From a7b3ce0e234f34676b60dcba7356c845c3890522 Mon Sep 17 00:00:00 2001 From: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Date: Fri, 10 Sep 2021 21:10:04 +0300 Subject: [PATCH] fix: make sure podSecurityContext is included in both SCALE and Helm installs (#956) * remove strategy * move runAsNonRoot to securityContext * Add podSecurityContext and securityContext to values pt1 * Add podSecurityContext and securityContext to values pt2 * Add podSecurityContext and securityContext to values pt3 * Add podSecurityContext and securityContext to values pt4 * Add podSecurityContext and securityContext to values pt5 * fix empty lines * Remove secCont from NC - values * fixPermissions for some apps * on apps with perm prob, set fsGroup to 0 also --- charts/incubator/custom-app/values.yaml | 13 ++++++-- charts/stable/appdaemon/values.yaml | 13 ++++---- charts/stable/authelia/values.yaml | 27 ++++++++--------- charts/stable/bazarr/values.yaml | 14 +++++++-- charts/stable/calibre-web/values.yaml | 3 -- charts/stable/collabora-online/values.yaml | 3 -- charts/stable/deepstack-cpu/values.yaml | 3 -- charts/stable/deluge/values.yaml | 3 -- charts/stable/emby/values.yaml | 9 ++++-- charts/stable/esphome/values.yaml | 14 +++++++-- charts/stable/fireflyiii/values.yaml | 10 +++++-- charts/stable/flaresolverr/values.yaml | 13 ++++++++ charts/stable/flood/values.yaml | 13 ++++++++ charts/stable/focalboard/values.yaml | 13 ++++++++ charts/stable/freshrss/values.yaml | 3 -- charts/stable/gaps/values.yaml | 14 +++++++-- charts/stable/gonic/SCALE/questions.yaml | 8 ++--- charts/stable/gonic/values.yaml | 13 ++++++++ charts/stable/grocy/values.yaml | 3 -- charts/stable/handbrake/values.yaml | 3 -- charts/stable/haste-server/values.yaml | 11 +++++-- charts/stable/heimdall/values.yaml | 3 -- charts/stable/home-assistant/values.yaml | 3 -- .../stable/hyperion-ng/SCALE/questions.yaml | 8 ++--- charts/stable/hyperion-ng/values.yaml | 13 ++++++++ charts/stable/jackett/values.yaml | 13 ++++++-- charts/stable/jdownloader2/values.yaml | 3 -- charts/stable/jellyfin/values.yaml | 9 ++++-- charts/stable/kms/values.yaml | 3 -- charts/stable/komga/values.yaml | 13 ++++++++ charts/stable/lazylibrarian/values.yaml | 3 -- charts/stable/lidarr/values.yaml | 14 +++++++-- charts/stable/littlelink/values.yaml | 3 -- charts/stable/lychee/values.yaml | 3 -- charts/stable/mosquitto/values.yaml | 13 ++++++++ charts/stable/mylar/SCALE/questions.yaml | 8 ++--- charts/stable/mylar/values.yaml | 13 ++++++++ charts/stable/navidrome/values.yaml | 14 +++++++-- charts/stable/nextcloud/values.yaml | 14 ++++----- charts/stable/node-red/values.yaml | 14 +++++++-- charts/stable/nullserv/SCALE/questions.yaml | 8 ++--- charts/stable/nullserv/values.yaml | 13 ++++++++ charts/stable/nzbget/values.yaml | 14 +++++++-- charts/stable/nzbhydra/values.yaml | 14 +++++++-- .../omada-controller/SCALE/questions.yaml | 8 ++--- charts/stable/omada-controller/values.yaml | 13 ++++++++ charts/stable/ombi/values.yaml | 14 +++++++-- charts/stable/organizr/values.yaml | 3 -- charts/stable/overseerr/values.yaml | 13 ++++++++ charts/stable/owncloud-ocis/values.yaml | 13 ++++++++ charts/stable/pgadmin/values.yaml | 14 +++++++-- charts/stable/photoprism/values.yaml | 13 ++++++++ charts/stable/phpldapadmin/values.yaml | 3 -- charts/stable/piaware/SCALE/questions.yaml | 8 ++--- charts/stable/piaware/values.yaml | 18 +++++++---- charts/stable/plex/values.yaml | 9 ++++-- charts/stable/podgrab/values.yaml | 13 ++++---- charts/stable/postgresql/values.yaml | 3 -- .../pretend-youre-xyzzy/SCALE/questions.yaml | 8 ++--- charts/stable/pretend-youre-xyzzy/values.yaml | 13 ++++++++ .../protonmail-bridge/SCALE/questions.yaml | 8 ++--- charts/stable/protonmail-bridge/values.yaml | 13 ++++++++ charts/stable/prowlarr/values.yaml | 10 ++++++- charts/stable/pyload/SCALE/questions.yaml | 8 ++--- charts/stable/pyload/values.yaml | 13 ++++++++ charts/stable/qbittorrent/values.yaml | 14 +++++++-- charts/stable/radarr/values.yaml | 14 +++++++-- charts/stable/readarr/values.yaml | 14 +++++++-- charts/stable/reg/values.yaml | 10 ++++++- charts/stable/resilio-sync/values.yaml | 13 ++++++++ charts/stable/sabnzbd/values.yaml | 14 +++++++-- charts/stable/ser2sock/values.yaml | 17 ++++++++--- charts/stable/sonarr/values.yaml | 14 +++++++-- charts/stable/syncthing/values.yaml | 14 +++++++-- charts/stable/tautulli/values.yaml | 14 +++++++-- charts/stable/thelounge/values.yaml | 3 -- charts/stable/traefik/SCALE/questions.yaml | 5 ---- charts/stable/traefik/values.yaml | 30 +++++++++++-------- charts/stable/transmission/values.yaml | 14 +++++++-- charts/stable/truecommand/values.yaml | 3 -- charts/stable/tvheadend/values.yaml | 3 -- charts/stable/unifi/values.yaml | 3 -- charts/stable/unpackerr/values.yaml | 14 +++++++-- charts/stable/vaultwarden/values.yaml | 16 ++++++++-- charts/stable/xteve/values.yaml | 13 ++++++++ charts/stable/zwavejs2mqtt/values.yaml | 9 ++++-- templates/app/SCALE/questions.yaml | 10 +++---- templates/app/values.yaml | 14 +++++++-- 88 files changed, 685 insertions(+), 230 deletions(-) diff --git a/charts/incubator/custom-app/values.yaml b/charts/incubator/custom-app/values.yaml index d114cd44b91..ce0c52d2f8f 100644 --- a/charts/incubator/custom-app/values.yaml +++ b/charts/incubator/custom-app/values.yaml @@ -5,9 +5,18 @@ image: pullPolicy: IfNotPresent tag: v0.18.686 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/appdaemon/values.yaml b/charts/stable/appdaemon/values.yaml index 28a79f5375a..7b24f2847da 100644 --- a/charts/stable/appdaemon/values.yaml +++ b/charts/stable/appdaemon/values.yaml @@ -3,15 +3,18 @@ image: pullPolicy: IfNotPresent tag: "v4.0.8" -strategy: - type: Recreate - -# Configure the Security Context for the Pod -podSecurityContext: +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true runAsNonRoot: true + +podSecurityContext: runAsUser: 568 runAsGroup: 568 fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" env: TZ: "America/Chicago" diff --git a/charts/stable/authelia/values.yaml b/charts/stable/authelia/values.yaml index d125872ffa0..e3350130e3b 100644 --- a/charts/stable/authelia/values.yaml +++ b/charts/stable/authelia/values.yaml @@ -5,6 +5,18 @@ image: pullPolicy: IfNotPresent tag: "4.30.4" +securityContext: + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" postgresqlImage: repository: postgres @@ -14,9 +26,6 @@ postgresqlImage: command: ["authelia"] args: ["--config=/configuration.yaml"] -strategy: - type: Recreate - enableServiceLinks: false service: @@ -81,18 +90,6 @@ redis: persistence: enabled: false - -podSecurityContext: - runAsUser: 568 - runAsGroup: 568 - fsGroup: 568 - -securityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - privileged: false - - resources: limits: {} # limits: diff --git a/charts/stable/bazarr/values.yaml b/charts/stable/bazarr/values.yaml index c4c6ca5987f..35d296ec4b0 100644 --- a/charts/stable/bazarr/values.yaml +++ b/charts/stable/bazarr/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v0.9.8 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/calibre-web/values.yaml b/charts/stable/calibre-web/values.yaml index b424b2ad247..894cd0c5949 100644 --- a/charts/stable/calibre-web/values.yaml +++ b/charts/stable/calibre-web/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: version-0.6.12 -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/collabora-online/values.yaml b/charts/stable/collabora-online/values.yaml index 2bbc50b4948..6efc032af44 100644 --- a/charts/stable/collabora-online/values.yaml +++ b/charts/stable/collabora-online/values.yaml @@ -3,9 +3,6 @@ image: tag: 6.4.10.10 pullPolicy: IfNotPresent -strategy: - type: Recreate - service: main: type: NodePort diff --git a/charts/stable/deepstack-cpu/values.yaml b/charts/stable/deepstack-cpu/values.yaml index c9adc2baa09..2f6bb43661b 100644 --- a/charts/stable/deepstack-cpu/values.yaml +++ b/charts/stable/deepstack-cpu/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: cpu-2021.02.1 -strategy: - type: Recreate - service: main: enabled: true diff --git a/charts/stable/deluge/values.yaml b/charts/stable/deluge/values.yaml index 8b791a2d77d..6a4aa55974c 100644 --- a/charts/stable/deluge/values.yaml +++ b/charts/stable/deluge/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: version-2.0.3-2201906121747ubuntu18.04.1 -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/emby/values.yaml b/charts/stable/emby/values.yaml index 65ec246cc86..76ad4727aee 100644 --- a/charts/stable/emby/values.yaml +++ b/charts/stable/emby/values.yaml @@ -5,16 +5,19 @@ image: pullPolicy: IfNotPresent tag: v4.6.4.0 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true # 44=video 107=render podSecurityContext: - runAsNonRoot: true runAsUser: 568 runAsGroup: 568 fsGroup: 568 supplementalGroups: [44, 107] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/esphome/values.yaml b/charts/stable/esphome/values.yaml index 8dfd7964c09..fefe6e00b5b 100644 --- a/charts/stable/esphome/values.yaml +++ b/charts/stable/esphome/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: 2021.8.2 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/fireflyiii/values.yaml b/charts/stable/fireflyiii/values.yaml index ffb529e4771..5e50efad33f 100644 --- a/charts/stable/fireflyiii/values.yaml +++ b/charts/stable/fireflyiii/values.yaml @@ -11,14 +11,18 @@ postgresqlImage: pullPolicy: IfNotPresent tag: 13.4-alpine -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false podSecurityContext: - runAsNonRoot: false runAsUser: 0 runAsGroup: 0 fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/flaresolverr/values.yaml b/charts/stable/flaresolverr/values.yaml index 5e136cec6b7..0b2c0635673 100644 --- a/charts/stable/flaresolverr/values.yaml +++ b/charts/stable/flaresolverr/values.yaml @@ -13,6 +13,19 @@ image: # -- image tag tag: v1.2.9 +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See more environment variables in the [flaresolverr documentation](https://github.com/FlareSolverr/FlareSolverr#environment-variables). # @default -- See below env: diff --git a/charts/stable/flood/values.yaml b/charts/stable/flood/values.yaml index c1b0c97e0d3..b6e7f2c19d6 100644 --- a/charts/stable/flood/values.yaml +++ b/charts/stable/flood/values.yaml @@ -13,6 +13,19 @@ image: # -- image tag tag: 4.6.1 +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See more environment variables in the [flood documentation] (https://github.com/jesec/flood/blob/v4.6.0/config.ts) # Note: The environmental variables are not case sensitive (e.g. FLOOD_OPTION_port=FLOOD_OPTION_PORT). # @default -- See below diff --git a/charts/stable/focalboard/values.yaml b/charts/stable/focalboard/values.yaml index 2a644998937..ad2b899e3a5 100644 --- a/charts/stable/focalboard/values.yaml +++ b/charts/stable/focalboard/values.yaml @@ -13,6 +13,19 @@ image: # -- image tag tag: 0.8.0 +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See more environment variables in the [image entrypoint script](https://github.com/FlipEnergy/container-images/blob/main/focalboard/entrypoint.sh) # @default -- See below env: {} diff --git a/charts/stable/freshrss/values.yaml b/charts/stable/freshrss/values.yaml index 80bf6769c92..ec5cf361f47 100644 --- a/charts/stable/freshrss/values.yaml +++ b/charts/stable/freshrss/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: version-1.18.1 -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/gaps/values.yaml b/charts/stable/gaps/values.yaml index 29edcb27bd2..77ae00044e5 100644 --- a/charts/stable/gaps/values.yaml +++ b/charts/stable/gaps/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v0.8.8 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/gonic/SCALE/questions.yaml b/charts/stable/gonic/SCALE/questions.yaml index 21292c95b6f..600c81a518d 100644 --- a/charts/stable/gonic/SCALE/questions.yaml +++ b/charts/stable/gonic/SCALE/questions.yaml @@ -979,7 +979,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -992,19 +992,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/gonic/values.yaml b/charts/stable/gonic/values.yaml index ffa50795a48..188e9eb5473 100644 --- a/charts/stable/gonic/values.yaml +++ b/charts/stable/gonic/values.yaml @@ -13,6 +13,19 @@ image: # -- image tag tag: v0.13.1 +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See more environment variables in the [gonic documentation](https://github.com/sentriz/gonic#configuration-options) # @default -- See below env: diff --git a/charts/stable/grocy/values.yaml b/charts/stable/grocy/values.yaml index 5441f2ffb03..1dc65359396 100644 --- a/charts/stable/grocy/values.yaml +++ b/charts/stable/grocy/values.yaml @@ -5,9 +5,6 @@ image: tag: version-v3.1.1 pullPolicy: IfNotPresent -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/handbrake/values.yaml b/charts/stable/handbrake/values.yaml index cb1fb9307c6..1dd35fd08a0 100644 --- a/charts/stable/handbrake/values.yaml +++ b/charts/stable/handbrake/values.yaml @@ -3,9 +3,6 @@ image: tag: v1.24.1 pullPolicy: IfNotPresent -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/haste-server/values.yaml b/charts/stable/haste-server/values.yaml index e51c1821b1e..18c85b80233 100644 --- a/charts/stable/haste-server/values.yaml +++ b/charts/stable/haste-server/values.yaml @@ -13,13 +13,18 @@ image: # -- image tag tag: latest -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true podSecurityContext: - runAsNonRoot: true runAsUser: 568 runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" # -- environment variables. See [image docs](https://github.com/seejohnrun/haste-server) for more details. # @default -- See below diff --git a/charts/stable/heimdall/values.yaml b/charts/stable/heimdall/values.yaml index c2354753fa4..4fa5e518105 100644 --- a/charts/stable/heimdall/values.yaml +++ b/charts/stable/heimdall/values.yaml @@ -5,9 +5,6 @@ image: tag: version-2.2.2 pullPolicy: IfNotPresent -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/home-assistant/values.yaml b/charts/stable/home-assistant/values.yaml index fced67fd3f2..122becc51bf 100644 --- a/charts/stable/home-assistant/values.yaml +++ b/charts/stable/home-assistant/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: 2021.9.4 -strategy: - type: Recreate - env: {} # TZ: diff --git a/charts/stable/hyperion-ng/SCALE/questions.yaml b/charts/stable/hyperion-ng/SCALE/questions.yaml index 667031b812c..b4cc929212e 100644 --- a/charts/stable/hyperion-ng/SCALE/questions.yaml +++ b/charts/stable/hyperion-ng/SCALE/questions.yaml @@ -1282,7 +1282,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -1295,19 +1295,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/hyperion-ng/values.yaml b/charts/stable/hyperion-ng/values.yaml index dfdd0aeb40f..2cb4d34465a 100644 --- a/charts/stable/hyperion-ng/values.yaml +++ b/charts/stable/hyperion-ng/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See [image docs](https://docs.linuxserver.io/images/docker-airsonic#environment-variables-e) for more details. # @default -- See below env: diff --git a/charts/stable/jackett/values.yaml b/charts/stable/jackett/values.yaml index a73c8c63fb0..f1eb437452a 100644 --- a/charts/stable/jackett/values.yaml +++ b/charts/stable/jackett/values.yaml @@ -5,9 +5,18 @@ image: pullPolicy: IfNotPresent tag: v0.18.686 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/jdownloader2/values.yaml b/charts/stable/jdownloader2/values.yaml index bf467dbc38c..31e7cf77e23 100644 --- a/charts/stable/jdownloader2/values.yaml +++ b/charts/stable/jdownloader2/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: v1.7.1 -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/jellyfin/values.yaml b/charts/stable/jellyfin/values.yaml index 85d00e142e3..fb0b84c7774 100644 --- a/charts/stable/jellyfin/values.yaml +++ b/charts/stable/jellyfin/values.yaml @@ -5,16 +5,19 @@ image: pullPolicy: IfNotPresent tag: 10.7.7 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true # 44=video 107=render podSecurityContext: - runAsNonRoot: true runAsUser: 568 runAsGroup: 568 fsGroup: 568 supplementalGroups: [44, 107] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/kms/values.yaml b/charts/stable/kms/values.yaml index 8aabb450d99..69190b2c90e 100644 --- a/charts/stable/kms/values.yaml +++ b/charts/stable/kms/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: minimal -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/komga/values.yaml b/charts/stable/komga/values.yaml index c881c7abbfb..b9e8ac99e21 100644 --- a/charts/stable/komga/values.yaml +++ b/charts/stable/komga/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See more environment variables in the [komga documentation](https://komga.org/installation/configuration.html#optional-configuration). # @default -- See below env: {} diff --git a/charts/stable/lazylibrarian/values.yaml b/charts/stable/lazylibrarian/values.yaml index ce1abe3ab65..64d71c6247f 100644 --- a/charts/stable/lazylibrarian/values.yaml +++ b/charts/stable/lazylibrarian/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: latest -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/lidarr/values.yaml b/charts/stable/lidarr/values.yaml index d92c801d3be..28c637b3836 100644 --- a/charts/stable/lidarr/values.yaml +++ b/charts/stable/lidarr/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v1.0.0.2255 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/littlelink/values.yaml b/charts/stable/littlelink/values.yaml index 3d5f3cac7a9..44c381188ed 100644 --- a/charts/stable/littlelink/values.yaml +++ b/charts/stable/littlelink/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: latest -strategy: - type: Recreate - service: main: diff --git a/charts/stable/lychee/values.yaml b/charts/stable/lychee/values.yaml index 3ff0193ab47..3790746874a 100644 --- a/charts/stable/lychee/values.yaml +++ b/charts/stable/lychee/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: v4.3.4 -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/mosquitto/values.yaml b/charts/stable/mosquitto/values.yaml index 6e240e18a07..7e3fcfb014c 100644 --- a/charts/stable/mosquitto/values.yaml +++ b/charts/stable/mosquitto/values.yaml @@ -8,6 +8,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- Configures service settings for the chart. Normally this does not need to be modified. # @default -- See values.yaml service: diff --git a/charts/stable/mylar/SCALE/questions.yaml b/charts/stable/mylar/SCALE/questions.yaml index ecad01dfe61..cd68837922e 100644 --- a/charts/stable/mylar/SCALE/questions.yaml +++ b/charts/stable/mylar/SCALE/questions.yaml @@ -991,7 +991,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -1004,19 +1004,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/mylar/values.yaml b/charts/stable/mylar/values.yaml index 509667209d3..f170f789729 100644 --- a/charts/stable/mylar/values.yaml +++ b/charts/stable/mylar/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See [image docs](https://docs.linuxserver.io/images/docker-mylar3#environment-variables-e) for more details. # @default -- See below env: diff --git a/charts/stable/navidrome/values.yaml b/charts/stable/navidrome/values.yaml index a6e3ad15d0d..7ee9753ad91 100644 --- a/charts/stable/navidrome/values.yaml +++ b/charts/stable/navidrome/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: 0.45.1 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/nextcloud/values.yaml b/charts/stable/nextcloud/values.yaml index 9dc05f21365..f26f29cc06e 100644 --- a/charts/stable/nextcloud/values.yaml +++ b/charts/stable/nextcloud/values.yaml @@ -5,14 +5,18 @@ image: pullPolicy: IfNotPresent tag: 22.1.1 +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 33 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + postgresqlImage: repository: postgres pullPolicy: IfNotPresent tag: "13.1" -strategy: - type: Recreate - service: main: ports: @@ -87,10 +91,6 @@ initContainers: name: dbcreds key: plainhost - -podSecurityContext: - fsGroup: 33 - # -- Probe configuration # -- [[ref]](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) # @default -- See below diff --git a/charts/stable/node-red/values.yaml b/charts/stable/node-red/values.yaml index 2d3d976203b..66736c64951 100644 --- a/charts/stable/node-red/values.yaml +++ b/charts/stable/node-red/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: 2.0.6 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" # See more environment varaibles in the node-red documentation # https://nodered.org/docs/getting-started/docker diff --git a/charts/stable/nullserv/SCALE/questions.yaml b/charts/stable/nullserv/SCALE/questions.yaml index 3330e0432c7..592cef878a0 100644 --- a/charts/stable/nullserv/SCALE/questions.yaml +++ b/charts/stable/nullserv/SCALE/questions.yaml @@ -1082,7 +1082,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -1095,19 +1095,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/nullserv/values.yaml b/charts/stable/nullserv/values.yaml index 23b208d565a..04be9d1c365 100644 --- a/charts/stable/nullserv/values.yaml +++ b/charts/stable/nullserv/values.yaml @@ -17,6 +17,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See more environment variables in the [nullserv documentation](https://github.com/bmrzycki/nullserv/blob/master/README.md). # @default -- See below env: diff --git a/charts/stable/nzbget/values.yaml b/charts/stable/nzbget/values.yaml index b7f901b3628..84b489cb0de 100644 --- a/charts/stable/nzbget/values.yaml +++ b/charts/stable/nzbget/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v21.1 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/nzbhydra/values.yaml b/charts/stable/nzbhydra/values.yaml index ea18da3a84c..ff9958d90f4 100644 --- a/charts/stable/nzbhydra/values.yaml +++ b/charts/stable/nzbhydra/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v3.15.2 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/omada-controller/SCALE/questions.yaml b/charts/stable/omada-controller/SCALE/questions.yaml index e3e8eb8c26d..fe6f8455340 100644 --- a/charts/stable/omada-controller/SCALE/questions.yaml +++ b/charts/stable/omada-controller/SCALE/questions.yaml @@ -979,7 +979,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -992,19 +992,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/omada-controller/values.yaml b/charts/stable/omada-controller/values.yaml index 5cd36323121..a1c8009f0b6 100644 --- a/charts/stable/omada-controller/values.yaml +++ b/charts/stable/omada-controller/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See [image docs](https://github.com/mbentley/docker-omada-controller) for more details. # @default -- See below env: diff --git a/charts/stable/ombi/values.yaml b/charts/stable/ombi/values.yaml index 5b76e4ef5f4..043b3b4228b 100644 --- a/charts/stable/ombi/values.yaml +++ b/charts/stable/ombi/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v4.0.1475 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/organizr/values.yaml b/charts/stable/organizr/values.yaml index cf066965d16..4692731e5d2 100644 --- a/charts/stable/organizr/values.yaml +++ b/charts/stable/organizr/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: Always tag: latest -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/overseerr/values.yaml b/charts/stable/overseerr/values.yaml index d9f82d1c237..c5408aa4567 100644 --- a/charts/stable/overseerr/values.yaml +++ b/charts/stable/overseerr/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. # @default -- See below env: diff --git a/charts/stable/owncloud-ocis/values.yaml b/charts/stable/owncloud-ocis/values.yaml index fe1da3e1543..4332e7892f3 100644 --- a/charts/stable/owncloud-ocis/values.yaml +++ b/charts/stable/owncloud-ocis/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See more environment variables in the [owncloud-ocis documentation](https://owncloud.dev/ocis/configuration/#environment-variables). # @default -- See below env: diff --git a/charts/stable/pgadmin/values.yaml b/charts/stable/pgadmin/values.yaml index bf1b9d135ae..3f97dcecb3e 100644 --- a/charts/stable/pgadmin/values.yaml +++ b/charts/stable/pgadmin/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: "5.6" -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 5050 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/photoprism/values.yaml b/charts/stable/photoprism/values.yaml index 19ee5d69ef0..8df54d5ff27 100644 --- a/charts/stable/photoprism/values.yaml +++ b/charts/stable/photoprism/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See [image docs](https://docs.photoprism.org/getting-started/config-options/) for more details. # @default -- See below env: diff --git a/charts/stable/phpldapadmin/values.yaml b/charts/stable/phpldapadmin/values.yaml index 99345a76f15..a766bcf708d 100644 --- a/charts/stable/phpldapadmin/values.yaml +++ b/charts/stable/phpldapadmin/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: "0.9.0" -strategy: - type: Recreate - service: main: diff --git a/charts/stable/piaware/SCALE/questions.yaml b/charts/stable/piaware/SCALE/questions.yaml index 2aa4d8c49c7..e5292b5bcf4 100644 --- a/charts/stable/piaware/SCALE/questions.yaml +++ b/charts/stable/piaware/SCALE/questions.yaml @@ -979,7 +979,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -992,19 +992,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/piaware/values.yaml b/charts/stable/piaware/values.yaml index 1e45f1611fe..79311fecdf2 100644 --- a/charts/stable/piaware/values.yaml +++ b/charts/stable/piaware/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: true + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See [application docs](https://flightaware.com/adsb/piaware/advanced_configuration) for more details. # @default -- See below env: @@ -27,11 +40,6 @@ service: main: port: 8080 - -securityContext: - # -- (bool) Privileged securityContext may be required if USB device is accessed directly through the host machine - privileged: true - # -- Configure persistence settings for the chart under this key. # @default -- See values.yaml persistence: diff --git a/charts/stable/plex/values.yaml b/charts/stable/plex/values.yaml index fec95290dd5..95146b4bb01 100644 --- a/charts/stable/plex/values.yaml +++ b/charts/stable/plex/values.yaml @@ -5,16 +5,19 @@ image: pullPolicy: IfNotPresent tag: v1.24.1.4931-1a38e63c6 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true # 44=video 107=render podSecurityContext: - runAsNonRoot: true runAsUser: 568 runAsGroup: 568 fsGroup: 568 supplementalGroups: [44, 107] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/podgrab/values.yaml b/charts/stable/podgrab/values.yaml index 41b324a9612..f3ee5f001ec 100644 --- a/charts/stable/podgrab/values.yaml +++ b/charts/stable/podgrab/values.yaml @@ -5,15 +5,18 @@ image: pullPolicy: Always tag: 1.0.0 -strategy: - type: Recreate - -# Configure the Security Context for the Pod -podSecurityContext: +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true runAsNonRoot: true + +podSecurityContext: runAsUser: 568 runAsGroup: 568 fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/postgresql/values.yaml b/charts/stable/postgresql/values.yaml index d4da044db4c..675492d1edc 100644 --- a/charts/stable/postgresql/values.yaml +++ b/charts/stable/postgresql/values.yaml @@ -3,9 +3,6 @@ image: pullPolicy: IfNotPresent tag: "13.4" -strategy: - type: Recreate - service: main: diff --git a/charts/stable/pretend-youre-xyzzy/SCALE/questions.yaml b/charts/stable/pretend-youre-xyzzy/SCALE/questions.yaml index 6d694e7a602..820bccbd14c 100644 --- a/charts/stable/pretend-youre-xyzzy/SCALE/questions.yaml +++ b/charts/stable/pretend-youre-xyzzy/SCALE/questions.yaml @@ -862,7 +862,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -875,19 +875,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/pretend-youre-xyzzy/values.yaml b/charts/stable/pretend-youre-xyzzy/values.yaml index 2d19c5fed92..3683487c9f9 100644 --- a/charts/stable/pretend-youre-xyzzy/values.yaml +++ b/charts/stable/pretend-youre-xyzzy/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- Configures service settings for the chart. # @default -- See values.yaml service: diff --git a/charts/stable/protonmail-bridge/SCALE/questions.yaml b/charts/stable/protonmail-bridge/SCALE/questions.yaml index 51eb9d2de7e..fe40f285b7d 100644 --- a/charts/stable/protonmail-bridge/SCALE/questions.yaml +++ b/charts/stable/protonmail-bridge/SCALE/questions.yaml @@ -991,7 +991,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -1004,19 +1004,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/protonmail-bridge/values.yaml b/charts/stable/protonmail-bridge/values.yaml index 5ecf3d90d8e..e6eef682fc2 100644 --- a/charts/stable/protonmail-bridge/values.yaml +++ b/charts/stable/protonmail-bridge/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. # @default -- See below env: diff --git a/charts/stable/prowlarr/values.yaml b/charts/stable/prowlarr/values.yaml index 8fe347572af..105052f56e8 100644 --- a/charts/stable/prowlarr/values.yaml +++ b/charts/stable/prowlarr/values.yaml @@ -13,10 +13,18 @@ image: # -- image pull policy pullPolicy: IfNotPresent -podSecurityContext: +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true runAsNonRoot: true + +podSecurityContext: runAsUser: 568 runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" # -- environment variables. # @default -- See below diff --git a/charts/stable/pyload/SCALE/questions.yaml b/charts/stable/pyload/SCALE/questions.yaml index 6c375cfcad7..6082fbc4360 100644 --- a/charts/stable/pyload/SCALE/questions.yaml +++ b/charts/stable/pyload/SCALE/questions.yaml @@ -991,7 +991,7 @@ questions: label: "runAsNonRoot" schema: type: boolean - default: true + default: false - variable: podSecurityContext group: "Security and Permissions" @@ -1004,19 +1004,19 @@ questions: description: "The UserID of the user running the application" schema: type: int - default: 568 + default: 0 - variable: runAsGroup label: "runAsGroup" description: The groupID this App of the user running the application" schema: type: int - default: 568 + default: 0 - variable: fsGroup label: "fsGroup" description: "The group that should own ALL storage." schema: type: int - default: 568 + default: 0 - variable: supplementalGroups label: "supplemental Groups" schema: diff --git a/charts/stable/pyload/values.yaml b/charts/stable/pyload/values.yaml index f78d6ae1750..eadb3fb222c 100644 --- a/charts/stable/pyload/values.yaml +++ b/charts/stable/pyload/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See [image docs](https://docs.linuxserver.io/images/docker-pyload#environment-variables-e) for more details. # @default -- See below env: diff --git a/charts/stable/qbittorrent/values.yaml b/charts/stable/qbittorrent/values.yaml index a33e523251a..0a2f11e91b1 100644 --- a/charts/stable/qbittorrent/values.yaml +++ b/charts/stable/qbittorrent/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v4.3.7 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" env: {} # TZ: UTC diff --git a/charts/stable/radarr/values.yaml b/charts/stable/radarr/values.yaml index 68a42ce833b..c67718a11c6 100644 --- a/charts/stable/radarr/values.yaml +++ b/charts/stable/radarr/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v3.2.2.5080 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/readarr/values.yaml b/charts/stable/readarr/values.yaml index 643a40bded5..dc76270bf48 100644 --- a/charts/stable/readarr/values.yaml +++ b/charts/stable/readarr/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v0.1.0.963 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/reg/values.yaml b/charts/stable/reg/values.yaml index 93668d4a17f..0b66302570c 100644 --- a/charts/stable/reg/values.yaml +++ b/charts/stable/reg/values.yaml @@ -13,10 +13,18 @@ image: # -- image tag tag: v0.16.1 -podSecurityContext: +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true runAsNonRoot: true + +podSecurityContext: runAsUser: 568 runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" # -- environment variables. See more environment variables in the [reg documentation](https://github.com/genuinetools/reg). env: diff --git a/charts/stable/resilio-sync/values.yaml b/charts/stable/resilio-sync/values.yaml index a11783eba6d..ee5a569971e 100644 --- a/charts/stable/resilio-sync/values.yaml +++ b/charts/stable/resilio-sync/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See [image docs](https://docs.linuxserver.io/images/docker-resilio-sync#environment-variables-e) for more details. # @default -- See below env: diff --git a/charts/stable/sabnzbd/values.yaml b/charts/stable/sabnzbd/values.yaml index 87bbd6f6169..2ef93816be5 100644 --- a/charts/stable/sabnzbd/values.yaml +++ b/charts/stable/sabnzbd/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v3.3.1 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/ser2sock/values.yaml b/charts/stable/ser2sock/values.yaml index 9359ad10eb8..c87ba876842 100644 --- a/charts/stable/ser2sock/values.yaml +++ b/charts/stable/ser2sock/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: Always +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. See [image docs](https://github.com/tenstartups/ser2sock) for more details. # @default -- See below env: @@ -46,10 +59,6 @@ persistence: type: hostPath mountPath: /dev/ttyUSB0 -securityContext: - # -- (bool) Privileged securityContext may be required if USB controller is accessed directly through the host machine - privileged: # true - # -- Affinity constraint rules to place the Pod on a specific node. # [[ref]](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) affinity: {} diff --git a/charts/stable/sonarr/values.yaml b/charts/stable/sonarr/values.yaml index 861e725aa70..805900488c5 100644 --- a/charts/stable/sonarr/values.yaml +++ b/charts/stable/sonarr/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v3.0.6.1265 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/syncthing/values.yaml b/charts/stable/syncthing/values.yaml index d0893ab5fa9..854da9df2c0 100644 --- a/charts/stable/syncthing/values.yaml +++ b/charts/stable/syncthing/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: "1.18" -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/tautulli/values.yaml b/charts/stable/tautulli/values.yaml index 560eb4de84e..4e8ca4be2a9 100644 --- a/charts/stable/tautulli/values.yaml +++ b/charts/stable/tautulli/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v2.7.6 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/thelounge/values.yaml b/charts/stable/thelounge/values.yaml index df1e164be5d..04977ca6734 100644 --- a/charts/stable/thelounge/values.yaml +++ b/charts/stable/thelounge/values.yaml @@ -13,9 +13,6 @@ image: # -- image tag tag: 4.2.0-alpine -strategy: - type: Recreate - # -- environment variables. See [image docs](https://hub.docker.com/r/thelounge/thelounge/) for more details. # @default -- See below env: diff --git a/charts/stable/traefik/SCALE/questions.yaml b/charts/stable/traefik/SCALE/questions.yaml index a1d61e7f104..955d62a895f 100644 --- a/charts/stable/traefik/SCALE/questions.yaml +++ b/charts/stable/traefik/SCALE/questions.yaml @@ -1140,11 +1140,6 @@ questions: schema: type: dict attrs: - - variable: runAsNonRoot - label: "runAsNonRoot" - schema: - type: boolean - default: true - variable: runAsUser label: "runAsUser" description: "The UserID of the user running the application" diff --git a/charts/stable/traefik/values.yaml b/charts/stable/traefik/values.yaml index 0cb9f617ac8..803167bb3c5 100644 --- a/charts/stable/traefik/values.yaml +++ b/charts/stable/traefik/values.yaml @@ -5,6 +5,23 @@ image: tag: v2.5.2 pullPolicy: IfNotPresent +# -- Set the container security context +# To run the container with ports below 1024 this will need to be adjust to run as root +securityContext: + capabilities: + drop: [ALL] + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + runAsNonRoot: false + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x ingressClass: # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12 @@ -274,19 +291,6 @@ serviceAccount: # If not set, a service account is created automatically using the fullname template name: "" -# -- Set the container security context -# To run the container with ports below 1024 this will need to be adjust to run as root -securityContext: - capabilities: - drop: [ALL] - readOnlyRootFilesystem: true - runAsGroup: 568 - runAsNonRoot: true - runAsUser: 568 - -podSecurityContext: - fsGroup: 568 - # -- SCALE Middleware Handlers middlewares: basicAuth: [] diff --git a/charts/stable/transmission/values.yaml b/charts/stable/transmission/values.yaml index 64e8f3714a9..3fc755a4a5b 100644 --- a/charts/stable/transmission/values.yaml +++ b/charts/stable/transmission/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: v3.00 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/truecommand/values.yaml b/charts/stable/truecommand/values.yaml index 00803865bfe..5b75e7d3b8a 100644 --- a/charts/stable/truecommand/values.yaml +++ b/charts/stable/truecommand/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: "2.0" -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/tvheadend/values.yaml b/charts/stable/tvheadend/values.yaml index b517736201d..1e8417b127a 100644 --- a/charts/stable/tvheadend/values.yaml +++ b/charts/stable/tvheadend/values.yaml @@ -5,9 +5,6 @@ image: pullPolicy: IfNotPresent tag: version-63784405 -strategy: - type: Recreate - # See https://github.com/linuxserver/docker-tvheadend#parameters env: {} # PUID: 1000 diff --git a/charts/stable/unifi/values.yaml b/charts/stable/unifi/values.yaml index 2398231ef74..97bd11d7f8f 100644 --- a/charts/stable/unifi/values.yaml +++ b/charts/stable/unifi/values.yaml @@ -5,9 +5,6 @@ image: tag: v6.2.26 pullPolicy: IfNotPresent -strategy: - type: Recreate - envTpl: # Permissions Settings UNIFI_GID: "{{ .Values.env.PUID }}" diff --git a/charts/stable/unpackerr/values.yaml b/charts/stable/unpackerr/values.yaml index 8e823d75dd7..272144f1588 100644 --- a/charts/stable/unpackerr/values.yaml +++ b/charts/stable/unpackerr/values.yaml @@ -5,8 +5,18 @@ image: pullPolicy: IfNotPresent tag: 0.9.7 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" service: main: diff --git a/charts/stable/vaultwarden/values.yaml b/charts/stable/vaultwarden/values.yaml index ffe8693f502..5c0dc246b93 100644 --- a/charts/stable/vaultwarden/values.yaml +++ b/charts/stable/vaultwarden/values.yaml @@ -5,15 +5,25 @@ image: pullPolicy: IfNotPresent tag: 1.22.2 +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + postgresqlImage: repository: postgres pullPolicy: IfNotPresent tag: 13.4-alpine -strategy: - type: Recreate - service: main: ports: diff --git a/charts/stable/xteve/values.yaml b/charts/stable/xteve/values.yaml index b7f896590c6..0c2732bfacc 100644 --- a/charts/stable/xteve/values.yaml +++ b/charts/stable/xteve/values.yaml @@ -13,6 +13,19 @@ image: # -- image pull policy pullPolicy: IfNotPresent +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + # -- environment variables. # @default -- See below env: diff --git a/charts/stable/zwavejs2mqtt/values.yaml b/charts/stable/zwavejs2mqtt/values.yaml index 0f9e2ff4efa..84cfe796f10 100644 --- a/charts/stable/zwavejs2mqtt/values.yaml +++ b/charts/stable/zwavejs2mqtt/values.yaml @@ -7,16 +7,19 @@ image: pullPolicy: IfNotPresent tag: 5.5.3 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true # 5=tty 20=dialout 24=cdrom podSecurityContext: - runAsNonRoot: true runAsUser: 568 runAsGroup: 568 fsGroup: 568 supplementalGroups: [5, 20, 24] + fsGroupChangePolicy: "OnRootMismatch" # # See more environment variables in the zwavejs2mqtt documentation # https://zwave-js.github.io/zwavejs2mqtt/#/guide/env-vars diff --git a/templates/app/SCALE/questions.yaml b/templates/app/SCALE/questions.yaml index 5f2773cba89..986c3059d8c 100644 --- a/templates/app/SCALE/questions.yaml +++ b/templates/app/SCALE/questions.yaml @@ -589,6 +589,11 @@ questions: schema: type: boolean default: false + - variable: runAsNonRoot + label: "runAsNonRoot" + schema: + type: boolean + default: true - variable: podSecurityContext group: "Security and Permissions" @@ -596,11 +601,6 @@ questions: schema: type: dict attrs: - - variable: runAsNonRoot - label: "runAsNonRoot" - schema: - type: boolean - default: true - variable: runAsUser label: "runAsUser" description: "The UserID of the user running the application" diff --git a/templates/app/values.yaml b/templates/app/values.yaml index 992f90524f3..d464dc44c7f 100644 --- a/templates/app/values.yaml +++ b/templates/app/values.yaml @@ -10,8 +10,18 @@ image: pullPolicy: IfNotPresent tag: 1.0.0 -strategy: - type: Recreate +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: true + +podSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" # See more environment variables in the ${CHARTNAME} documentation # https://${CHARTNAME}.org/docs