✨(frontend) allow unauthenticated participants to mute via LiveKit token

Pass the LiveKit token when calling the mute-participant endpoint
to authenticate the request.

This enables non-authenticated participants to mute others through
the API while preserving proper authorization checks.

CHANGELOG.md

@@ -10,7 +10,6 @@ and this project adheres to
 
 ### Changed
 
-- ⚡️(helm) Add pod and container securityContext #4805
 - ♻️(backend) configurable SESSION_ENGINE #1038 #1154
 - ♿️(frontend) fix sidepanel accessibility aria-label #1182
 - ♿️(frontend) fix more tools heading hierarchy #1181

docs/openapi.yaml

@@ -190,6 +190,7 @@ paths:
         '403':
           $ref: '#/components/responses/ForbiddenError'
 
+  /rooms/:
     post:
       tags:
         - Rooms

docs/resource_server.yaml

@@ -113,6 +113,7 @@ paths:
         '403':
           $ref: '#/components/responses/ForbiddenError'
 
+  /rooms/:
     post:
       tags:
         - Rooms

src/backend/core/api/permissions.py

@@ -136,3 +136,35 @@ class FilePermission(IsAuthenticated):
             raise Http404
 
         return obj.get_abilities(request.user).get(view.action, False)
+
+
+class CanMuteParticipant(permissions.BasePermission):
+    """
+    Grant muting rights based on role or room configuration.
+
+    Allows muting unconditionally for admins/owners. For other users, requires
+    both the room's ``everyone_can_mute`` option to be enabled and a valid
+    authentication (session/JWT or a LiveKit token matching the room ID).
+    """
+
+    def has_object_permission(self, request, view, obj):
+        """Check if the requesting user is allowed to mute a participant in the given room."""
+
+        # Always allow admins/owners
+        if obj.is_administrator_or_owner(request.user):
+            return True
+
+        everyone_can_mute = obj.configuration.get("everyone_can_mute", True)
+
+        if not everyone_can_mute:
+            return False
+
+        # Standard backend auth (e.g. session/JWT) — no LiveKit token needed
+        if request.user and request.user.is_authenticated:
+            return True
+
+        # LiveKit token auth
+        if request.auth and hasattr(request.auth, "video"):
+            return request.auth.video.room == str(obj.id)
+
+        return False

src/backend/core/api/viewsets.py

@@ -30,6 +30,7 @@ from rest_framework import (
 from rest_framework import (
     status as drf_status,
 )
+from rest_framework.settings import api_settings
 
 from core import enums, models, utils
 from core.api.filters import ListFileFilter
@@ -583,7 +584,12 @@ class RoomViewSet(
         methods=["post"],
         url_path="mute-participant",
         url_name="mute-participant",
-        permission_classes=[permissions.HasPrivilegesOnRoom],
+        permission_classes=[permissions.CanMuteParticipant],
+        # Accept both session auth (privileged users) and LiveKit token auth (participants)
+        authentication_classes=[
+            *api_settings.DEFAULT_AUTHENTICATION_CLASSES,
+            LiveKitTokenAuthentication,
+        ],
     )
     def mute_participant(self, request, pk=None):  # pylint: disable=unused-argument
         """Mute a specific track for a participant in the room."""

src/frontend/Dockerfile

@@ -1,16 +1,14 @@
 FROM node:20-alpine AS frontend-deps
 
-USER node
-
 WORKDIR /home/frontend/
 
-COPY --chown=node:node ./src/frontend/package.json ./package.json
-COPY --chown=node:node ./src/frontend/package-lock.json ./package-lock.json
+COPY ./src/frontend/package.json ./package.json
+COPY ./src/frontend/package-lock.json ./package-lock.json
 
 RUN npm ci
 
-COPY --chown=node:node .dockerignore ./.dockerignore
-COPY --chown=node:node ./src/frontend/ .
+COPY .dockerignore ./.dockerignore
+COPY ./src/frontend/ .
 
 ### ---- Front-end builder image ----
 FROM frontend-deps AS meet
@@ -19,8 +17,6 @@ WORKDIR /home/frontend
 
 FROM frontend-deps AS meet-dev
 
-USER node
-
 WORKDIR /home/frontend
 
 EXPOSE 8080

src/frontend/src/features/rooms/api/muteParticipant.ts

@@ -7,13 +7,13 @@ import {
 } from '@/features/notifications'
 import { fetchApi } from '@/api/fetchApi'
 
-export const useMuteParticipant = () => {
-  const data = useRoomData()
 
+export const useMuteParticipant = () => {
+   const apiRoomData = useRoomData()
   const { notifyParticipants } = useNotifyParticipants()
 
   const muteParticipant = async (participant: Participant) => {
-    if (!data?.id) {
+    if (!apiRoomData?.livekit?.room) {
       throw new Error('Room id is not available')
     }
     const trackSid = participant.getTrackPublication(
@@ -25,24 +25,31 @@ export const useMuteParticipant = () => {
     }
 
     try {
-      const response = await fetchApi(`rooms/${data.id}/mute-participant/`, {
+      const response = fetchApi(`rooms/${apiRoomData?.livekit?.room}/mute-participant/`, {
         method: 'POST',
         body: JSON.stringify({
+          token: apiRoomData?.livekit?.token,
           participant_identity: participant.identity,
           track_sid: trackSid,
         }),
       })
-
-      await notifyParticipants({
-        type: NotificationType.ParticipantMuted,
-        destinationIdentities: [participant.identity],
-      })
-
       return response
     } catch (error) {
       console.error(
         `Failed to mute participant ${participant.identity}: ${error instanceof Error ? error.message : 'Unknown error'}`
       )
+      return
+    }
+
+    try {
+      await notifyParticipants({
+        type: NotificationType.ParticipantMuted,
+        destinationIdentities: [participant.identity],
+      })
+    } catch (e) {
+      console.error(
+        `Failed to notify muted participant ${participant.identity}: ${e}`
+      )
     }
   }
   return { muteParticipant }

src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl

@@ -41,15 +41,3 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
-
-podSecurityContext:
-  fsGroup: 1000
-  fsGroupChangePolicy: "OnRootMismatch"
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - ALL
-  seccompProfile:
-    type: RuntimeDefault

src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl

@@ -28,16 +28,6 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
-podSecurityContext:
-  fsGroup: 2000
-
-securityContext:
-  capabilities:
-    drop:
-    - ALL
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  runAsUser: 1000
 
 loadBalancer:
   type: nginx

src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl

@@ -112,21 +112,6 @@ backend:
         - key: cacert.pem
           path: cacert.pem
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
 frontend:
 
   replicas: 1
@@ -136,21 +121,6 @@ frontend:
     pullPolicy: Always
     tag: "latest"
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
 ingress:
   enabled: true
   host: meet.127.0.0.1.nip.io
@@ -166,7 +136,7 @@ ingressWebhook:
 posthog:
   ingress:
     enabled: false
-
+  
   ingressAssets:
     enabled: false
 
@@ -190,27 +160,12 @@ summary:
     WEBHOOK_URL: https://www.mock-impress.com/webhook/
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
-
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
+  
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
     tag: "latest"
-
+  
   command:
     - "uvicorn"
     - "summary.main:app"
@@ -242,21 +197,6 @@ celeryTranscribe:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -293,21 +233,6 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always

src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl

@@ -44,15 +44,3 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
-
-podSecurityContext:
-  fsGroup: 1000
-  fsGroupChangePolicy: "OnRootMismatch"
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - ALL
-  seccompProfile:
-    type: RuntimeDefault

src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl

@@ -28,16 +28,6 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
-podSecurityContext:
-  fsGroup: 2000
-
-securityContext:
-  capabilities:
-    drop:
-    - ALL
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  runAsUser: 1000
 
 loadBalancer:
   type: nginx

src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

@@ -86,20 +86,6 @@ backend:
     CELERY_ENABLED: True
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
 
   migrate:
     command:
@@ -148,21 +134,6 @@ frontend:
 
   replicas: 1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-frontend-generic
     pullPolicy: Always
@@ -183,7 +154,7 @@ ingressWebhook:
 posthog:
   ingress:
     enabled: false
-
+  
   ingressAssets:
     enabled: false
 
@@ -209,27 +180,12 @@ summary:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
-
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
+  
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
     tag: "latest"
-
+  
   command:
     - "uvicorn"
     - "summary.main:app"
@@ -261,22 +217,7 @@ celeryTranscribe:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
-
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
+  
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -315,21 +256,6 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -357,21 +283,6 @@ agents:
     {{- end }}
     ENABLE_SILERO_VAD: "false"
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-agents
     pullPolicy: Always

src/helm/env.d/dev/values.egress.yaml.gotmpl

@@ -41,15 +41,3 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
-
-podSecurityContext:
-  fsGroup: 1000
-  fsGroupChangePolicy: "OnRootMismatch"
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - ALL
-  seccompProfile:
-    type: RuntimeDefault

src/helm/env.d/dev/values.livekit.yaml.gotmpl

@@ -28,17 +28,6 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
-podSecurityContext:
-  fsGroup: 2000
-
-securityContext:
-  capabilities:
-    drop:
-    - ALL
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  runAsUser: 1000
-
 loadBalancer:
   type: nginx
   annotations:

src/helm/env.d/dev/values.meet.yaml.gotmpl

@@ -96,20 +96,6 @@ backend:
     ROOM_TELEPHONY_ENABLED: True
     SSL_CERT_FILE: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
 
   migrate:
     command:
@@ -158,21 +144,6 @@ frontend:
 
   replicas: 1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-frontend
     pullPolicy: Always
@@ -218,21 +189,6 @@ summary:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -269,21 +225,6 @@ celeryTranscribe:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -320,21 +261,6 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: "OnRootMismatch"
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always

src/helm/meet/templates/agents_deployment.yaml

@@ -31,10 +31,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.agents.shareProcessNamespace }}
-      {{- with .Values.agents.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.agents.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_deployment.yaml

@@ -31,10 +31,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
-      {{- with .Values.backend.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_job_createsuperuser.yaml

@@ -30,10 +30,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
-      {{- with .Values.backend.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_job_migrate.yaml

@@ -30,10 +30,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
-      {{- with .Values.backend.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_backend_deployment.yaml

@@ -31,10 +31,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celeryBackend.shareProcessNamespace }}
-      {{- with .Values.celeryBackend.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.celeryBackend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_summarize_deployment.yaml

@@ -31,10 +31,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celerySummarize.shareProcessNamespace }}
-      {{- with .Values.celerySummarize.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.celerySummarize.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_transcribe_deployment.yaml

@@ -31,10 +31,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celeryTranscribe.shareProcessNamespace }}
-      {{- with .Values.celeryTranscribe.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.celeryTranscribe.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/frontend_deployment.yaml

@@ -31,10 +31,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.frontend.shareProcessNamespace }}
-      {{- with .Values.frontend.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.frontend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/summary_deployment.yaml

@@ -31,10 +31,6 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.summary.shareProcessNamespace }}
-      {{- with .Values.summary.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         {{- with .Values.summary.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/values.yaml

@@ -216,12 +216,9 @@ backend:
     ttlSecondsAfterFinished: 30
     backoffLimit: 2
 
-  ## @param backend.securityContext Configure backend Container security context
+  ## @param backend.securityContext Configure backend Pod security context
   securityContext: null
 
-  ## @param backend.podSecurityContext Configure backend Pod security context
-  podSecurityContext: null
-
   ## @param backend.envVars Configure backend container environment variables
   ## @extra backend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra backend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -362,12 +359,9 @@ frontend:
   ## @param frontend.sidecars Add sidecars containers to frontend deployment
   sidecars: []
 
-  ## @param frontend.securityContext Configure frontend Container security context
+  ## @param frontend.securityContext Configure frontend Pod security context
   securityContext: null
 
-  ## @param frontend.podSecurityContext Configure frontend Pod security context
-  podSecurityContext: null
-
   ## @param frontend.envVars Configure frontend container environment variables
   ## @extra frontend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -539,12 +533,9 @@ summary:
   ## @param summary.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param summary.securityContext Configure summary Container security context
+  ## @param summary.securityContext Configure summary Pod security context
   securityContext: null
 
-  ## @param summary.podSecurityContext Configure summary Pod security context
-  podSecurityContext: null
-
   ## @param summary.envVars Configure summary container environment variables
   ## @extra summary.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra summary.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -655,12 +646,9 @@ celeryBackend:
   ## @param celeryBackend.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celeryBackend.securityContext Configure celeryBackend Container security context
+  ## @param celeryBackend.securityContext Configure celeryBackend Pod security context
   securityContext: null
 
-  ## @param celeryBackend.podSecurityContext Configure celeryBackend Pod security context
-  podSecurityContext: null
-
   ## @param celeryBackend.envVars Configure celeryBackend container environment variables
   ## @extra celeryBackend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celeryBackend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -767,12 +755,9 @@ celeryTranscribe:
   ## @param celeryTranscribe.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celeryTranscribe.securityContext Configure celeryTranscribe Container security context
+  ## @param celeryTranscribe.securityContext Configure celeryTranscribe Pod security context
   securityContext: null
 
-  ## @param celeryTranscribe.podSecurityContext Configure celeryTranscribe Pod security context
-  podSecurityContext: null
-
   ## @param celeryTranscribe.envVars Configure celeryTranscribe container environment variables
   ## @extra celeryTranscribe.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celeryTranscribe.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -879,12 +864,9 @@ celerySummarize:
   ## @param celerySummarize.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celerySummarize.securityContext Configure celerySummarize Container security context
+  ## @param celerySummarize.securityContext Configure celerySummarize Pod security context
   securityContext: null
 
-  ## @param celerySummarize.podSecurityContext Configure celerySummarize Pod security context
-  podSecurityContext: null
-
   ## @param celerySummarize.envVars Configure celerySummarize container environment variables
   ## @extra celerySummarize.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celerySummarize.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -981,12 +963,9 @@ agents:
   ## @param agents.sidecars Add sidecars containers to agents deployment
   sidecars: []
 
-  ## @param agents.securityContext Configure agents Container security context
+  ## @param agents.securityContext Configure agents Pod security context
   securityContext: null
 
-  ## @param agents.podSecurityContext Configure agents Pod security context
-  podSecurityContext: null
-
   ## @param agents.envVars Configure agents container environment variables
   ## @extra agents.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra agents.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap