Helm chart hook job fails under PSA restricted (missing securityContext)

[ggualerz]

Hi Chatwoot team,

We’re using the official Helm chart (2.0.9) on a cluster with Pod Security Admission restricted:latest enforced. The install/upgrade hook Job chatwoot-migrate fails because its containers don’t set the required securityContext fields:

• allowPrivilegeEscalation: false
• capabilities.drop: ["ALL"]
• runAsNonRoot: true
• seccompProfile.type: RuntimeDefault
• Error excerpt:

pods "chatwoot-migrate-..." is forbidden: violates PodSecurity "restricted:latest":
allowPrivilegeEscalation != false (containers "init-postgres", "init-redis", "db-migrate-job" must set securityContext.allowPrivilegeEscalation=false),
unrestricted capabilities (containers "init-postgres", "init-redis", "db-migrate-job" must set securityContext.capabilities.drop=["ALL"]),
runAsNonRoot != true (pod or containers "init-postgres", "init-redis", "db-migrate-job" must set securityContext.runAsNonRoot=true),
seccompProfile (pod or containers "init-postgres", "init-redis", "db-migrate-job" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

The chart currently applies .Values.securityContext only at the pod level and not on containers, and the hook job doesn’t expose container‑level securityContext for initContainers/main container. Because Helm hooks are rendered separately, post‑render patches (Kustomize/Fleet) can’t fix this.

Could you please add container‑level securityContext for the hook job (init + main), ideally configurable via values (e.g. hooks.migrate.securityContext / hooks.migrate.podSecurityContext)? This would make the chart compatible with PSA restricted clusters without exemptions.

Thanks!

[ggualerz]

PSA restricted also blocks the web/worker pods because the chart sets only pod‑level securityContext, and allowPrivilegeEscalation/capabilities.drop must be set at the container level. So the fix needs to cover web/worker containers too, not just the migrate job.

[98jan]

the interesting thing is, that the podSecurityContext is never used in any template file of the helm chart and the securityContext is configured on podLevel

securityContext on podLevel:

charts/charts/chatwoot/templates/web-deployment.yaml

Line 110 in 3907937

securityContext: {{ .Values.securityContext | toYaml | nindent 8 }}

never used podSecurityContext: https://github.com/search?q=repo%3Achatwoot%2Fcharts%20podSecurityContext&type=code

Just created a Pull Request for it: #196
I am not sure, if the same securityContext can be used for all containers or a separation is needed.

EDIT (15.03.2026):
Just deployed chatwoot with a SecurityContext and everything worked as a charm from securityContext perspective. Still an issue when an external databas is used and the initjob doesn't add the -U parameter.

Best regards,
Jan