OLS-3144 harden postgres wait init container

[xrajesh]

Summary

• use the shared restricted security context for the Postgres wait init container
• extend tests to verify non-root, seccomp, and dropped capabilities

Testing

• make test

Summary by CodeRabbit

• Security
  • The PostgreSQL wait initialization container now uses a restricted security context.
  • It runs as a non-root user, applies the runtime-default seccomp profile, and drops all Linux capabilities.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 31215252-76a8-4f59-b192-ab2f37d3f4c4

📥 Commits

Reviewing files that changed from the base of the PR and between f2c9445 and afb7c79.

📒 Files selected for processing (2)

• internal/controller/utils/postgres_wait.go
• internal/controller/utils/postgres_wait_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The PostgreSQL wait init container now uses RestrictedContainerSecurityContext(). Tests verify non-root execution, the runtime-default seccomp profile, and dropped capabilities.

Changes

PostgreSQL wait container security

Layer / File(s)	Summary
Apply and validate restricted security settings internal/controller/utils/postgres_wait.go, internal/controller/utils/postgres_wait_test.go	The init container uses RestrictedContainerSecurityContext(). Tests verify non-root execution, the runtime-default seccomp profile, and dropped capabilities.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to afb7c

The PostgreSQL wait init container now receives the shared restricted security settings, with tests covering the intended hardening behavior. No current merge-readiness risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: hardening the Postgres wait init container.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[sriroopar]

/lgtm

[xrajesh]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: xrajesh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [xrajesh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[xrajesh]

/retest

[openshift-ci]

@xrajesh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.