bug(helm): certgen hook is rejected by Restricted Pod Security

Start with the OpenShell Helm chart template that renders the certgen Job and compare it with the configurable gateway pod and container security contexts. Run helm template using the reproduction settings, then inspect the chart tests. Done means the default rendered hook passes Restricted admission, exposes certgen-specific overrides, and is covered by tests without requiring migration for existing installs.

User Story

As a Kubernetes platform operator enforcing the Restricted Pod Security Standard on controller namespaces, I want the OpenShell Helm chart's certificate-generation hook to pass admission, so that I can install the gateway without weakening the namespace security policy.

Problem Statement

OpenShell Helm chart 0.0.116 renders Job/<release>-certgen without a pod securityContext and without runAsNonRoot or seccompProfile on its container. The container already drops all capabilities and disables privilege escalation, but Kubernetes Restricted Pod Security admission still rejects the hook for the missing non-root and seccomp settings.

The main gateway workload can already be configured with podSecurityContext and securityContext; the certgen hook does not inherit those settings and exposes no equivalent values.

Impact / Why This Matters

The pre-install/pre-upgrade hook blocks the entire Helm release in a namespace labeled pod-security.kubernetes.io/enforce: restricted. Operators must either weaken admission for the trusted gateway namespace or carry a Flux/Helm post-render patch for a security-sensitive hook. The post-render workaround is coupled to the hook resource name and container position and can silently stop matching after a chart refactor unless it is separately tested.

Acceptance Criteria

• A default helm template render of the certgen Job satisfies the Restricted Pod Security Standard for the chart's supported Kubernetes versions.
• The certgen pod and container run as non-root and declare a Restricted-compatible seccomp profile.
• The chart exposes certgen-specific pod/container security-context values if operators need to override the defaults.
• Chart tests cover the rendered certgen security context.
• Existing installs that do not enforce Pod Security continue to upgrade without manual migration.

Reproduction Steps

1. Create a namespace with pod-security.kubernetes.io/enforce: restricted (tested with policy version v1.36).
2. Install OpenShell chart 0.0.116 with Agent Sandbox available and pkiInitJob.enabled: true.
3. Observe that Job/<release>-certgen is rejected by Pod Security admission for missing runAsNonRoot and seccompProfile fields.
4. Render the chart and compare the certgen Job with the configurable gateway StatefulSet security contexts.

Environment

• OpenShell Helm chart: 0.0.116, OCI digest sha256:df55cd1538bdfb7836834c30dfcf8373b85ffea83bbfd70d50dbe69407a0d2b3
• Kubernetes: v1.36.4
• Distribution: Talos Linux v1.13.9
• Deployment: Flux HelmRelease, Kubernetes Agent Sandbox driver

Logs

The rendered certgen container has allowPrivilegeEscalation: false and drops ALL, but neither the pod nor container declares runAsNonRoot or seccompProfile. Restricted admission reports those missing fields under the restricted policy.