feat(chart): add securityContext, priorityClassName, and standard labels

Add support for Kubernetes security and scheduling best practices:

- Add configurable `podSecurityContext` (default: `fsGroup: 1000`,
  preserving existing behavior) and `securityContext` for the container
  (default: `{}`, no change for existing users)
- Add `priorityClassName` value (default: empty, field not emitted)
- Add standard `app.kubernetes.io/*` labels via helpers while keeping
  the existing `app: <name>` selector labels for backwards compatibility

These changes allow deployments to comply with Kubernetes PodSecurity
"restricted" profile and common policy engines (Kyverno, OPA/Gatekeeper)
without breaking existing installations.

Selector labels (`spec.selector.matchLabels`) are intentionally left
unchanged to avoid breaking rolling updates on existing deployments.

Example values for PodSecurity "restricted" compliance:

    securityContext:
      runAsNonRoot: true
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]
      seccompProfile:
        type: RuntimeDefault
    priorityClassName: my-priority-class

Author: bl4ko

charts/trek/templates/_helpers.tpl

@@ -16,3 +16,30 @@ Create a default fully qualified app name.
 {{- printf "%s" $name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "trek.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "trek.labels" -}}
+helm.sh/chart: {{ include "trek.chart" . }}
+{{ include "trek.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "trek.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "trek.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}

charts/trek/templates/deployment.yaml

@@ -4,6 +4,7 @@ metadata:
   name: {{ include "trek.fullname" . }}
   labels:
     app: {{ include "trek.name" . }}
+    {{- include "trek.labels" . | nindent 4 }}
 spec:
   replicas: 1
   selector:
@@ -16,19 +17,29 @@ spec:
         checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
       labels:
         app: {{ include "trek.name" . }}
+        {{- include "trek.selectorLabels" . | nindent 8 }}
     spec:
       {{- if .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- range .Values.imagePullSecrets }}
         - name: {{ .name }}
         {{- end }}
       {{- end }}
+      {{- with .Values.podSecurityContext }}
       securityContext:
-        fsGroup: 1000
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+      {{- end }}
       containers:
         - name: trek
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- with .Values.resources }}
           resources:
             {{- toYaml . | nindent 12 }}

charts/trek/templates/ingress.yaml

@@ -5,6 +5,7 @@ metadata:
   name: {{ include "trek.fullname" . }}
   labels:
     app: {{ include "trek.name" . }}
+    {{- include "trek.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/trek/templates/service.yaml

@@ -4,6 +4,7 @@ metadata:
   name: {{ include "trek.fullname" . }}
   labels:
     app: {{ include "trek.name" . }}
+    {{- include "trek.labels" . | nindent 4 }}
 spec:
   type: {{ .Values.service.type }}
   ports:

charts/trek/values.yaml

@@ -90,6 +90,25 @@ generateEncryptionKey: false
 existingSecret: ""
 existingSecretKey: ENCRYPTION_KEY
 
+# Pod-level security context (applied to the pod spec)
+podSecurityContext:
+  fsGroup: 1000
+
+# Container-level security context (applied to the trek container)
+# Example for PodSecurity "restricted" compliance:
+#   runAsNonRoot: true
+#   allowPrivilegeEscalation: false
+#   capabilities:
+#     drop:
+#       - ALL
+#   seccompProfile:
+#     type: RuntimeDefault
+securityContext: {}
+
+# Priority class name for the pod
+# See: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/
+priorityClassName: ""
+
 persistence:
   enabled: true
   data: