charts: Permit setting hostUsers for deployment

jcpunk · jcpunk · commit c8ba436646b8 · 2026-01-20T08:39:52.000-06:00
Signed-off-by: Pat Riehecky &lt;riehecky@fnal.gov&gt;
diff --git a/charts/headlamp/templates/deployment.yaml b/charts/headlamp/templates/deployment.yaml
@@ -81,6 +81,7 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "headlamp.serviceAccountName" . }}
       automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+      hostUsers: {{ .Values.hostUsers }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       {{- with .Values.initContainers }}
diff --git a/charts/headlamp/tests/expected_templates/azure-oidc-with-validators.yaml b/charts/headlamp/tests/expected_templates/azure-oidc-with-validators.yaml
@@ -85,6 +85,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/default.yaml b/charts/headlamp/tests/expected_templates/default.yaml
@@ -94,6 +94,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/extra-args.yaml b/charts/headlamp/tests/expected_templates/extra-args.yaml
@@ -94,6 +94,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/extra-manifests.yaml b/charts/headlamp/tests/expected_templates/extra-manifests.yaml
@@ -111,6 +111,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/me-user-info-url-directly.yaml b/charts/headlamp/tests/expected_templates/me-user-info-url-directly.yaml
@@ -94,6 +94,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/me-user-info-url.yaml b/charts/headlamp/tests/expected_templates/me-user-info-url.yaml
@@ -94,6 +94,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/namespace-override-oidc-create-secret.yaml b/charts/headlamp/tests/expected_templates/namespace-override-oidc-create-secret.yaml
@@ -98,6 +98,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/namespace-override.yaml b/charts/headlamp/tests/expected_templates/namespace-override.yaml
@@ -94,6 +94,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/non-azure-oidc.yaml b/charts/headlamp/tests/expected_templates/non-azure-oidc.yaml
@@ -85,6 +85,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/oidc-create-secret.yaml b/charts/headlamp/tests/expected_templates/oidc-create-secret.yaml
@@ -98,6 +98,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/oidc-directly-env.yaml b/charts/headlamp/tests/expected_templates/oidc-directly-env.yaml
@@ -94,6 +94,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/oidc-directly.yaml b/charts/headlamp/tests/expected_templates/oidc-directly.yaml
@@ -85,6 +85,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/oidc-external-secret.yaml b/charts/headlamp/tests/expected_templates/oidc-external-secret.yaml
@@ -85,6 +85,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/oidc-pkce.yaml b/charts/headlamp/tests/expected_templates/oidc-pkce.yaml
@@ -85,6 +85,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/oidc-validator-overrides.yaml b/charts/headlamp/tests/expected_templates/oidc-validator-overrides.yaml
@@ -85,6 +85,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/pod-disruption.yaml b/charts/headlamp/tests/expected_templates/pod-disruption.yaml
@@ -114,6 +114,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/security-context.yaml b/charts/headlamp/tests/expected_templates/security-context.yaml
@@ -109,6 +109,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         fsGroup: 2000
         runAsGroup: 3000
diff --git a/charts/headlamp/tests/expected_templates/tls-added.yaml b/charts/headlamp/tests/expected_templates/tls-added.yaml
@@ -94,6 +94,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/tests/expected_templates/volumes-added.yaml b/charts/headlamp/tests/expected_templates/volumes-added.yaml
@@ -94,6 +94,7 @@ spec:
     spec:
       serviceAccountName: headlamp
       automountServiceAccountToken: true
+      hostUsers: true
       securityContext:
         {}
       containers:
diff --git a/charts/headlamp/values.yaml b/charts/headlamp/values.yaml
@@ -146,6 +146,13 @@ podAnnotations: {}
 # -- Labels to add to the pod
 podLabels: {}
 
+# -- Controls user namespace isolation for the Headlamp pod.
+# -- When true (default), the pod shares the host user namespace (user namespaces are DISABLED).
+# -- When false, the pod uses a separate user namespace (user namespaces are ENABLED) for stronger isolation,
+# -- if supported by the cluster. Set this to false if your cluster supports user namespaces and you want
+# -- additional isolation; leave as true for the default behavior or if user namespaces are not available.
+hostUsers: true
+
 # -- Headlamp pod's Security Context
 podSecurityContext:
   {}
