py

@@ -139,6 +139,7 @@ def test_check_local_setting(self):
                 "createUserJob": {**component_contexts},
                 "migrateDatabaseJob": {**component_contexts},
                 "triggerer": {**component_contexts},
+                "redis": {**component_contexts},
                 "statsd": {"enabled": True, **component_contexts},
                 "airflowVersion": "2.2.0",
                 "executor": "CeleryKubernetesExecutor",
@@ -152,6 +153,7 @@ def test_check_local_setting(self):
                 "templates/jobs/create-user-job.yaml",
                 "templates/jobs/migrate-database-job.yaml",
                 "templates/statsd/statsd-deployment.yaml",
+                "templates/redis/redis-statefulset.yaml",
             ],
         )
 
@@ -160,14 +162,22 @@ def test_check_local_setting(self):
             assert 9000 == jmespath.search("spec.template.spec.securityContext.runAsUser", docs[index])
             assert 90 == jmespath.search("spec.template.spec.securityContext.fsGroup", docs[index])
 
-    # Test containerSecurity priority over uid under statsd
-    def test_check_statsd_uid(self):
+    # Test containerSecurity priority over uid under components using localSecurityContext
+    def test_check_local_uid(self):
+        component_contexts = {"uid": 3000, "securityContext": {"runAsUser": 7000}}
         docs = render_chart(
-            values={"statsd": {"enabled": True, "uid": 3000, "securityContext": {"runAsUser": 7000}}},
-            show_only=["templates/statsd/statsd-deployment.yaml"],
+            values={
+                "redis": {**component_contexts},
+                "statsd": {"enabled": True, **component_contexts},
+            },
+            show_only=[
+                "templates/statsd/statsd-deployment.yaml",
+                "templates/redis/redis-statefulset.yaml",
+            ],
         )
 
-        assert 7000 == jmespath.search("spec.template.spec.securityContext.runAsUser", docs[0])
+        for doc in docs:
+            assert 7000 == jmespath.search("spec.template.spec.securityContext.runAsUser", doc)
 
     # Test containerSecurity priority over uid under dags.gitSync
     def test_gitsync_sidecar_and_init_container(self):