feat: pure helm prerequisites sandbox tools

.gitignore

@@ -0,0 +1,2 @@
+*.lock
+*.tgz

modules/prerequisites/Chart.yaml

@@ -18,3 +18,15 @@ apiVersion: v2
 name: prerequisites
 description: A Helm chart for installing OKDP prerequisites
 version: 0.1.0
+dependencies:
+  - name: reloader
+    version: "1.0.72"
+    repository: "https://stakater.github.io/stakater-charts"
+  - name: kubernetes-replicator
+    version: "2.9.2"
+    repository: "https://helm.mittwald.de"
+    alias: replicator
+  - name: kubernetes-secret-generator
+    version: "3.4.0"
+    repository: "https://helm.mittwald.de"
+    alias: secret-generator

modules/prerequisites/README.md

@@ -11,11 +11,16 @@ A Helm chart for installing OKDP prerequisites.
 To install the chart with the release name `prerequisites`:
 
 ```sh
-$ helm install prerequisites modules/prerequisites
+helm dependency update modules/prerequisites/
+helm install prerequisites modules/prerequisites \
+  -f modules/prerequisites/values/sandbox.yaml \
+  -n okdp-prerequisites \
+  --create-namespace
 ```
 
 ## Uninstalling the chart `prerequisites`
 
 ```sh
-$ helm uninstall prerequisites
+helm uninstall prerequisites -n okdp-prerequisites
+kubectl delete namespace okdp-prerequisites
 ```

modules/prerequisites/values.schema.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "reloader": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean", "default": true }
+      }
+    },
+    "replicator": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean", "default": true }
+      }
+    },
+    "secret-generator": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean", "default": true }
+      }
+    }
+  }
+}

modules/prerequisites/values/sandbox.yaml

@@ -0,0 +1,68 @@
+#
+# Copyright 2026 The OKDP Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+reloader:
+  enabled: true
+  reloader:
+    deployment:
+      containerSecurityContext:
+        # Restricts privileges at the container process level.
+        allowPrivilegeEscalation: false
+        # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem.
+        readOnlyRootFilesystem: true
+        capabilities:
+          # Removes all default Linux kernel capabilities: it removes all system
+          # "superpowers" (the app cannot control the underlying system).
+          drop: ["ALL"]
+
+replicator:
+  enabled: true
+  # Configures security settings at the entire Pod level.
+  podSecurityContext:
+    # Uses the container runtime's default system call filter.
+    seccompProfile: { type: RuntimeDefault }
+  # Configures security settings specifically for the container.
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+    capabilities:
+      # Removes all default Linux kernel capabilities: it removes all system
+      # "superpowers" (the app cannot control the underlying system).
+      drop: ["ALL"]
+  # Sets the delay before checking if the container is alive and healthy.
+  livenessProbe: { initialDelaySeconds: 10 }
+  # Sets the delay before checking if the container is ready to accept traffic.
+  readinessProbe: { initialDelaySeconds: 10 }
+
+secret-generator:
+  enabled: true
+  fullnameOverride: secret-generator
+  # Configures security settings at the entire Pod level.
+  podSecurityContext:
+    fsGroup: 2000
+    # Uses the container runtime's default system call filter.
+    seccompProfile: { type: RuntimeDefault }
+  # Configures security settings specifically for the container.
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+    capabilities:
+      # Removes all default Linux kernel capabilities: it removes all system
+      # "superpowers" (the app cannot control the underlying system).
+      drop: ["ALL"]