Repository: goauthentik/authentik

Issue:
Outpost cannot be created in restricted namespaces
**Describe the bug**
Creating outposts in restricted namespaces does not work due to securityContext settings not getting copied over from main deployment.

**To Reproduce**
Steps to reproduce the behavior:
1. Create a restricted namespace:
* kubectl create ns test-authentik
* kubectl label ns test-authentikpod-security.kubernetes.io/enforce=baseline --overwrite
2. Create a new Outpost, in configuration do:
kubernetes_namespace=test-authentik

**Expected behavior**
Outpost should be created successfully.

**Logs**
```bash
kubectl describe -n authentik replicasets.apps ak-outpost-default-ldap-outpost 
 ...
  Warning  FailedCreate  6m51s                replicaset-controller  Error creating: pods "ak-outpost-default-ldap-outpost-7f4d464f8c-7g76k" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "ldap" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "ldap" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "ldap" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "ldap" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
 ```

**Version and Deployment (please complete the following information):**
 - authentik version: 23.3.1
 - Deployment: helm

**Workaround**
Edit deployment to use the same securityContext settings from main pod and container in new deployments.



Discussion:

Resolving patch:
diff --git a/authentik/outposts/controllers/k8s/deployment.py b/authentik/outposts/controllers/k8s/deployment.py
--- a/authentik/outposts/controllers/k8s/deployment.py
+++ b/authentik/outposts/controllers/k8s/deployment.py
@@ -4,6 +4,7 @@
 from django.utils.text import slugify
 from kubernetes.client import (
     AppsV1Api,
+    V1Capabilities,
     V1Container,
     V1ContainerPort,
     V1Deployment,
@@ -13,9 +14,12 @@
     V1LabelSelector,
     V1ObjectMeta,
     V1ObjectReference,
+    V1PodSecurityContext,
     V1PodSpec,
     V1PodTemplateSpec,
+    V1SeccompProfile,
     V1SecretKeySelector,
+    V1SecurityContext,
 )
 
 from authentik import __version__, get_full_version
@@ -103,6 +107,12 @@ def get_reference_object(self) -> V1Deployment:
                         image_pull_secrets=[
                             V1ObjectReference(name=secret) for secret in image_pull_secrets
                         ],
+                        security_context=V1PodSecurityContext(
+                            run_as_non_root=True,
+                            seccomp_profile=V1SeccompProfile(
+                                type="RuntimeDefault",
+                            ),
+                        ),
                         containers=[
                             V1Container(
                                 name=str(self.outpost.type),
@@ -146,6 +156,12 @@ def get_reference_object(self) -> V1Deployment:
                                         ),
                                     ),
                                 ],
+                                security_context=V1SecurityContext(
+                                    allow_privilege_escalation=False,
+                                    capabilities=V1Capabilities(
+                                        drop=["ALL"],
+                                    ),
+                                ),
                             )
                         ],
                     ),


Test patch: