bug(helm): certgen hook is rejected by Restricted Pod Security

certgen Job をレンダリングする OpenShell Helm chart template から始め、設定可能な gateway の pod と container の security context と比較します。再現設定を使用して helm template を実行し、その後 chart のテストを確認します。デフォルトでレンダリングされた hook が Restricted admission を通過し、certgen 固有の override を公開し、既存のインストールに対する移行を必要とせずにテストでカバーされていれば完了です。

User Story

As a Kubernetes platform operator enforcing the Restricted Pod Security Standard on controller namespaces, I want the OpenShell Helm chart's certificate-generation hook to pass admission, so that I can install the gateway without weakening the namespace security policy.

Problem Statement

OpenShell Helm chart 0.0.116 renders Job/<release>-certgen without a pod securityContext and without runAsNonRoot or seccompProfile on its container. The container already drops all capabilities and disables privilege escalation, but Kubernetes Restricted Pod Security admission still rejects the hook for the missing non-root and seccomp settings.

The main gateway workload can already be configured with podSecurityContext and securityContext; the certgen hook does not inherit those settings and exposes no equivalent values.

Impact / Why This Matters

The pre-install/pre-upgrade hook blocks the entire Helm release in a namespace labeled pod-security.kubernetes.io/enforce: restricted. Operators must either weaken admission for the trusted gateway namespace or carry a Flux/Helm post-render patch for a security-sensitive hook. The post-render workaround is coupled to the hook resource name and container position and can silently stop matching after a chart refactor unless it is separately tested.

Acceptance Criteria

• A default helm template render of the certgen Job satisfies the Restricted Pod Security Standard for the chart's supported Kubernetes versions.
• The certgen pod and container run as non-root and declare a Restricted-compatible seccomp profile.
• The chart exposes certgen-specific pod/container security-context values if operators need to override the defaults.
• Chart tests cover the rendered certgen security context.
• Existing installs that do not enforce Pod Security continue to upgrade without manual migration.

Reproduction Steps

1. Create a namespace with pod-security.kubernetes.io/enforce: restricted (tested with policy version v1.36).
2. Install OpenShell chart 0.0.116 with Agent Sandbox available and pkiInitJob.enabled: true.
3. Observe that Job/<release>-certgen is rejected by Pod Security admission for missing runAsNonRoot and seccompProfile fields.
4. Render the chart and compare the certgen Job with the configurable gateway StatefulSet security contexts.

Environment

• OpenShell Helm chart: 0.0.116, OCI digest sha256:df55cd1538bdfb7836834c30dfcf8373b85ffea83bbfd70d50dbe69407a0d2b3
• Kubernetes: v1.36.4
• Distribution: Talos Linux v1.13.9
• Deployment: Flux HelmRelease, Kubernetes Agent Sandbox driver

Logs

The rendered certgen container has allowPrivilegeEscalation: false and drops ALL, but neither the pod nor container declares runAsNonRoot or seccompProfile. Restricted admission reports those missing fields under the restricted policy.