Summary:

This pull request adds a new configuration option to make the container-level securityContext optional in the CloudNativePG Helm chart. This change improves compatibility with OpenShift by allowing users to disable the container securityContext when deploying the operator.

Background:

When deploying the CloudNativePG operator on OpenShift, the predefined container securityContext can cause conflicts due to OpenShift's strict security policies. OpenShift manages user and group IDs dynamically and does not allow containers to run as a specific user or group unless explicitly permitted. Hardcoded runAsUser and runAsGroup values (values.yaml) in the container securityContext may prevent pods from starting on OpenShift clusters.

Changes Introduced:

• Added a new boolean flag enableSecurityContext under containerSecurityContext in values.yaml, defaulting to true to maintain existing behavior.
• Modified deployment.yaml to include the container securityContext only when enableSecurityContext is set to true.
• Updated the README.md to document the new configuration option and guide users on how to use it.

Benefits:

• Flexibility: Users can now disable the container securityContext when deploying to OpenShift or other environments with strict security constraints.
• Compatibility: Resolves deployment issues on OpenShift by preventing conflicts with the platform's security policies.
• Maintainability: Maintains the default behavior for existing users while providing an option for those who need it.

Usage Example:

To disable the container securityContext on OpenShift, set enableSecurityContext to false in your custom values/override file:

containerSecurityContext:
  enableSecurityContext: false

Testing:

• Verified that the operator deploys successfully on OpenShift with enableSecurityContext set to false.
• Confirmed that the default behavior remains unchanged when the flag is set to true.