feat(kubernetes): support OpenShift restricted SCC via AGENT_SECURITY_CONTEXT - #1155

Merged

skevetter merged 47 commits into

mainfrom

admiring-peacock

Sep 1, 2026

Commits on Aug 29, 2026

feat: add AGENT_SECURITY_CONTEXT kubernetes provider option
skevetter
committed
c3593a8
feat: add container security context resolution helper
skevetter
committed
b0b6899
feat: apply AGENT_SECURITY_CONTEXT and STRICT_SECURITY to injected containers
skevetter
committed
b1df673
feat: set spec.securityContext.hostUsers=false for restricted-cluster configs
skevetter
committed
89a1f8c
test: add OpenShift security context regression coverage and docs
skevetter
committed
87aebeb
fix: let AGENT_SECURITY_CONTEXT override Capabilities/Privileged
skevetter
committed
afd6114
test: add e2e coverage for OpenShift-style restricted admission
skevetter
committed
9cde92d
chore: satisfy diff-scoped golangci-lint findings
skevetter
committed
430ec61
fix: surface the real Abs/ReadFile error in parseSecurityContext
skevetter
committed
69bbf47
fix: restore POD_MANIFEST_TEMPLATE as highest-precedence for container SecurityContext
skevetter
committed
6a44e21
test: close init-container and default-mode coverage gaps
skevetter
committed
4522411
refactor: replace nolint:cyclop suppression with a real complexity fix
skevetter
committed
be7ac73
refactor: bundle getContainers params into devsyContainerInputs
skevetter
committed
c61691c
fix: work around kind's hostUsers OCI hook bug in the restricted-scc e2e test
skevetter
committed
dade92b
fix: retry kubernetes-native agent delivery before falling back to legacy inject
skevetter
committed
31f5a48
refactor: replace blind delivery retry with a resilient, classified redesign
skevetter
committed
a07e125
feat: add AGENT_INSTALL_PATH kubernetes option for non-root containers
skevetter
committed
a39ac90
fix: fall back to writable paths for git config and result files
skevetter
committed
107072b
fix: prefer a locally-available binary over in-container download
skevetter
committed
096da0e
fix: reuse ContainerDataDirFallback constant and document agentInstallPath
skevetter
committed
b346b01

Commits on Aug 30, 2026

style: update comments
skevetter
committed
961b90f
fix: address CodeRabbit review findings on PR #1155
skevetter
committed
5af807b
fix: address local CodeRabbit CLI review findings
skevetter
committed
3176539
Merge remote-tracking branch 'origin/main' into admiring-peacock
skevetter
committed
1c0f34a
fix: suppress gosec findings on deliberate test fixtures
skevetter
committed
80986f3
fix(ci): revert kind node image to the CLI-compatible v1.34.0
skevetter
committed
efc4257
fix: tolerate permission-denied chowning the workspace parent dir
skevetter
committed
ebd565e
fix: tighten restricted container setup
skevetter
committed
a921d19

Commits on Aug 31, 2026

fix: apply kubernetes review feedback
skevetter
committed
4234c35
Merge branch 'main' into admiring-peacock
skevetter
authored
6af0547
style: update comments
skevetter
committed
7c40f41
fix: keep restricted e2e user namespace compatible
skevetter
committed
6705f67
fix: satisfy git config lint
skevetter
committed
ed5ffed
fix: select active container result path
skevetter
committed
8ab4f9b
fix(kubernetes): support restricted SCC
skevetter
committed
d5c48e2
fix: satisfy lint checks
skevetter
committed
1c8ce1d
fix: stabilize restricted kubernetes e2e
skevetter
committed
96c3af7
Merge branch 'main' into admiring-peacock
skevetter
authored
5de76ab
fix(kubernetes): stabilize restricted SCC test
skevetter
committed
f44be4d
test(e2e): share SSH command constants
skevetter
committed
4369a76
fix: address kubernetes review feedback
skevetter
committed
366e22b
fix: satisfy secure directory lint
skevetter
committed
2f680ba
fix: support macos data directory paths
skevetter
committed
aa9deb8
fix: address latest review findings
skevetter
committed
dbf148e
fix: reduce security resolver complexity
skevetter
committed
49a11b4
fix: address latest review feedback
skevetter
committed
eb063c7

Commits on Sep 1, 2026

docs: address latest review remarks
skevetter
committed
59eb495