feat: add configurable pod and container security contexts to postgresql deployment

[BearTS]

Summary

Moves the hardcoded fsGroup: 999 pod security context for the PostgreSQL deployment into a configurable values.yaml field, and adds support for a container-level security context on the PostgreSQL primary container.

Changes

• Replaced the hardcoded fsGroup: 999 in the PostgreSQL deployment pod spec with a templated reference to .Values.postgresql.primary.podSecurityContext, defaulting to fsGroup: 999 in values.yaml
• Added an optional containerSecurityContext field under postgresql.primary (defaults to {}) that, when set, is applied to the PostgreSQL container's securityContext

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Deploy the Bifrost Helm chart and verify the PostgreSQL pod launches with the expected security context. Override postgresql.primary.podSecurityContext and postgresql.primary.containerSecurityContext in a custom values.yaml to confirm they are applied correctly.

helm template bifrost ./helm-charts/bifrost -f custom-values.yaml | grep -A 10 securityContext

Breaking changes

• Yes
• No

Related issues

Security considerations

This change allows operators to customize the security context for the PostgreSQL pod and container, enabling stricter security policies (e.g., running as a non-root user, dropping capabilities) without requiring chart modifications.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[BearTS]

• chore: bump Bifrost Helm chart to 2.1.18 with feature flags, model catalog URL, and bug fixes #3623
• feat: add configurable pod and container security contexts to postgresql deployment #3694 👈 (View in Graphite)
• feat: support existingSecret for internal PostgreSQL auth in Bifrost Helm chart #3689
• fix: sort provider secrets and weaviate env vars alphabetically for deterministic Helm rendering #3621
• feat: add default password warnings for PostgreSQL and Redis in Helm chart NOTES.txt #3620
• fix: gate Weaviate PVC creation on persistence.enabled #3619
• fix: use REDISCLI_AUTH env var to avoid passing password via -a flag in Redis health checks #3618
• feat: add optional gRPC port to bifrost cluster deployment and service #3617
• feat: add timeout comments to guardrail rule and provider entries in values.yaml #3612
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — changes are additive, backward-compatible, and scoped entirely to Helm templating for the PostgreSQL deployment.

The change replaces a hardcoded constant with a configurable value that defaults to the same constant, so existing deployments are unaffected. The only behavioural nuance is that the else fallback in the pod security context block makes it impossible to completely remove the fsGroup setting by overriding with {}, but this does not break anything in the common path and the default remains correct.

No files require special attention beyond the minor else-branch behaviour in postgresql-deployment.yaml.

Important Files Changed

Filename	Overview
helm-charts/bifrost/templates/postgresql-deployment.yaml	Replaces hardcoded fsGroup: 999 with a configurable podSecurityContext using with/else, and adds optional containerSecurityContext; the else branch makes it impossible to fully remove the pod-level security context by overriding with {}
helm-charts/bifrost/values.yaml	Adds podSecurityContext: {fsGroup: 999} and containerSecurityContext: {} defaults under postgresql.primary; defaults preserve backward compatibility

_{Reviews (2): Last reviewed commit: "chore: add ability to have containerSecu..." | Re-trigger Greptile}

[coderabbitai]

🧹 Nitpick comments (1)

helm-charts/bifrost/values.yaml (1)

896-899: ⚡ Quick win

Configuration looks correct for postgres:16-alpine.

The fsGroup: 999 matches the default postgres user/group in the official postgres:16-alpine image, and the empty containerSecurityContext provides a template for users to add custom security settings.

Consider adding runAsNonRoot: true to the podSecurityContext for defense-in-depth security hardening:

🔒 Optional security hardening

     podSecurityContext:
       fsGroup: 999
+      runAsNonRoot: true

     containerSecurityContext: {}

This makes the non-root requirement explicit even though postgres:16-alpine already runs as user 999 by default.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@helm-charts/bifrost/values.yaml` around lines 896 - 899, Add defense-in-depth
by updating the pod security context: ensure podSecurityContext includes
runAsNonRoot: true in addition to the existing fsGroup: 999 so pods explicitly
require a non-root user; leave containerSecurityContext as-is for user
overrides. Locate the podSecurityContext block (podSecurityContext, fsGroup,
containerSecurityContext) and add runAsNonRoot: true under podSecurityContext.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@helm-charts/bifrost/values.yaml`:
- Around line 896-899: Add defense-in-depth by updating the pod security
context: ensure podSecurityContext includes runAsNonRoot: true in addition to
the existing fsGroup: 999 so pods explicitly require a non-root user; leave
containerSecurityContext as-is for user overrides. Locate the podSecurityContext
block (podSecurityContext, fsGroup, containerSecurityContext) and add
runAsNonRoot: true under podSecurityContext.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 900b138f-7f97-4eb1-b1b2-18c060380e8a

📥 Commits

Reviewing files that changed from the base of the PR and between 61223f9 and 8a696da.

📒 Files selected for processing (2)

• helm-charts/bifrost/templates/postgresql-deployment.yaml
• helm-charts/bifrost/values.yaml

[akshaydeo]

Merge activity

• May 25, 6:33 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 25, 6:40 AM UTC: @akshaydeo merged this pull request with Graphite.

The base branch was changed.