Support pod.spec.containers.securityContext specification

This PR attempts to close #116

Following the valeriano-manassero's implementation,
https://github.com/valeriano-manassero/helm-charts/blob/6382a14272927a908bc006d0f1370ba9dffc821f/valeriano-manassero/trino/values.yaml#L467-L471

let me Support `pod.spec.containers.securityContext`  specification

charts/trino/README.md

@@ -77,6 +77,7 @@ The following table lists the configurable parameters of the Trino chart and the
 | `coordinator.annotations` |  | `{}` |
 | `coordinator.labels` |  | `{}` |
 | `coordinator.secretMounts` |  | `[]` |
+| `coordinator.containerSecurityContext` |  | `{}` |
 | `worker.jvm.maxHeapSize` |  | `"8G"` |
 | `worker.jvm.gcMethod.type` |  | `"UseG1GC"` |
 | `worker.jvm.gcMethod.g1.heapRegionSize` |  | `"32M"` |
@@ -96,6 +97,7 @@ The following table lists the configurable parameters of the Trino chart and the
 | `worker.annotations` |  | `{}` |
 | `worker.labels` |  | `{}` |
 | `worker.secretMounts` |  | `[]` |
+| `worker.containerSecurityContext` |  | `{}` |
 | `kafka.mountPath` |  | `"/etc/trino/schemas"` |
 | `kafka.tableDescriptions` |  | `{}` |
 | `commonLabels` | Labels that get applied to every resource's metadata | `{}` |

charts/trino/templates/deployment-coordinator.yaml

@@ -102,6 +102,8 @@ spec:
         - name: {{ .Chart.Name }}-coordinator
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
           env:
             {{- toYaml .Values.env | nindent 12 }}
           envFrom:

charts/trino/templates/deployment-worker.yaml

@@ -80,6 +80,8 @@ spec:
         - name: {{ .Chart.Name }}-worker
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
           env:
             {{- toYaml .Values.env | nindent 12 }}
           envFrom:

charts/trino/values.yaml

@@ -218,6 +218,13 @@ securityContext:
   runAsUser: 1000
   runAsGroup: 1000
 
+# -- SecurityContext configuration for containers
+containerSecurityContext:
+  allowPrivilegeEscalation: false  #  Controls whether a process can gain more privileges than its parent process. 
+  capabilities: 
+    drop:  # Kernel capabilities that will be dropped from a pod
+      - ALL  
+
 shareProcessNamespace:
   coordinator: false
   worker: false