(kyuubi) branch branch-1.12 updated: [KYUUBI #7790] [K8S][HELM] Support container security context and StatefulSet annotations

[dn...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

dnskr pushed a commit to branch branch-1.12
in repository https://gitbox.apache.org/repos/asf/kyuubi.git


The following commit(s) were added to refs/heads/branch-1.12 by this push:
     new da8a967b9b [KYUUBI #7790] [K8S][HELM] Support container security context and StatefulSet annotations
da8a967b9b is described below

commit da8a967b9b729932f32ff7888d89a1fb8cef05b7
Author: Andreas Kirn <an...@servicenow.com>
AuthorDate: Sun Oct 25 13:19:02 2026 +0100

    [KYUUBI #7790] [K8S][HELM] Support container security context and StatefulSet annotations
    
    ### Why are the changes needed?
    
    The chart only exposes a pod-level `securityContext`. Fields such as `allowPrivilegeEscalation`, `readOnlyRootFilesystem` and `capabilities` exist only on the container `securityContext`, so clusters whose admission policies require them (for example Pod Security Standards "restricted", or Kyverno/Gatekeeper equivalents) can't run the chart without patching the template. This adds a `containerSecurityContext` value applied to the `kyuubi-server` container, as the Apache Polaris and Da [...]
    
    It also adds an `annotations` value for the StatefulSet's own metadata. `podAnnotations` only reaches the pod template, but some controllers read the workload's annotations. For example, Stakater Reloader' `secret.reloader.stakater.com/reload` must be on the StatefulSet to roll the pods when a TLS keystore Secret is renewed, since the Kyuubi server reads its keystore only at startup.
    
    Both values default to `{}`, so the rendered output is unchanged for existing users.
    
    ### How was this patch tested?
    
    The chart has no unit tests, so this was checked by rendering:
    
    1. `helm lint charts/kyuubi` passes.
    2. With default values, `helm template t charts/kyuubi` is byte-identical to master.
    3. With both values set:
    ```
    helm template t charts/kyuubi -s templates/kyuubi-statefulset.yaml --set-json 'annotations={"secret.reloader.stakater.com/reload":"kyuubi-tls"}' --set-json
      'containerSecurityContext={"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"capabilities":{"drop":["ALL"]}}'
      the annotation renders under the StatefulSet's `metadata.annotations` and the security context under the `kyuubi-server` container. The output passes `kubectl apply --dry-run=client`.
    ```
    ### Was this patch assisted by generative AI tooling?
    No. The patch wasn't assisted. The description was.
    
     cc pan3793 dnskr
    
    Closes #7790 from akirn/helm-container-security-context-and-statefulset-annotations.
    
    Closes #7790
    
    2477b1af0 [andreas.kirn] [K8S][HELM] Support container security context and StatefulSet annotations
    
    Authored-by: Andreas Kirn <an...@servicenow.com>
    Signed-off-by: Denis Krivenko <dn...@gmail.com>
    (cherry picked from commit 07a5a969b840845a43b1915a700ada2f3d6167b3)
    Signed-off-by: Denis Krivenko <dn...@gmail.com>
---
 charts/kyuubi/templates/kyuubi-statefulset.yaml | 6 ++++++
 charts/kyuubi/values.yaml                       | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/charts/kyuubi/templates/kyuubi-statefulset.yaml b/charts/kyuubi/templates/kyuubi-statefulset.yaml
index 36c1127d73..152f492d0a 100644
--- a/charts/kyuubi/templates/kyuubi-statefulset.yaml
+++ b/charts/kyuubi/templates/kyuubi-statefulset.yaml
@@ -21,6 +21,9 @@ metadata:
   name: {{ .Release.Name }}
   labels:
     {{- include "kyuubi.labels" . | nindent 4 }}
+  {{- with .Values.annotations }}
+  annotations: {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     matchLabels:
@@ -60,6 +63,9 @@ spec:
         - name: kyuubi-server
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- with .Values.containerSecurityContext }}
+          securityContext: {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- with .Values.command }}
           command: {{- tpl (toYaml .) $ | nindent 12 }}
           {{- end }}
diff --git a/charts/kyuubi/values.yaml b/charts/kyuubi/values.yaml
index e48cb01abf..1f1ec33179 100644
--- a/charts/kyuubi/values.yaml
+++ b/charts/kyuubi/values.yaml
@@ -27,6 +27,9 @@ replicaCount: 2
 # The default policy is `OrderedReady`, alternative policy is `Parallel`.
 podManagementPolicy: OrderedReady
 
+# Optional additional annotations to add to the Kyuubi server StatefulSet
+annotations: {}
+
 # Optional additional annotations to add to Kyuubi server pods
 podAnnotations: {}
 
@@ -291,6 +294,9 @@ affinity: {}
 # Kyuubi pods security context
 securityContext: {}
 
+# Kyuubi server container security context
+containerSecurityContext: {}
+
 # Metrics configuration
 metrics:
   # Enable metrics system, used for 'kyuubi.metrics.enabled' property