Create new permission and customStorage system on the individual apps (#343)

incubator/tvheadend/3.0.0/ix_values.yaml

@@ -9,8 +9,6 @@ image:
   pullPolicy: IfNotPresent
   tag: latest
 
-startAsRoot: true
-
 ##
 # Most other defaults are set in questions.yaml
 # For other options please refer to the wiki, default_values.yaml or the common library chart

incubator/tvheadend/3.0.0/questions.yaml

@@ -17,7 +17,6 @@ groups:
     description: "Advanced Configuration"
   - name: "WARNING"
     description: "WARNING"
-
 portals:
   web_portal:
     protocols:
@@ -26,9 +25,7 @@ portals:
       - "$kubernetes-resource_configmap_portal_host"
     ports:
       - "$kubernetes-resource_configmap_portal_port"
-
 questions:
-
   - variable: portal
     group: "Container Image"
     label: "Configure Portal Button"
@@ -45,7 +42,6 @@ questions:
             type: boolean
             default: true
 
-
   # Update Policy
   - variable: strategyType
     group: "Container Image"
@@ -59,8 +55,6 @@ questions:
         - value: "Recreate"
           description: "Kill existing pods before creating new ones"
 
-
-  # Configure Time Zone
   # Configure Time Zone
   - variable: timezone
     group: "Container Image"
@@ -71,30 +65,6 @@ questions:
       $ref:
         - "definitions/timezone"
 
-  - variable: PUID
-    group: "Container Image"
-    label: "PUID"
-    description: "The UserID of the user running the application and owning the files"
-    schema:
-      type: int
-      default: 568
-
-  - variable: PGID
-    group: "Container Image"
-    label: "PGID"
-    description: "The groupID of the user/group running the application and owning the files"
-    schema:
-      type: int
-      default: 568
-
-  - variable: UMASK
-    group: "Container Image"
-    label: "UMASK (advanced)"
-    description: "The UMASK used if supported by the application"
-    schema:
-      type: string
-      default: "002"
-
   # Service Configuration
   # Enable Host Networking
   - variable: hostNetwork
@@ -103,7 +73,6 @@ questions:
     schema:
       type: boolean
       default: false
-
   - variable: services
     group: "Networking"
     label: "Configure Service"
@@ -235,7 +204,6 @@ questions:
                         max: 65535
                         default: 36052
                         required: true
-
   - variable: persistence
     label: "Integrated Persistent Storage"
     description: "Websocket Service"
@@ -295,8 +263,7 @@ questions:
                 schema:
                   type: string
                   default: "100Gi"
-
-  - variable: additionalAppVolumeMounts
+  - variable: customStorage
     label: "Custom app storage"
     group: "Storage"
     schema:
@@ -356,7 +323,6 @@ questions:
                 schema:
                   type: hostpath
                   required: true
-
   - variable: ingress
     label: ""
     group: "Reverse Proxy Configuration"
@@ -446,3 +412,89 @@ questions:
                       schema:
                         type: string
                         default: ""
+  - variable: PUID
+    group: "Advanced"
+    label: "PUID"
+    description: "Sets the PUID env var for LinuxServer.io (compatible) containers"
+    schema:
+      type: int
+      default: 568
+
+  - variable: PGID
+    group: "Advanced"
+    label: "PGID"
+    description: "Sets the PGID env var for LinuxServer.io (compatible) containers"
+    schema:
+      type: int
+      default: 568
+  - variable: UMASK
+    group: "Advanced"
+    label: "UMASK"
+    description: "Sets the UMASK env var for LinuxServer.io (compatible) containers"
+    schema:
+      type: string
+      default: "002"
+  # Enable privileged
+  - variable: securityContext
+    group: "Advanced"
+    label: "Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: privileged
+          label: "Enable privileged mode for Common-Chart based charts"
+          schema:
+            type: boolean
+            default: false
+  # Set Pod Security Policy
+  - variable: podSecurityContext
+    group: "Advanced"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsNonRoot
+          label: "runAsNonRoot"
+          schema:
+            type: boolean
+            default: false
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: supplementalGroups
+          label: "supplementalGroups"
+          description: "Additional groups this App needs access to"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: Group
+                label: "Group"
+                schema:
+                  type: int
+                  default: 568
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"

incubator/tvheadend/3.0.0/templates/NOTES.txt

@@ -1 +0,0 @@
-{{- include "common.notes.defaultNotes" . -}}

incubator/tvheadend/3.0.0/test_values.yaml

@@ -8,7 +8,12 @@ image:
 strategy:
   type: Recreate
 
-startAsRoot: true
+# Configure the Security Context for the Pod
+podSecurityContext:
+  runAsNonRoot: false
+  runAsUser: 0
+  runAsGroup: 0
+  fsGroup: 0
 
 # See https://github.com/linuxserver/docker-tvheadend#parameters
 env: {}