Helm chart - adding securityContext and initcontainer option to Microcks #1231

Reason/Context

Motivation:
A few days ago, I attempted to deploy Microcks on our Kubernetes (K8S) cluster (clean Kubernetes, not OpenShift).

We have a strict policy on our K8S cluster, meaning all our containers must be rootless and read-only. Additionally, the securityContext is pre-configured and needs to be adjusted before deployment. Some services, like Conduktor, allow changes to the securityContext for containers in the values.yml file.

I apologize for any incorrect terminology, as I am still new to Helm and related concepts.

Description

Currently, deploying Microcks on a Kubernetes (k8s) cluster with strict policies is not possible for Microcks helm now. For instance, on our k8s cluster, all containers must be strictly read-only and run as non-root users. To handle a read-write medium, we need to create volumes.

When dealing with read-only and rootless containers, an InitContainer is required to move existing files to a read-write medium.

If the securityContext is pre-configured by the k8s cluster, we cannot directly change these values in the values.yml configuration for now. Thats why I hope these changes will be applied in next version.

Implementation ideas

Nice option will be like this (implemented in values.yml)
(Something like this I implemented for another application called keycloak with same problems)

appName: microcks
ingresses: true


microcks:
  containerSecurityContext:
      runAsUser: 1000
      runAsGroup: 0
      fsGroup: 1000

  initContainers:
      - name: copy-opt
        command: ["bash", "-c"]
        args:
        - rm -rf /tmp/opt/microcks/ && mkdir -p /tmp/opt/microcks/ && cp -R /opt/microcks/* /tmp/opt/microcks/
        image: quay.io/microcks/microcks:1.9.1
        imagePullPolicy: IfNotPresent
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true

  containerVolumeMounts:
     - volumeMounts:
        - mountPath: /tmp
          name: workspace
          subPath: tmp
        - mountPath: /opt
          name: workspace
          subPath: opt
  extraVolumes:
      - name: workspace
        emptyDir: {}