feat: Add pod security context configuration for ClickHouse and Redis StatefulSets

HelmChart/Public/oneuptime/templates/clickhouse-statefulset.yaml

@@ -44,10 +44,17 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.clickhouse.podSecurityContext }}
+      {{- with .Values.clickhouse.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- else if .Values.podSecurityContext }}
       {{- with .Values.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- end }}
       containers:
       - name: clickhouse
         image: "{{ .Values.clickhouse.image.repository }}:{{ .Values.clickhouse.image.tag }}"

HelmChart/Public/oneuptime/templates/redis-statefulset.yaml

@@ -38,10 +38,17 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.redis.master.podSecurityContext }}
+      {{- with .Values.redis.master.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- else if .Values.podSecurityContext }}
       {{- with .Values.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- end }}
       containers:
       - name: redis
         image: "{{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}"

HelmChart/Public/oneuptime/values.yaml

@@ -134,6 +134,16 @@ clickhouse:
   nodeSelector: {}
   tolerations: []
   affinity: {}
+  # Optional: override global security contexts just for the ClickHouse pod/container
+  # podSecurityContext:
+  #   runAsUser: 101
+  #   runAsGroup: 101
+  #   fsGroup: 101
+  # containerSecurityContext:
+  #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop: ["ALL"]
   resources: {}
   # Custom ClickHouse configuration
   configuration: |-
@@ -195,6 +205,16 @@ redis:
     nodeSelector: {}
     tolerations: []
     affinity: {}
+  # Optional: override global security contexts just for the Redis pod/container
+  # podSecurityContext:
+  #   runAsUser: 999
+  #   runAsGroup: 999
+  #   fsGroup: 999
+  # containerSecurityContext:
+  #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop: ["ALL"]
     resources: {}
   commonConfiguration: |-
    appendonly no