feat: harden pod security

[Patrick Derks (TrayserCassa)]

No description provided.

[Copilot]

Pull request overview

Adds a shared “restricted” container security context and applies it across operator-managed Deployments/Jobs/CronJobs to better align generated workloads with hardened Kubernetes security settings.

Changes:

• Introduces util.RestrictedContainerSecurityContext() and wires it into multiple controllers’ container specs.
• Adds unit tests to assert the new container-level security context is applied (jobs + cronjob).
• Adds a kubebuilder default annotation for podSecurityContext on ContainerSpec.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/util/security.go	Adds helper to generate a restricted corev1.SecurityContext for containers.
internal/job/snapshot.go	Applies restricted container security context to snapshot job container.
internal/job/snapshot_test.go	New test asserting snapshot job uses restricted container security context.
internal/job/setup.go	Applies restricted container security context to setup job container.
internal/job/setup_test.go	Adds assertions that setup job container uses restricted container security context.
internal/job/migration.go	Applies restricted container security context to migration job container.
internal/job/migration_test.go	Adds assertions that migration job container uses restricted container security context.
internal/job/command.go	Applies restricted container security context to command job container spec.
internal/job/command_test.go	Adds assertions that command job + cronjob containers use restricted container security context.
internal/cronjob/scheduled_task.go	Applies restricted container security context to scheduled-task cronjob container.
internal/cronjob/scheduled_task_test.go	New test asserting scheduled-task cronjob uses restricted container security context.
internal/deployment/storefront.go	Applies restricted container security context to storefront deployment container.
internal/deployment/storefront_test.go	Updates storefront security-context test expectations.
internal/deployment/worker.go	Applies restricted container security context to worker deployment container.
internal/deployment/admin.go	Applies restricted container security context to admin deployment container.
api/v1/store.go	Adds kubebuilder default for podSecurityContext on ContainerSpec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.