From da78b93162a3221cd44e3f68592b0ae0bff369c7 Mon Sep 17 00:00:00 2001
From: Jorge Garcia Oncins <jgarciao@redhat.com>
Date: Mon, 31 Aug 2026 15:36:12 +0200
Subject: [PATCH] fix(helm): omit podSecurityContext block when value is null

The gateway pod template rendered `securityContext:` unconditionally, so
setting `podSecurityContext: null` (e.g. to let OpenShift's SCC assign the
UID/GID range) produced `securityContext: null` instead of omitting the
block. Wrap the block in `{{- with .Values.podSecurityContext }}` so a null
value omits it and an explicit value renders unchanged.

Add a helm-unittest suite covering the default, explicit, and null cases.

Fixes #3033

Signed-off-by: Jorge Garcia Oncins <jgarciao@redhat.com>
---
 .../openshell/templates/_gateway-workload.tpl |  4 ++-
 .../gateway_pod_security_context_test.yaml    | 36 +++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml

diff --git a/deploy/helm/openshell/templates/_gateway-workload.tpl b/deploy/helm/openshell/templates/_gateway-workload.tpl
index a73acc9810..1158c26d7d 100644
--- a/deploy/helm/openshell/templates/_gateway-workload.tpl
+++ b/deploy/helm/openshell/templates/_gateway-workload.tpl
@@ -34,8 +34,10 @@ spec:
         - host.docker.internal
         - host.openshell.internal
   {{- end }}
+  {{- with .Values.podSecurityContext }}
   securityContext:
-    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   containers:
     - name: openshell-gateway
       securityContext:
diff --git a/deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml b/deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml
new file mode 100644
index 0000000000..cdb70a05eb
--- /dev/null
+++ b/deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml
@@ -0,0 +1,36 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+suite: gateway pod securityContext
+templates:
+  - templates/gateway-config.yaml
+  - templates/statefulset.yaml
+release:
+  name: openshell
+  namespace: my-namespace
+
+tests:
+  - it: renders the pod securityContext from podSecurityContext by default
+    template: templates/statefulset.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.securityContext.fsGroup
+          value: 1000
+
+  - it: renders an explicitly set podSecurityContext
+    template: templates/statefulset.yaml
+    set:
+      podSecurityContext:
+        fsGroup: 2000
+    asserts:
+      - equal:
+          path: spec.template.spec.securityContext.fsGroup
+          value: 2000
+
+  - it: omits the pod securityContext block when podSecurityContext is null
+    template: templates/statefulset.yaml
+    set:
+      podSecurityContext: null
+    asserts:
+      - notExists:
+          path: spec.template.spec.securityContext