Add support for container security context

2 files changed, 40 insertions, 3 deletions

diff --git a/deployment.tf b/deployment.tf
index 97ae210..791ce85 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -83,6 +83,12 @@ resource "kubernetes_deployment_v1" "this" {
 
           image_pull_policy = try(var.pull_policy, contains(local.container_tags_pull_always, local.container_tag) ? "Always" : null, "IfNotPresent")
 
+          security_context {
+            allow_privilege_escalation = var.allow_privilege_escalation
+            privileged                 = var.privileged
+            read_only_root_filesystem  = var.ro_rootfs
+          }
+
           dynamic "env" {
             for_each = var.env
 
diff --git a/main.tf b/main.tf
index 3b1b391..eb7cc7d 100644
--- a/main.tf
+++ b/main.tf
@@ -52,6 +52,16 @@ variable "namespace" {
 
 # Deployment
 
+variable "allow_privilege_escalation" {
+  type        = bool
+  default     = false
+  description = <<-EOF
+    Allow privilege escalation of the container. Be wary of security risks when
+    setting this to true. In Kubernetes manifests, this is equivalent to
+    `.spec.template.spec.container[0].securityContext.allowPrivilegeEscalation`.
+  EOF
+}
+
 variable "args" {
   type        = list(string)
   default     = null
@@ -169,15 +179,25 @@ variable "image" {
 }
 
 variable "priority_class" {
-  type         = string
-  default      = null
-  description  = <<-EOF
+  type        = string
+  default     = null
+  description = <<-EOF
     The priority class name to schedule the containers with. In Kubernetes
     manifests, this is equivalent to
     `.spec.template.spec.container[0].priorityClassName`.
   EOF
 }
 
+variable "privileged" {
+  type        = bool
+  default     = false
+  description = <<-EOF
+    Run the container with full privileges. Be wary of security risks when
+    setting this to true. In Kubernetes manifests, this is equivalent to
+    `.spec.template.spec.container[0].securityContext.privileged`.
+  EOF
+}
+
 variable "pull_policy" {
   type        = string
   default     = null
@@ -221,6 +241,17 @@ variable "resources" {
   EOF
 }
 
+variable "ro_rootfs" {
+  type        = bool
+  default     = false
+  description = <<-EOF
+    Mark the container's root filesystem as read-only. It is set to true by
+    default, which can break some containers. In Kubernetes manifests, this is
+    equivalent to
+    `.spec.template.spec.container[0].securityContext.readOnlyRootFilesystem`.
+  EOF
+}
+
 variable "selector" {
   type        = map(string)
   default     = {}