[tarabrind]

What

Adds helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add_runtime_default.

It returns the same securityContext as helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add, plus seccompProfile: RuntimeDefault:

securityContext:
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL
    add: [...]
  seccompProfile:
    type: RuntimeDefault

Why

Containers that must run as root with extra capabilities currently have no helper that also sets the RuntimeDefault seccomp profile:

• *_drop_all_and_add has no seccompProfile, so modules append it by hand after the include.
• *_pss_restricted_flexible sets seccompProfile, but for root (runAsNonRoot: false) it sets allowPrivilegeEscalation: true, which weakens the context.
• A pod-level seccompProfile cannot be combined with the pod security context helpers, as each of them emits its own securityContext block.

The first user is hubble-relay in the cilium-hubble module of Deckhouse (root with DAC_OVERRIDE).

Changes

• The helper in charts/helm_lib/templates/_module_security_context.tpl.
• A unit test in tests/templates and tests/tests.
• charts/helm_lib/README.md regenerated with make doc/build.
• Chart version 1.72.32 -> 1.72.33.

Testing

make tests/unit: 88 suites, 457 tests passed, including the new one.