[JENKINS-73513] Fix inheritance of container capabilities and and pod shareProcessNamespace settings

[cfraenkel]

This PR fixes two bugs related to the usage and overriding of pod shareProcessNamespace and container securityContext.capabilities settings.

• for shareProcessNamespace it makes sure this setting can be overwritten in combined pods.
• for securityContext.capabilities it introduces merging of the fields to the current logic in PodTemplateUtils

see https://issues.jenkins.io/browse/JENKINS-73513

Testing done

• I've added unit tests to PodTemplateUtils that cover the changed fields
• I've built the hpi locally and deployed it to a minikube cluster and verified the behavior with the following pipeline script
  • all expected settings (capabilities, shareProcessNamespace) where present in the final pod.

Jenkinsfile

podTemplate(yaml:'''
spec:
  containers:
  - name: jnlp
    env:
    - name: HELLO
      value: "WORLD!"
  - name: inner
    securityContext:
      capabilities:
        drop:
        - CHOWN
''') {
    podTemplate(yamlMergeStrategy: merge(), yaml: '''
spec:
  shareProcessNamespace: true
  containers:
  - name: inner
    image: eclipse-temurin:17-jdk-jammy
    imagePullPolicy: IfNotPresent
    command:
    - cat 
    - '-'
    tty: true
    volumeMounts:
    - name: workspace-volume
      mountPath: /home/jenkins/agent
    securityContext:
      runAsUser: 1000
      runAsGroup: 1000
      capabilities:
        add:
        - SYS_PTRACE
        drop: null
''') {
        node (POD_LABEL) {
            sh '''
            echo running from jnlp
            '''
            container("inner") {
                sh '''
                echo running from inner
                ps aux
                jcmd
                jcmd agent.jar GC.heap_info
                '''
            }
        }
    }
}

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[jglick]

FYI

• The maintainer is not available currently.
• It is generally discouraged to rely on pod template inheritance. Use whatever logic you need (e.g., in a library) to define the pod you actually want, then request it directly.

[cfraenkel]

Thanks for the update.
I do hope this fix will get merged eventually - I've been testing the incremental built from this PR successfully.

It is generally discouraged to rely on pod template inheritance. Use whatever logic you need (e.g., in a library) to define the pod you actually want, then request it directly.

Thanks for that information. I do not think this is currently reflected in the readme which goes into some detail on nested podtemplates (which means inheritance).