Skip to content

fix(helm): pass Restricted Pod Security on certgen hook - #3747

Closed
ericcurtin wants to merge 1 commit into
NVIDIA:mainfrom
ericcurtin:fix-helm-certgen-psa/ec
Closed

fix(helm): pass Restricted Pod Security on certgen hook#3747
ericcurtin wants to merge 1 commit into
NVIDIA:mainfrom
ericcurtin:fix-helm-certgen-psa/ec

Conversation

@ericcurtin

@ericcurtin ericcurtin commented Sep 27, 2026

Copy link
Copy Markdown
Contributor

Summary

Certgen Job now sets runAsNonRoot and seccompProfile so it passes Restricted PSA. Both certgen Jobs share one pkiInitJob.podSecurityContext/pkiInitJob.securityContext value instead of duplicating inline security blocks.

Related Issue

Fixes #3215

Changes

  • Add pkiInitJob.podSecurityContext and pkiInitJob.securityContext values, Restricted-compliant by default.
  • Both certgen Jobs render these instead of a hardcoded, duplicated securityContext.
  • New chart test asserting the rendered security context on both Jobs.
  • Regenerated README with helm-docs.

Testing

  • mise run helm:lint
  • mise run helm:test
  • mise run pre-commit

Checklist

  • Follows Conventional Commits
  • Commit is signed off (DCO)

@ericcurtin
fix(helm): pass Restricted Pod Security on certgen hook
01f4d63 
Add runAsNonRoot and seccompProfile so the certgen Job passes
Restricted PSA. Values are configurable via pkiInitJob.podSecurityContext
and pkiInitJob.securityContext, shared by both certgen Jobs instead of
duplicated inline blocks.

Fixes NVIDIA#3215

Signed-off-by: Eric Curtin <eric.curtin@docker.com>
@copy-pr-bot

copy-pr-bot Bot commented Sep 27, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@ericcurtin ericcurtin closed this Sep 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@sjenning sjenning Awaiting requested review from sjenning sjenning is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

bug(helm): certgen hook is rejected by Restricted Pod Security

1 participant

@ericcurtin