Problem

If the third-party chart does not allow modifications of some resources (e. g. no way to specify securityContext for Pod), then chart consumers must fork the chart and modify it themselves.

Solution (if you have one)

Provide a way to easily patch rendered chart resources on-the-fly. Might look like this:

$ cat patch.yaml
- selector:
    chart: mychart
    resourceName: myapp
    resourceKind: Deployment
  patch: |
    <patch>
$ werf converge --patch patch.yaml

We could also provide a way to automatically apply patches that are distributed with the chart, so that the user can have a parent chart with patches for the resources in the dependent child charts.

Additional information

Helm 3 has a --post-renderer flag which might help with this, but it has its issues:

1. Chart developers can't enforce usage of specific post-renderer with a specific configuration for their chart. They must provide instructions to the chart consumers on how to manually set up the post-renderer and how to run it.
2. Ability to use any language to patch resources results in chart consumers potentially required to learn many different languages just for Kubernetes manifest patching.