fix: security context.

[pantierra]

Closes #608

[claude]

Claude finished @pantierra's task in 1m 44s —— View job

---

Review

• Gather context
• Review diff for correctness/security/best-practice issues
• Apply ponytail-review pass for over-engineering
• Post final review

✅ No blocking issues — safe to merge.

Reviewed the full diff (git diff origin/main...HEAD) across all 18 changed files.

What the PR does: adds opt-in securityContext (container) and podSecurityContext (pod) fields to every workload in the chart (stac/raster/vector/multidim/browser/doc-server/testing deployments, knative jobs/cloudevents-sink, and all pgstacBootstrap Jobs/CronJobs), all defaulting to {} so existing deployments are unaffected.

Correctness/security checks performed:

• Verified the two places that previously had hardcoded securityContext (the wait-for-pgstac-jobs init container in _helpers/services.tpl and knative-init.yaml) now source their values from values.yaml defaults that reproduce the exact same values (runAsNonRoot: true, runAsUser: 65534, runAsGroup: 65534) — no regression in default hardening.
• Verified cloudevents-sink.yaml and the other deployment templates had no prior hardcoded securityContext, so defaulting to {} there is correctly non-breaking, not a hardening regression.
• Spot-checked nindent levels in stac/deployment.yaml, doc-server.yaml, job.yaml, knative-init.yaml — container-level blocks align with sibling resources:/env: keys, pod-level blocks align with sibling serviceAccountName:/affinity: keys. Indentation is correct throughout.
• Confirmed values.schema.json additions structurally mirror the existing schema entries (valid type/description objects, correctly nested under the right service definitions).
• Confirmed values.yaml value paths referenced in templates (e.g. knative.jobs.init.podSecurityContext, testing.mockOidcServer.securityContext, pgstacBootstrap.settings.initContainerSecurityContext) all resolve to real, correctly-nested keys.
• security_context_tests.yaml (311 lines, helm-unittest) covers default-absence and override behavior for every touched template, including the two default-hardened cases — good regression coverage.
• README documents the new fields and the two historical-default exceptions accurately.

Pattern is applied consistently (same {{- with .Values.X.securityContext }}...{{- end }} idiom already used elsewhere in this chart for resources/affinity/tolerations), so no new template conventions were introduced.

Simplify (ponytail): none — the repeated {{- with }} security-context blocks match this chart's existing boilerplate style for optional pod/container fields (same as resources, affinity, tolerations); introducing a shared helper would add nindent-parameterization complexity for no real gain at this call-site count.

---

💰 Estimated review cost: $0.57 · 1m44s · 30 turns