fix: make sure podSecurityContext is included in both SCALE and Helm installs (#956)

* remove strategy

* move runAsNonRoot to securityContext

* Add podSecurityContext and securityContext to values pt1

* Add podSecurityContext and securityContext to values pt2

* Add podSecurityContext and securityContext to values pt3

* Add podSecurityContext and securityContext to values pt4

* Add podSecurityContext and securityContext to values pt5

* fix empty lines

* Remove secCont from NC - values

* fixPermissions for some apps

* on apps with perm prob, set fsGroup to 0 also

charts/stable/traefik/SCALE/questions.yaml

@@ -1140,11 +1140,6 @@ questions:
     schema:
       type: dict
       attrs:
-        - variable: runAsNonRoot
-          label: "runAsNonRoot"
-          schema:
-            type: boolean
-            default: true
         - variable: runAsUser
           label: "runAsUser"
           description: "The UserID of the user running the application"

charts/stable/traefik/values.yaml

@@ -5,6 +5,23 @@ image:
   tag: v2.5.2
   pullPolicy: IfNotPresent
 
+# -- Set the container security context
+# To run the container with ports below 1024 this will need to be adjust to run as root
+securityContext:
+  capabilities:
+    drop: [ALL]
+  privileged: false
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 568
+  runAsGroup: 568
+  fsGroup: 568
+  supplementalGroups: []
+  fsGroupChangePolicy: "OnRootMismatch"
+
 # -- Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x
 ingressClass:
   # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12
@@ -274,19 +291,6 @@ serviceAccount:
   # If not set, a service account is created automatically using the fullname template
   name: ""
 
-# -- Set the container security context
-# To run the container with ports below 1024 this will need to be adjust to run as root
-securityContext:
-  capabilities:
-    drop: [ALL]
-  readOnlyRootFilesystem: true
-  runAsGroup: 568
-  runAsNonRoot: true
-  runAsUser: 568
-
-podSecurityContext:
-  fsGroup: 568
-
 # -- SCALE Middleware Handlers
 middlewares:
   basicAuth: []