fix(agents): add podSecurityContext and securityContext to all agent charts

[QuentinBisson]

What

Adds podSecurityContext and securityContext values to all 10 declarative agent charts and wires them through to spec.declarative.deployment in the rendered Agent CR.

Why

All agent chart templates currently only render imagePullSecrets and resources in the deployment section. The kagent controller creates Deployments from those Agent CRs, and those Deployments lack the fields required by Kubernetes restricted Pod Security Standards:

• capabilities.drop: [ALL]
• allowPrivilegeEscalation: false
• runAsNonRoot: true
• seccompProfile.type: RuntimeDefault

On clusters enforcing restricted PSS via Kyverno or OPA, all declarative agent Deployments are blocked at admission.

The Agent CRD v1alpha2 already supports spec.declarative.deployment.podSecurityContext and spec.declarative.deployment.securityContext. The templates just weren't passing them through.

Changes

Each of the 10 agent charts (argo-rollouts, cilium-debug, cilium-manager, cilium-policy, helm, istio, k8s, kgateway, observability, promql) gets the same change:

values.yaml (new defaults, empty so existing deployments are unaffected):

podSecurityContext: {}
securityContext: {}

templates/agent.yaml (render only when set):

{{- with .Values.podSecurityContext }}
podSecurityContext:
  {{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.securityContext }}
securityContext:
  {{- toYaml . | nindent 8 }}
{{- end }}

Usage

Callers can now pass the required fields:

cilium-policy:
  podSecurityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop: [ALL]
    seccompProfile:
      type: RuntimeDefault

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds configurable pod/container security context options to multiple agent Helm charts so deployments can set Kubernetes security hardening settings via values.

Changes:

• Introduced podSecurityContext and securityContext in agent chart values.yaml files.
• Rendered those values into each agent manifest template under spec.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
helm/agents/promql/values.yaml	Adds security context value keys for the promql agent chart.
helm/agents/promql/templates/agent.yaml	Renders new security context values into the promql agent manifest.
helm/agents/observability/values.yaml	Adds security context value keys for the observability agent chart.
helm/agents/observability/templates/agent.yaml	Renders new security context values into the observability agent manifest.
helm/agents/kgateway/values.yaml	Adds security context value keys for the kgateway agent chart.
helm/agents/kgateway/templates/agent.yaml	Renders new security context values into the kgateway agent manifest.
helm/agents/k8s/values.yaml	Adds security context value keys for the k8s agent chart.
helm/agents/k8s/templates/agent.yaml	Renders new security context values into the k8s agent manifest.
helm/agents/istio/values.yaml	Adds security context value keys for the istio agent chart.
helm/agents/istio/templates/agent.yaml	Renders new security context values into the istio agent manifest.
helm/agents/helm/values.yaml	Adds security context value keys for the helm agent chart.
helm/agents/helm/templates/agent.yaml	Renders new security context values into the helm agent manifest.
helm/agents/cilium-policy/values.yaml	Adds security context value keys for the cilium-policy agent chart.
helm/agents/cilium-policy/templates/agent.yaml	Renders new security context values into the cilium-policy agent manifest.
helm/agents/cilium-manager/values.yaml	Adds security context value keys for the cilium-manager agent chart.
helm/agents/cilium-manager/templates/agent.yaml	Renders new security context values into the cilium-manager agent manifest.
helm/agents/cilium-debug/values.yaml	Adds security context value keys for the cilium-debug agent chart.
helm/agents/cilium-debug/templates/agent.yaml	Renders new security context values into the cilium-debug agent manifest.
helm/agents/argo-rollouts/values.yaml	Adds security context value keys for the argo-rollouts agent chart.
helm/agents/argo-rollouts/templates/agent.yaml	Renders new security context values into the argo-rollouts agent manifest.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.