security(Apps): Improve Snyk hardening advisory (#1208)

* Harden postgresql by removing the migration initcontainer

* Harden initcontainers

* Harden serviceaccounts and RBAC

* hmm

* fix

charts/library/common/templates/_postSetup.tpl

@@ -25,9 +25,7 @@ Secondary entrypoint and primary loader for the common chart
   {{- /* Build the templates */ -}}
   {{- include "common.pvc" . }}
 
-  {{- if .Values.serviceAccount.create -}}
-    {{- include "common.serviceAccount" . }}
-  {{- end -}}
+  {{- include "common.serviceAccount" . }}
 
   {{- if .Values.controller.enabled }}
     {{- if eq .Values.controller.type "deployment" }}

charts/library/common/templates/_rbac.tpl

@@ -42,7 +42,6 @@ roleRef:
   kind: ClusterRole
   name: {{ include "common.names.fullname" . }}
 subjects:
-  {{- if .Values.serviceAccount }}
   - kind: ServiceAccount
     name: {{ include "common.names.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
@@ -50,5 +49,4 @@ subjects:
   {{- with .Values.rbac.subjects }}
   {{- toYaml . | nindent 2 }}
   {{- end }}
-{{- end }}
 {{- end -}}

charts/library/common/templates/_serviceaccount.tpl

@@ -2,11 +2,12 @@
 The ServiceAccount object to be created.
 */}}
 {{- define "common.serviceAccount" }}
+{{- if .Values.serviceAccount.create }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "common.names.serviceAccountName" . }}
+  name: {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
   labels:
     {{- include "common.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}
@@ -14,3 +15,4 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 {{- end }}
+{{- end }}

charts/library/common/templates/lib/controller/_autopermissions.yaml

@@ -15,10 +15,15 @@ before chart installation.
   image: {{ .Values.alpineImage.repository }}:{{ .Values.alpineImage.tag }}
   securityContext:
     runAsUser: 0
-    runAsGroup: 0
-    privileged: true
-    allowPrivilegeEscalation: true
-    runAsNonRoot: false
+    privileged: false
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+  resources:
+  {{- with .Values.resources }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   command:
     - "/bin/sh"
     - "-c"

charts/library/common/templates/lib/dependencies/_postgresInit.tpl

@@ -6,6 +6,14 @@ This template ensures pods with postgresql dependency have a delayed start
 {{- if .Values.postgresql.enabled }}
 - name: postgresql-init
   image: "{{ .Values.postgresqlImage.repository}}:{{ .Values.postgresqlImage.tag }}"
+  securityContext:
+    capabilities:
+      drop:
+        - ALL
+  resources:
+  {{- with .Values.resources }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   command:
     - "sh"
     - "-c"