(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps * Add default common securityContext to all apps * Adjust securityContext defaults in questions.yaml, according to values.yaml * Add default common podSecurityContext to all apps * Clean whitespace * Clean more whitespace * Adjust podSecurityContext defaults in questions.yaml, according to values.yaml * fix pgadmin Co-authored-by: Stavros kois <s.kois@outlook.com>
2021-09-26 20:05:21 +02:00
parent fe03d574fc
commit acf510ea13
314 changed files with 2675 additions and 3091 deletions
@@ -1,24 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
-# OWNERS file for Kubernetes
-OWNERS
@@ -1,62 +0,0 @@
-# Changelog<br>
-
-
-<a name="portalexample-0.0.2"></a>
-### [portalexample-0.0.2](https://github.com/truecharts/apps/compare/portalexample-0.0.1...portalexample-0.0.2) (2021-09-21)
-
-#### Chore
-
-* update non-major deps helm releases ([#1014](https://github.com/truecharts/apps/issues/1014))
-
-
-
-<a name="portalexample-0.0.1"></a>
-### portalexample-0.0.1 (2021-09-16)
-
-
-
-<a name="pihole-2.0.5"></a>
-### [pihole-2.0.5](https://github.com/truecharts/apps/compare/pihole-2.0.4...pihole-2.0.5) (2021-09-16)
-
-
-
-<a name="pihole-2.0.4"></a>
-### [pihole-2.0.4](https://github.com/truecharts/apps/compare/pihole-2.0.3...pihole-2.0.4) (2021-09-16)
-
-
-
-<a name="pihole-2.0.3"></a>
-### [pihole-2.0.3](https://github.com/truecharts/apps/compare/pihole-2.0.2...pihole-2.0.3) (2021-09-14)
-
-#### Fix
-
-* update pihole digest and versioning to mirror
-
-
-
-<a name="pihole-2.0.2"></a>
-### [pihole-2.0.2](https://github.com/truecharts/apps/compare/pihole-2.0.1...pihole-2.0.2) (2021-09-14)
-
-#### Fix
-
-* update pihole versioning to 2021 scheme
-
-
-
-<a name="pihole-2.0.1"></a>
-### [pihole-2.0.1](https://github.com/truecharts/apps/compare/pihole-1.0.7...pihole-2.0.1) (2021-09-13)
-
-#### Chore
-
-* move most remaining Apps to GHCR mirror ([#959](https://github.com/truecharts/apps/issues/959))
-* update non-major ([#962](https://github.com/truecharts/apps/issues/962))
-
-#### Feat
-
-* add new GUI and VPN support to all Apps ([#977](https://github.com/truecharts/apps/issues/977))
-* Add VPN addon and move some config to includes ([#973](https://github.com/truecharts/apps/issues/973))
-* pin all container references to digests ([#963](https://github.com/truecharts/apps/issues/963))
-* Move some common containers to our own containers
-
-<a name="pihole-1.0.7"></a>
-## [pihole-1.0.7](https://github.com/truecharts/apps/compare/pihole-1.0.6...pihole-1.0.7) (2021-09-08)
@@ -1,24 +0,0 @@
-apiVersion: v2
-appVersion: "2021.09"
-dependencies:
- name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
-deprecated: false
-description: portal example
-home: https://github.com/truecharts/apps/tree/master/charts/stable/pihole
-icon: https://upload.wikimedia.org/wikipedia/en/thumb/1/15/Pi-hole_vector_logo.svg/1200px-Pi-hole_vector_logo.svg.png
-keywords:
- DNS
-kubeVersion: '>=1.16.0-0'
-maintainers:
- email: info@truecharts.org
-  name: TrueCharts
-  url: truecharts.org
-name: portalexample
-sources:
- https://pi-hole.net/
- https://github.com/pi-hole
- https://github.com/pi-hole/docker-pi-hole
-type: application
-version: 0.0.2
@@ -1,39 +0,0 @@
-# Introduction
-
-portal example
-
-TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation.
-**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)**
-
-## Source Code
-
-* <https://pi-hole.net/>
-* <https://github.com/pi-hole>
-* <https://github.com/pi-hole/docker-pi-hole>
-
-## Requirements
-
-Kubernetes: `>=1.16.0-0`
-
-## Dependencies
-
-| Repository | Name | Version |
-|------------|------|---------|
-| https://truecharts.org/ | common | 7.0.14 |
-
-## Installing the Chart
-
-To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/).
-
-## Uninstalling the Chart
-
-To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/).
-
-## Support
-
- Please check our [quick-start guides](https://truecharts.org/manual/Quick-Start%20Guides/01-Open-Apps/) first.
- See the [Wiki](https://truecharts.org)
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
---
-All Rights Reserved - The TrueCharts Project
@@ -1,7 +0,0 @@
-
-<a name="portalexample-0.0.2"></a>
-### [portalexample-0.0.2](https://github.com/truecharts/apps/compare/portalexample-0.0.1...portalexample-0.0.2) (2021-09-21)
-
-#### Chore
-
-* update non-major deps helm releases ([#1014](https://github.com/truecharts/apps/issues/1014))
@@ -1,3 +0,0 @@
-categories:
-  - networking
-icon_url: https://upload.wikimedia.org/wikipedia/en/thumb/1/15/Pi-hole_vector_logo.svg/1200px-Pi-hole_vector_logo.svg.png
@@ -1,19 +0,0 @@
-##
-# This file contains Values.yaml content that gets added to the output of questions.yaml
-# It's ONLY meant for content that the user is NOT expected to change.
-# Example: Everything under "image" is not included in questions.yaml but is included here.
-##
-
-image:
-  repository: ghcr.io/truecharts/pihole
-  pullPolicy: IfNotPresent
-  tag: v2021.09@sha256:e043ab188da4c36abb11d70d82bbfb394ef5054abff21dafbaf54bc21861bd1e
-
-envFrom:
-  - configMapRef:
-      name: pihole-env
-
-##
-# Most other defaults are set in questions.yaml
-# For other options please refer to the wiki, default_values.yaml or the common library chart
-##
@@ -1,3 +0,0 @@
-portal example
-
-This App is supplied by TrueCharts, for more information please visit https://truecharts.org
@@ -1,40 +0,0 @@
-# Default Helm-Values
-
-TrueCharts is primarily build to supply TrueNAS SCALE Apps.
-However, we also supply all Apps as standard Helm-Charts. In this document we aim to document the default values in our values.yaml file.
-
-Most of our Apps also consume our "common" Helm Chart.
-If this is the case, this means that all values.yaml values are set to the common chart values.yaml by default. This values.yaml file will only contain values that deviate from the common chart.
-You will, however, be able to use all values referenced in the common chart here, besides the values listed in this document.
-
-## Values
-
-| Key | Type | Default | Description |
-|-----|------|---------|-------------|
-| envFrom[0].configMapRef.name | string | `"pihole-env"` |  |
-| image.pullPolicy | string | `"IfNotPresent"` |  |
-| image.repository | string | `"ghcr.io/truecharts/pihole"` |  |
-| image.tag | string | `"v2021.09@sha256:e043ab188da4c36abb11d70d82bbfb394ef5054abff21dafbaf54bc21861bd1e"` |  |
-| persistence.config.accessMode | string | `"ReadWriteOnce"` |  |
-| persistence.config.enabled | bool | `true` |  |
-| persistence.config.mountPath | string | `"/etc/pihole"` |  |
-| persistence.config.size | string | `"100Gi"` |  |
-| persistence.config.type | string | `"pvc"` |  |
-| persistence.dnsmasq.accessMode | string | `"ReadWriteOnce"` |  |
-| persistence.dnsmasq.enabled | bool | `true` |  |
-| persistence.dnsmasq.mountPath | string | `"/etc/dnsmasq.d"` |  |
-| persistence.dnsmasq.size | string | `"100Gi"` |  |
-| persistence.dnsmasq.type | string | `"pvc"` |  |
-| pihole.DNS1 | string | `"9.9.9.9"` |  |
-| pihole.DNS2 | string | `"149.112.112.112"` |  |
-| pihole.WEBPASSWORD | string | `"somepassword"` |  |
-| service.dns-tcp.enabled | bool | `true` |  |
-| service.dns-tcp.ports.https.enabled | bool | `true` |  |
-| service.dns-tcp.ports.https.port | int | `53` |  |
-| service.dns.enabled | bool | `true` |  |
-| service.dns.ports.dns.enabled | bool | `true` |  |
-| service.dns.ports.dns.port | int | `53` |  |
-| service.main.enabled | bool | `true` |  |
-| service.main.ports.main.port | int | `80` |  |
-
-All Rights Reserved - The TrueCharts Project
@@ -1,13 +0,0 @@
-{{/* Define the configmap */}}
-{{- define "pihole.configmap" -}}
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pihole-env
-data:
-  WEBPASSWORD: {{ .Values.pihole.WEBPASSWORD | squote }}
-  {{- if .Values.pihole.DNS1 }}
-  "PIHOLE_DNS_": {{ if .Values.pihole.DNS2 }}{{ ( printf "%v;%v" .Values.pihole.DNS1 .Values.pihole.DNS2 ) | squote }}{{ else }}{{ .Values.pihole.DNS1 | squote }}{{ end }}
-  {{- end }}
-{{- end -}}
@@ -1,8 +0,0 @@
-{{/* Make sure all variables are set properly */}}
-{{- include "common.values.setup" . }}
-
-{{/* Render configmap for pihole */}}
-{{- include "pihole.configmap" . }}
-
-{{/* Render the templates */}}
-{{ include "common.all" . }}
@@ -1,49 +0,0 @@
-# Default values for Jackett.
-
-image:
-  repository: ghcr.io/truecharts/pihole
-  pullPolicy: IfNotPresent
-  tag: v2021.09@sha256:e043ab188da4c36abb11d70d82bbfb394ef5054abff21dafbaf54bc21861bd1e
-
-envFrom:
-  - configMapRef:
-      name: pihole-env
-
-service:
-  main:
-    enabled: true
-    ports:
-      main:
-        port: 80
-  dns-tcp:
-    enabled: true
-    ports:
-      https:
-        enabled: true
-        port: 53
-  dns:
-    enabled: true
-    ports:
-      dns:
-        enabled: true
-        port: 53
-
-pihole:
-  WEBPASSWORD: "somepassword"
-  DNS1: "9.9.9.9"
-  DNS2: "149.112.112.112"
-
-
-persistence:
-  config:
-    enabled: true
-    mountPath: "/etc/pihole"
-    type: pvc
-    accessMode: ReadWriteOnce
-    size: "100Gi"
-  dnsmasq:
-    enabled: true
-    mountPath: "/etc/dnsmasq.d"
-    type: pvc
-    accessMode: ReadWriteOnce
-    size: "100Gi"
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "5.2.0"
+appVersion: 5.2.0
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 - condition: postgresql.enabled
  name: postgresql
  repository: https://truecharts.org/
@@ -27,4 +27,4 @@ name: sogo
 sources:
 - https://www.sogo.nu/
 type: application
-version: 3.0.6
+version: 4.0.0
@@ -66,7 +66,6 @@ questions:
                description: "(Legacy) OnDelete: ignore .spec.template changes"
 # Include{controllerExpert}

-
  - variable: env
    group: "Container Configuration"
    label: "Image Environment"
@@ -88,7 +87,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
  - variable: sogo
    group: "App Configuration"
    label: "SOGo Configuration "
@@ -659,6 +657,17 @@ questions:
    schema:
      type: dict
      attrs:
+        - variable: varrun
+          label: "varrun override"
+          schema:
+            type: dict
+            attrs:
+              - variable: enabled
+                label: "Enable the storage"
+                schema:
+                  type: boolean
+                  default: false
+                  hidden: true
        - variable: data
          label: "App Data Storage"
          description: "Stores the Application Data."
@@ -1151,8 +1160,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  - variable: securityContext
    group: "Security and Permissions"
@@ -1174,13 +1181,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false

+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -4,6 +4,14 @@ image:
  pullPolicy: IfNotPresent
  tag: v5.2.0@sha256:8fc7bb87b77d76d929bcd36403d4f27878fa3e99f5448fb05ed64829078665a4

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 postgresqlImage:
  repository: bitnami/postgresql
  pullPolicy: IfNotPresent
@@ -51,7 +59,8 @@ persistence:
    enabled: true
    mountPath: "/mimetmp"
    type: emptyDir
-
+  varrun:
+    enabled: false

 # -- postgres dependency settings
 postgresql:
@@ -1,8 +0,0 @@
-# Configuration Options
-
-##### Connecting to other apps
-If you need to connect this App to other Apps on TrueNAS SCALE, please refer to our "Linking Apps Internally" quick-start guide:
-https://truecharts.org/manual/Quick-Start%20Guides/14-linking-apps/
-
-##### Available config options
-In the future this page is going to contain an automated list of options available in the installation/edit UI.
@@ -8,7 +8,6 @@ openvpnImage:
  # -- Specify the openvpn client image pull policy
  pullPolicy: IfNotPresent

-
 # -- WireGuard specific configuration
 # @default -- See below
 wireguardImage:
@@ -27,7 +26,6 @@ promtailImage:
  # -- Specify the promtail image pull policy
  pullPolicy: IfNotPresent

-
 netshootImage:
  # -- Specify the netshoot image
  repository: nicolaka/netshoot
@@ -261,7 +259,6 @@ securityContext:
  allowPrivilegeEscalation: false
  runAsNonRoot: true

-
 # -- Configure the lifecycle for the main container
 lifecycle: {}

@@ -358,7 +355,6 @@ termination:
  # -- [[ref](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#lifecycle)]
  gracePeriodSeconds: 10

-
 # -- Configure additional services for the chart here.
 # @default -- See below
 serviceList: []
@@ -426,7 +422,6 @@ service:
        # [[ref]](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)
        nodePort:

-
 # -- Configure ingressList for the chart here.
 # Additional items can be added by adding a items similar to ingress
 # @default -- []
@@ -608,7 +603,6 @@ persistence:
    # specify a size for memory backed volumes.
    sizeLimit:  # 1Gi

-
  # -- Example of a hostPath mount
  # [[ref]]https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)
  # @default -- See below
@@ -737,7 +731,6 @@ addons:
      # name: someenv
      # value: somevalue

-
    # -- Provide a customized vpn configuration file to be used by the VPN.
    configFile:
      enabled: true
@@ -749,7 +742,6 @@ addons:
      # See Kubernetes documentation for options.
      hostPathType: "File"

-
  # -- The common library supports adding a code-server add-on to access files. It can be configured under this key.
  # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#code-server)
  # @default -- See values.yaml
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "10.6.2"
+appVersion: 10.6.2
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 description: Airsonic is a Free and Open Source community driven media server
 home: https://github.com/truecharts/apps/tree/master/charts/incubator/airsonic
 icon: https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/airsonic-logo.png
@@ -19,4 +19,4 @@ sources:
 - https://github.com/airsonic/airsonic
 - https://github.com/linuxserver/docker-airsonic
 - https://github.com/k8s-at-home/charts/tree/master/charts/airsonic
-version: 2.0.3
+version: 3.0.0
@@ -99,8 +99,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -555,8 +553,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -579,13 +575,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false

+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -627,7 +668,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -13,6 +13,14 @@ image:
  # -- image pull policy
  pullPolicy: IfNotPresent

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 # -- environment variables. See [image docs](https://docs.linuxserver.io/images/docker-airsonic#environment-variables-e) for more details.
 # @default -- See below
 env:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "4.1.0"
+appVersion: 4.1.0
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: AppDaemon is a loosely coupled, multithreaded, sandboxed python execution
  environment for writing automation apps for Home Assistant home automation software.
@@ -26,4 +26,4 @@ name: appdaemon
 sources:
 - https://github.com/AppDaemon/appdaemon
 type: application
-version: 4.0.2
+version: 5.0.0
@@ -131,8 +131,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -427,7 +425,6 @@ questions:
                  default: "100Gi"
 # Include{persistenceList}

-
 # Include{ingressList}

  - variable: securityContext
@@ -445,12 +442,12 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -480,7 +477,7 @@ questions:
          description: "The group that should own ALL storage."
          schema:
            type: int
-            default: 0
+            default: 568
        - variable: supplementalGroups
          label: "supplemental Groups"
          schema:
@@ -501,6 +498,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -542,7 +540,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -4,17 +4,11 @@ image:
  tag: v4.1.0@sha256:209ee1c83b4c0794dd6f50333f60a212d0df7c4205e7e374ac78d988ffc3d8fd

 securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
  runAsNonRoot: false

 podSecurityContext:
  runAsUser: 0
  runAsGroup: 0
-  fsGroup: 0
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"

 env:
  TZ: "America/Chicago"
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "4.31.0"
+appVersion: 4.31.0
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 - condition: postgresql.enabled
  name: postgresql
  repository: https://truecharts.org/
@@ -38,4 +38,4 @@ sources:
 - https://github.com/authelia/chartrepo
 - https://github.com/authelia/authelia
 type: application
-version: 3.0.9
+version: 4.0.0
@@ -250,8 +250,6 @@ identity_providers:
        ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
        # userinfo_signing_algorithm: none

-
-
 ##
 # Most other defaults are set in questions.yaml
 # For other options please refer to the wiki, default_values.yaml or the common library chart
@@ -66,7 +66,6 @@ questions:
                description: "(Legacy) OnDelete: ignore .spec.template changes"
 # Include{controllerExpert}

-
  - variable: env
    group: "Container Configuration"
    label: "Image Environment"
@@ -283,7 +282,6 @@ questions:
            default: "5m"
            required: true

-
  - variable: authentication_backend
    group: "App Configuration"
    label: "Authentication Backend Provider"
@@ -519,7 +517,6 @@ questions:
                              default: 8
                              required: true

-
  - variable: notifier
    group: "App Configuration"
    label: "Notifier Configuration"
@@ -793,8 +790,6 @@ questions:
                              default: ""
                              required: true

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -1250,8 +1245,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  - variable: securityContext
    group: "Security and Permissions"
@@ -1323,6 +1316,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -1364,8 +1358,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,19 +5,6 @@ image:
  pullPolicy: IfNotPresent
  tag: 4.31.0@sha256:6036f2b1fa3214fdcf189a8f28f40a856372413984b08f15ba4fb5891d77bc0a

-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: true
-  allowPrivilegeEscalation: false
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
-
 postgresqlImage:
  repository: bitnami/postgresql
  pullPolicy: IfNotPresent
@@ -534,7 +521,6 @@ regulation:
  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
  ban_time: 5m

-
 ##
 ## Storage Provider Configuration
 ##
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "0.9.9"
+appVersion: 0.9.9
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Bazarr is a companion application to Bazarr and Radarr. It manages and
  downloads subtitles based on your requirements
@@ -29,4 +29,4 @@ sources:
 - https://github.com/Bazarr/Bazarr
 - https://hub.docker.com/r/linuxserver/bazarr
 type: application
-version: 7.0.2
+version: 8.0.0
@@ -86,8 +86,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -192,7 +190,6 @@ questions:
                              max: 65535
                              default: 36025

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -542,8 +539,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -561,12 +556,12 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -617,6 +612,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -658,7 +654,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,19 +5,6 @@ image:
  pullPolicy: IfNotPresent
  tag: v0.9.9@sha256:889f97670f5af6b39896a89c76652e346693b446bc9097988ff8eb32141fc38f

-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
-
 service:
  main:
    ports:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "2009.1.0"
+appVersion: 2009.1.0
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: Booksonic is a platform for accessing the audibooks you own wherever
  you are
 home: https://github.com/truechartsapps/tree/master/charts/incubator/booksonic-air
@@ -20,4 +20,4 @@ name: booksonic-air
 sources:
 - https://github.com/popeen/Booksonic-Air
 - https://hub.docker.com/r/linuxserver/booksonic-air
-version: 2.0.3
+version: 3.0.0
@@ -98,8 +98,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -204,7 +202,6 @@ questions:
                              max: 65535
                              default: 36052

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -553,8 +550,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -577,13 +572,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false

+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -625,7 +665,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -13,6 +13,14 @@ image:
  # -- image tag
  tag: version-v2009.1.0@sha256:e05e9b40b03ad4f7468c297f4282cd9a713de9513968b0872abf90b10cce00e7

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 # See more environment variables in the [booksonic-air documentation](https://github.com/linuxserver/docker-booksonic-air#parameters)
 # @default -- See below
 env:
@@ -33,7 +41,6 @@ service:
      main:
        port: 4040

-
 # -- Configure persistence settings for the chart under this key.
 # @default -- See values.yaml
 persistence:
@@ -2,8 +2,8 @@ apiVersion: v2
 appVersion: 0.6.12
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Calibre-Web is a web app providing a clean interface for browsing, reading
  and downloading eBooks using an existing Calibre database.
@@ -23,4 +23,4 @@ sources:
 - https://hub.docker.com/r/linuxserver/calibre-web/
 - https://github.com/janeczku/calibre-web
 type: application
-version: 7.0.4
+version: 8.0.0
@@ -98,8 +98,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -204,7 +202,6 @@ questions:
                              max: 65535
                              default: 36015

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -554,8 +551,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  - variable: securityContext
    group: "Security and Permissions"
@@ -577,12 +572,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false
+
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -624,7 +665,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,6 +5,14 @@ image:
  pullPolicy: IfNotPresent
  tag: version-0.6.12@sha256:938810eca3d3137221308afe9095773c8552a457dc0943abd0aec5613242b0b6

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 service:
  main:
    ports:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "5.26.0"
+appVersion: 5.26.0
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: Calibre is a powerful and easy to use e-book manager.
 home: https://github.com/truechartsapps/tree/master/charts/incubator/calibre
 icon: https://github.com/kovidgoyal/calibre/raw/master/resources/images/lt.png
@@ -18,4 +18,4 @@ name: calibre
 sources:
 - https://hub.docker.com/r/linuxserver/calibre/
 - https://github.com/kovidgoyal/calibre/
-version: 2.0.2
+version: 3.0.0
@@ -116,8 +116,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -319,7 +317,6 @@ questions:
                              max: 65535
                              default: 36054

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -668,8 +665,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -687,18 +682,63 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false

+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -740,7 +780,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -16,6 +16,13 @@ image:
  # -- image pull policy
  pullPolicy: IfNotPresent

+securityContext:
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 # -- environment variables. See [image docs](https://docs.linuxserver.io/images/docker-calibre#environment-variables-e) for more details.
 # @default -- See below
 env:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "6.4.11.3"
+appVersion: 6.4.11.3
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: "Collabora Online Development Edition \u2013 an awesome, Online Office\
  \ suite image suitable for home use."
@@ -25,4 +25,4 @@ sources:
 - https://sdk.collaboraonline.com/contents.html
 - https://github.com/CollaboraOnline/online/tree/master/kubernetes/helm
 type: application
-version: 7.0.3
+version: 8.0.0
@@ -132,8 +132,6 @@ questions:
            valid_chars: '^[a-z]{1,}\\{1}\.{1}[a-z]{1,}\\{1}\.{1}[a-z]{1,}$'
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -238,7 +236,6 @@ questions:
                              max: 65535
                              default: 36004

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -471,8 +468,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  - variable: securityContext
    group: "Security and Permissions"
@@ -494,12 +489,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false
+
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 104
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -541,7 +582,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -3,6 +3,14 @@ image:
  tag: v6.4.11.3@sha256:30eab5f9807e006b90b2533ad3a60b84c6e744a6fed8a3be2bd3f1a839715456
  pullPolicy: IfNotPresent

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 104
+  runAsGroup: 0
+
 service:
  main:
    type: NodePort
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "0.18.773"
+appVersion: 0.18.773
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Advanced tool to create your own TrueCharts-based App
 home: https://github.com/truecharts/apps/tree/master/charts/stable/custom-app
@@ -19,4 +19,4 @@ name: custom-app
 sources:
 - https://github.com/truecharts/apps/tree/master/charts/stable/custom-app
 type: application
-version: 1.0.4
+version: 2.0.0
@@ -113,8 +113,6 @@ questions:
              - "definitions/timezone"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -500,9 +498,6 @@ questions:
                                  schema:
                                    type: string

-
-
-
 # Include{ingressList}

  - variable: securityContext
@@ -525,13 +520,12 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: true
-
  - variable: podSecurityContext
    group: "Security and Permissions"
    label: "Pod Security Context"
@@ -557,13 +551,13 @@ questions:
            type: int
            default: 568
        - variable: supplementalGroups
-          label: "supplementalGroups"
+          label: "supplemental Groups"
          schema:
            type: list
            default: []
            items:
              - variable: supplementalGroupsEntry
-                label: "supplementalGroup"
+                label: "supplemental Group"
                schema:
                  type: int
        - variable: fsGroupChangePolicy
@@ -6,17 +6,7 @@ image:
  tag: v0.18.773@sha256:288d33f51df057ba91a8f4586e7b47082984c66f21ccfa09a39339402aebcbad

 securityContext:
-  privileged: false
  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"

 service:
  main:
@@ -42,7 +32,6 @@ env: {}
  # PUID: 1001
  # PGID: 1001

-
 persistence:
  config:
    enabled: true
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "2.12.06"
+appVersion: 2.12.06
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: deCONZ is an easy to use control software, with which you can set up
  and control Zigbee networks of any size without further programming effort.
 home: https://github.com/truechartsapps/tree/master/charts/incubator/deconz
@@ -22,4 +22,4 @@ name: deconz
 sources:
 - https://github.com/dresden-elektronik/deconz-rest-plugin
 - https://github.com/marthoc/docker-deconz
-version: 2.0.2
+version: 3.0.0
@@ -123,8 +123,6 @@ questions:
            default: ""
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -423,7 +421,6 @@ questions:
                              max: 65535
                              default: 36057

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -772,8 +769,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -796,13 +791,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false

+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -13,6 +13,14 @@ image:
  # -- image pull policy
  pullPolicy: IfNotPresent

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 # -- environment variables. See [image docs](https://github.com/marthoc/docker-deconz/blob/master/README.md) for more details.
 # @default -- See below
 env:
@@ -48,10 +56,6 @@ service:
        enabled: true
        port: 5900

-securityContext:
-  # -- (bool) Privileged securityContext may be required if USB controller is accessed directly through the host machine
-  privileged:  # true
-
 # -- Configure persistence settings for the chart under this key.
 # @default -- See values.yaml
 persistence:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "cpu-2021.0"
+appVersion: cpu-2021.0
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: DeepStack AI provides AI features including Face Recognition, Object
  Detection, Scene Recognition and custom AI Models
@@ -25,4 +25,4 @@ sources:
 - https://hub.docker.com/r/deepquestai/deepstack
 - https://www.deepstack.cc/
 type: application
-version: 5.0.2
+version: 6.0.0
@@ -153,8 +153,6 @@ questions:
            required: true
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -259,7 +257,6 @@ questions:
                              max: 65535
                              default: 36005

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -608,8 +605,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  - variable: securityContext
    group: "Security and Permissions"
@@ -626,17 +621,63 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
-            default: false
+            default: true
+
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 568
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 568
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -678,7 +719,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "2.0.3-2201"
+appVersion: 2.0.3-2201
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Deluge App for TrueNAS SCALE
 home: https://github.com/truecharts/apps/tree/master/charts/incubator/deluge
@@ -21,4 +21,4 @@ name: deluge
 sources:
 - https://github.com/deluge-torrent/deluge
 type: application
-version: 7.0.2
+version: 8.0.0
@@ -698,8 +698,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  - variable: securityContext
    group: "Security and Permissions"
@@ -716,17 +714,63 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false
+
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -768,7 +812,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,6 +5,13 @@ image:
  pullPolicy: IfNotPresent
  tag: version-2.0.3-2201906121747ubuntu18.04.1@sha256:a32d8680e315932b799c8267e2c0d630185aaf8b542d56a134c74c9a5c957c36

+securityContext:
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 service:
  main:
    ports:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.4.5"
+appVersion: 1.4.5
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: Create live TV channel streams from media on your Plex servers.
 home: https://github.com/truechartsapps/tree/master/charts/incubator/dizquetv
 icon: https://github.com/vexorian/dizquetv/raw/main/resources/dizquetv.png?raw=true
@@ -19,4 +19,4 @@ name: dizquetv
 sources:
 - https://github.com/vexorian/dizquetv
 - https://hub.docker.com/r/vexorian/dizquetv
-version: 2.0.3
+version: 3.0.0
@@ -98,8 +98,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -204,7 +202,6 @@ questions:
                              max: 65535
                              default: 36058

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -553,8 +550,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -572,17 +567,62 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
-            default: false
+            default: true
+
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 568
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 568
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"

  - variable: resources
    group: "Resources and Devices"
@@ -625,7 +665,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -31,7 +31,6 @@ service:
      main:
        port: 8000

-
 # -- Configure persistence settings for the chart under this key.
 # @default -- See values.yaml
 persistence:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "latest"
+appVersion: latest
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: Store securely encrypted backups on cloud storage services!
 home: https://github.com/truechartsapps/tree/master/charts/incubator/duplicati
 icon: https://avatars.githubusercontent.com/u/8270231?s=200&v=4
@@ -18,4 +18,4 @@ name: duplicati
 sources:
 - https://hub.docker.com/r/linuxserver/duplicati/
 - https://github.com/duplicati/duplicati
-version: 2.0.3
+version: 3.0.0
@@ -98,8 +98,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -204,7 +202,6 @@ questions:
                              max: 65535
                              default: 36059

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -553,8 +550,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -577,13 +572,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false

+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -625,7 +665,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -13,6 +13,14 @@ image:
  # -- image pull policy
  pullPolicy: IfNotPresent

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 # See more environment variables in the [duplicati documentation](https://github.com/linuxserver/docker-duplicati#parameters)
 # @default -- See below
 env:
@@ -31,7 +39,6 @@ service:
      main:
        port: 8200

-
 # -- Configure persistence settings for the chart under this key.
 # @default -- See values.yaml
 persistence:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "4.6.4.0"
+appVersion: 4.6.4.0
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Emby Server is a home media server
 home: https://github.com/truecharts/apps/master/stable/emby
@@ -25,4 +25,4 @@ sources:
 - https://hub.docker.com/r/linuxserver/emby
 - https://github.com/linuxserver/docker-emby.git
 type: application
-version: 7.0.2
+version: 8.0.0
@@ -86,8 +86,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -192,7 +190,6 @@ questions:
                              max: 65535
                              default: 36006

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -541,8 +538,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  # Specify GPU configuration
  - variable: scaleGPU
@@ -574,7 +569,7 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -625,6 +620,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -666,7 +662,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -6,18 +6,7 @@ image:
  tag: v4.6.4.0@sha256:3921a37cfd43abbc5be6fd6a2141488573c64f70d628b4a4731415713cbb12cd

 securityContext:
-  privileged: false
  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-# 44=video 107=render
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: [44, 107]
-  fsGroupChangePolicy: "OnRootMismatch"

 service:
  main:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "2021.9.1"
+appVersion: 2021.9.1
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: ESPHome is a system to control your ESP8266/ESP32 by simple yet powerful
  configuration files and control them remotely through Home Automation systems.
@@ -24,4 +24,4 @@ sources:
 - https://github.com/esphome/esphome
 - https://hub.docker.com/u/esphome
 type: application
-version: 7.0.3
+version: 8.0.0
@@ -80,8 +80,6 @@ questions:
              - "definitions/timezone"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -645,8 +643,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -664,12 +660,12 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -720,6 +716,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -761,7 +758,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,19 +5,6 @@ image:
  pullPolicy: IfNotPresent
  tag: v2021.9.1@sha256:f50cafe66793653fb2fd22ac436f9dea83535f0cca599400c2d76f09845a6e44

-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
-
 service:
  main:
    ports:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "0.66.6"
+appVersion: 0.66.6
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Allow external services to be used like Apps.
 home: https://github.com/truecharts/apps/tree/master/charts/stable/external-service
@@ -23,4 +23,4 @@ name: external-service
 sources:
 - https://github.com/truecharts/apps/tree/master/charts/stable/external-service
 type: application
-version: 2.0.2
+version: 3.0.0
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "5.5.12"
+appVersion: 5.5.12
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 - condition: postgresql.enabled
  name: postgresql
  repository: https://truecharts.org/
@@ -27,4 +27,4 @@ name: fireflyiii
 sources:
 - https://github.com/firefly-iii/firefly-iii/
 type: application
-version: 8.0.6
+version: 9.0.0
@@ -97,8 +97,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -553,8 +551,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -577,12 +573,12 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
-            default: false
+            default: true

  - variable: podSecurityContext
    group: "Security and Permissions"
@@ -595,19 +591,19 @@ questions:
          description: "The UserID of the user running the application"
          schema:
            type: int
-            default: 0
+            default: 568
        - variable: runAsGroup
          label: "runAsGroup"
          description: The groupID this App of the user running the application"
          schema:
            type: int
-            default: 0
+            default: 568
        - variable: fsGroup
          label: "fsGroup"
          description: "The group that should own ALL storage."
          schema:
            type: int
-            default: 0
+            default: 568
        - variable: supplementalGroups
          label: "supplemental Groups"
          schema:
@@ -628,6 +624,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -669,7 +666,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,25 +5,14 @@ image:
  pullPolicy: IfNotPresent
  tag: version-5.5.12@sha256:9a1f87a8ad38694675390756be9686fe9d8ba941fe1f145641626135c7eb5e4b

+securityContext:
+  readOnlyRootFilesystem: false

 postgresqlImage:
  repository: bitnami/postgresql
  pullPolicy: IfNotPresent
  tag: 13.4.0@sha256:abfb7efd31afc36a8b16aa077bb9dd165c4f635412affef37c7859605fda762c

-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: false
-
-podSecurityContext:
-  runAsUser: 0
-  runAsGroup: 0
-  fsGroup: 0
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
-
 service:
  main:
    ports:
@@ -80,7 +69,6 @@ persistence:
    accessMode: ReadWriteOnce
    size: "100Gi"

-
 # Enabled postgres
 postgresql:
  enabled: true
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.2.9"
+appVersion: 1.2.9
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: FlareSolverr is a proxy server to bypass Cloudflare protection
 home: https://github.com/truechartsapps/tree/master/charts/incubator/flaresolverr
 icon: https://raw.githubusercontent.com/FlareSolverr/FlareSolverr/master/resources/flaresolverr_logo.svg
@@ -19,4 +19,4 @@ name: flaresolverr
 sources:
 - https://github.com/FlareSolverr/FlareSolverr
 - https://hub.docker.com/r/flaresolverr/flaresolverr
-version: 2.0.2
+version: 3.0.0
@@ -86,8 +86,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -192,7 +190,6 @@ questions:
                              max: 65535
                              default: 36060

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -541,8 +538,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -565,7 +560,7 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -616,6 +611,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -657,7 +653,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -14,17 +14,7 @@ image:
  tag: v1.2.9@sha256:6f93f3359a8b2cbd268286ce460ff5ffa79a6f1d8c19097ed49097fbfab6a786

 securityContext:
-  privileged: false
  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"

 # -- environment variables. See more environment variables in the [flaresolverr documentation](https://github.com/FlareSolverr/FlareSolverr#environment-variables).
 # @default -- See below
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "4.6.1"
+appVersion: 4.6.1
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: Flood is a monitoring service for various torrent clients
 home: https://github.com/truechartsapps/tree/master/charts/incubator/flood
 icon: https://raw.githubusercontent.com/jesec/flood/master/flood.svg
@@ -21,4 +21,4 @@ name: flood
 sources:
 - https://github.com/jesec/flood
 - https://hub.docker.com/r/jesec/flood
-version: 2.0.2
+version: 3.0.0
@@ -93,8 +93,6 @@ questions:

 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -199,7 +197,6 @@ questions:
                              max: 65535
                              default: 36061

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -548,8 +545,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -567,12 +562,12 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -623,6 +618,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -664,7 +660,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -13,19 +13,6 @@ image:
  # -- image tag
  tag: v4.6.1@sha256:268dc4b4eff08c6c5563b779a1b41370c5c509ff190fe38886a65f65c4174f85

-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
-
 # -- environment variables. See more environment variables in the [flood documentation] (https://github.com/jesec/flood/blob/v4.6.0/config.ts)
 # Note: The environmental variables are not case sensitive (e.g. FLOOD_OPTION_port=FLOOD_OPTION_PORT).
 # @default -- See below
@@ -41,7 +28,6 @@ service:
      main:
        port: 3000

-
 # -- Configure persistence settings for the chart under this key.
 # @default -- See values.yaml
 persistence:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "0.8.0"
+appVersion: 0.8.0
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: Focalboard is an open source, self-hosted alternative to Trello, Notion,
  and Asana.
 home: https://github.com/truechartsapps/tree/master/charts/incubator/focalboard
@@ -22,4 +22,4 @@ sources:
 - https://www.focalboard.com/
 - https://github.com/mattermost/focalboard
 - https://github.com/FlipEnergy/container-images/blob/main/focalboard
-version: 2.0.2
+version: 3.0.0
@@ -86,8 +86,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -192,7 +190,6 @@ questions:
                              max: 65535
                              default: 36049

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -541,8 +538,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -565,7 +560,7 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -616,6 +611,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -657,7 +653,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -14,17 +14,7 @@ image:
  tag: v0.8.0@sha256:c8a81de85722b1d8ce728222cd5b77ea9f8e4ca33c91787a8a3eb0a49f6fa432

 securityContext:
-  privileged: false
  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"

 # -- environment variables. See more environment variables in the [image entrypoint script](https://github.com/FlipEnergy/container-images/blob/main/focalboard/entrypoint.sh)
 # @default -- See below
@@ -41,7 +31,6 @@ service:
      main:
        port: 8000

-
 # -- Configure persistence settings for the chart under this key.
 # @default -- See values.yaml
 persistence:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "3.0.23"
+appVersion: 3.0.23
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: OpenSource Radius implementation
 home: https://www.openldap.org
@@ -24,4 +24,4 @@ sources:
 - https://hub.docker.com/r/freeradius/freeradius-server/
 - https://freeradius.org/
 type: application
-version: 2.0.2
+version: 3.0.0
@@ -78,11 +78,8 @@ questions:
            type: string
            default: "002"

-
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -282,7 +279,6 @@ questions:
                              min: 9000
                              max: 65535

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -475,7 +471,6 @@ questions:

 # Include{persistenceList}

-
 # Include{ingressList}

  - variable: securityContext
@@ -498,13 +493,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false

+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -546,7 +586,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,6 +5,14 @@ image:
  pullPolicy: IfNotPresent
  tag: v3.0.23@sha256:21454da0a4f4950dd9b97e82de5b56556fdf2bf38f60ae427852b74a2622c972

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 service:
  main:
    ports:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.18.1"
+appVersion: 1.18.1
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: FreshRSS is a self-hosted RSS feed aggregator
 home: https://github.com/truecharts/apps/tree/master/charts/incubator/freshrss
@@ -21,4 +21,4 @@ sources:
 - https://github.com/FreshRSS/FreshRSS
 - https://hub.docker.com/r/linuxserver/freshrss
 type: application
-version: 7.0.3
+version: 8.0.0
@@ -98,8 +98,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -204,7 +202,6 @@ questions:
                              max: 65535
                              default: 36029

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -554,8 +551,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  - variable: securityContext
    group: "Security and Permissions"
@@ -577,12 +572,56 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -624,7 +663,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,6 +5,14 @@ image:
  pullPolicy: IfNotPresent
  tag: version-1.18.1@sha256:08fbb9de9f6c0292fc4334375ae0e7b7c618a0dac2a946306f57c64e9508e6b1

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 service:
  main:
    ports:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "0.8.8"
+appVersion: 0.8.8
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Gaps searches through your Plex Server or local folders for all movies,
  then queries for known movies in the same collection.
@@ -22,4 +22,4 @@ name: gaps
 sources:
 - https://github.com/JasonHHouse/gaps
 type: application
-version: 7.0.2
+version: 8.0.0
@@ -86,8 +86,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -541,8 +539,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -565,7 +561,7 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -657,7 +653,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -6,17 +6,7 @@ image:
  tag: v0.8.8@sha256:2e4b3b4e677be68b947517b0077aec719db8c382dad2952421b746060bbd6513

 securityContext:
-  privileged: false
  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"

 service:
  main:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "0.13.1"
+appVersion: 0.13.1
 dependencies:
 - name: common
  repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: Music streaming server / subsonic server API implementation
 home: https://github.com/truechartsapps/tree/master/charts/incubator/gonic
 icon: https://raw.githubusercontent.com/sentriz/gonic/master/.github/logo.png
@@ -19,4 +19,4 @@ name: gonic
 sources:
 - https://github.com/sentriz/gonic
 - https://hub.docker.com/r/sentriz/gonic
-version: 2.0.2
+version: 3.0.0
@@ -86,8 +86,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -192,7 +190,6 @@ questions:
                              max: 65535
                              default: 36062

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -541,8 +538,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -560,12 +555,12 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -595,7 +590,7 @@ questions:
          description: "The group that should own ALL storage."
          schema:
            type: int
-            default: 0
+            default: 568
        - variable: supplementalGroups
          label: "supplemental Groups"
          schema:
@@ -657,7 +652,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -14,17 +14,11 @@ image:
  tag: v0.13.1@sha256:14d01b4a1a90991097656975d0c8643a755323961bc5b5c657a5c96372024d5c

 securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
  runAsNonRoot: false

 podSecurityContext:
  runAsUser: 0
  runAsGroup: 0
-  fsGroup: 0
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"

 # -- environment variables. See more environment variables in the [gonic documentation](https://github.com/sentriz/gonic#configuration-options)
 # @default -- See below
@@ -43,7 +37,6 @@ service:
      main:
        port: 80

-
 # -- Configure persistence settings for the chart under this key.
 # @default -- See values.yaml
 persistence:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "3.1.1"
+appVersion: 3.1.1
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: ERP beyond your fridge - grocy is a web-based self-hosted groceries &
  household management solution for your home
@@ -20,4 +20,4 @@ name: grocy
 sources:
 - https://github.com/grocy/grocy
 type: application
-version: 7.0.3
+version: 8.0.0
@@ -98,8 +98,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -553,8 +551,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}
  - variable: securityContext
    group: "Security and Permissions"
@@ -576,12 +572,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false
+
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -623,7 +665,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -5,6 +5,14 @@ image:
  tag: version-v3.1.1@sha256:26537103c844e83316d64c4c42f11ea2225f878930c590d1c9048b49ad902188
  pullPolicy: IfNotPresent

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 service:
  main:
    ports:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.24.1"
+appVersion: 1.24.1
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: HandBrake is a tool for converting video from nearly any format to a
  selection of modern, widely supported codecs.
@@ -27,4 +27,4 @@ sources:
 - https://hub.docker.com/r/jlesage/handbrake/
 - https://handbrake.fr/
 type: application
-version: 7.0.2
+version: 8.0.0
@@ -171,8 +171,6 @@ questions:
                  required: true
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -374,7 +372,6 @@ questions:
                              max: 65535
                              default: 36003

-
  - variable: serviceexpert
    group: "Networking and Services"
    label: "Show Expert Config"
@@ -745,12 +742,58 @@ questions:
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
            type: boolean
            default: false
+
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -3,6 +3,14 @@ image:
  tag: v1.24.1@sha256:465f3116359c0b40497f0f2249cb1326047208d2aa70c0822df73e3d6e49eee7
  pullPolicy: IfNotPresent

+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 service:
  main:
    ports:
@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "latest"
+appVersion: latest
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 description: Simple text sharing
 home: https://github.com/truecharts/apps/tree/master/charts/incubator/haste
 icon: https://raw.githubusercontent.com/nicholaswilde/helm-charts/main/images/haste.png
@@ -21,4 +21,4 @@ name: haste-server
 sources:
 - https://github.com/seejohnrun/haste-server
 - https://github.com/k8s-at-home/container-images
-version: 2.0.2
+version: 3.0.0
@@ -97,8 +97,6 @@ questions:
            default: "002"
 # Include{containerConfig}

-
-
  - variable: service
    group: "Networking and Services"
    label: "Configure Service(s)"
@@ -553,8 +551,6 @@ questions:
                                  schema:
                                    type: string

-
-
 # Include{ingressList}

  - variable: securityContext
@@ -572,12 +568,12 @@ questions:
          label: "ReadOnly Root Filesystem"
          schema:
            type: boolean
-            default: false
+            default: true
        - variable: allowPrivilegeEscalation
          label: "Allow Privilege Escalation"
          schema:
            type: boolean
-            default: true
+            default: false
        - variable: runAsNonRoot
          label: "runAsNonRoot"
          schema:
@@ -602,6 +598,12 @@ questions:
          schema:
            type: int
            default: 568
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
        - variable: supplementalGroups
          label: "supplemental Groups"
          schema:
@@ -622,6 +624,7 @@ questions:
                description: "OnRootMismatch"
              - value: "Always"
                description: "Always"
+
  - variable: resources
    group: "Resources and Devices"
    label: ""
@@ -663,7 +666,6 @@ questions:
                  default: "50Mi"
                  valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'

-
  - variable: autoscaling
    group: "Resources and Devices"
    label: "(Advanced) Horizontal Pod Autoscaler"
@@ -13,19 +13,6 @@ image:
  # -- image tag
  tag: latest@sha256:827aa2f2389d94a522e333080fa8cbc0e0a487c5681173caca785b3b6b9e5b01

-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
-
 # -- environment variables. See [image docs](https://github.com/seejohnrun/haste-server) for more details.
 # @default -- See below
 env:
--- a/Show More
+++ b/Show More