Configurable images, imagePullSecrets, and securityContext per component

[prateekkanurkar-cmd]

Summary

• Every container's image (drd-vpc-agent app, redis, busybox init, kubectl restart) is now driven by values.yaml — repository, tag, and pullPolicy. No more hardcoded redis:7-alpine baked into the chart template.
• imagePullSecrets is configurable both globally (global.imagePullSecrets) and per component (celery-beat.imagePullSecrets, celery-worker.imagePullSecrets, redis.imagePullSecrets, autoUpdate.imagePullSecrets). Per-component secrets are merged on top of the global list, so a private mirror can be set once globally and one component can add its own pull secret without losing the global one.
• podSecurityContext and securityContext are configurable per component, with sensible defaults: runAsNonRoot: true, runAsUser: 33 (matches the www-data UID baked into the agent image), runAsUser: 999 for redis (matches redis:7.2.8-alpine's built-in user), allowPrivilegeEscalation: false, capabilities.drop: [ALL]. These satisfy the psp-pods-allowed-user-ranges Gatekeeper policy that was rejecting pod admission on clusters with PSP enforcement.
• helm/charts/*.tgz and helm/values.yaml.backup.* added to .gitignore so the auto-regenerated subchart tarballs and the deploy-script's timestamped backups stop polluting the working tree.

Test plan

• helm lint helm/ clean
• helm template renders valid YAML; programmatic check confirms every Deployment and CronJob has runAsNonRoot: true and runAsUser != 0 at both pod and container level
• Override matrix verified: per-component image overrides, init-container image override, custom readOnlyRootFilesystem, and imagePullSecrets merging (global + per-component) all flow through correctly
• autoUpdate.enabled=false correctly suppresses the restart CronJob
• Live-deployed against jfrog-dev-aks / drdroid namespace: celery-beat 1/1, celery-worker 3/3, redis 1/1, all with 0 restarts; original Gatekeeper PSP denials and CrashLoopBackOff are gone