(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps

* Add default common securityContext to all apps

* Adjust securityContext defaults in questions.yaml, according to values.yaml

* Add default common podSecurityContext to all apps

* Clean whitespace

* Clean more whitespace

* Adjust podSecurityContext defaults in questions.yaml, according to values.yaml

* fix pgadmin

Co-authored-by: Stavros kois <s.kois@outlook.com>

charts/stable/flood/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "4.6.1"
+appVersion: 4.6.1
 dependencies:
 - name: common
   repository: https://truecharts.org
-  version: 7.0.14
+  version: 8.0.7
 description: Flood is a monitoring service for various torrent clients
 home: https://github.com/truechartsapps/tree/master/charts/incubator/flood
 icon: https://raw.githubusercontent.com/jesec/flood/master/flood.svg
@@ -21,4 +21,4 @@ name: flood
 sources:
 - https://github.com/jesec/flood
 - https://hub.docker.com/r/jesec/flood
-version: 2.0.2
+version: 3.0.0

charts/stable/flood/SCALE/questions.yaml

@@ -93,8 +93,6 @@ questions:
 
 # Include{containerConfig}
 
-
-
   - variable: service
     group: "Networking and Services"
     label: "Configure Service(s)"
@@ -199,7 +197,6 @@ questions:
                               max: 65535
                               default: 36061
 
-
   - variable: serviceexpert
     group: "Networking and Services"
     label: "Show Expert Config"
@@ -548,8 +545,6 @@ questions:
                                   schema:
                                     type: string
 
-
-
 # Include{ingressList}
 
   - variable: securityContext
@@ -567,12 +562,12 @@ questions:
           label: "ReadOnly Root Filesystem"
           schema:
             type: boolean
-            default: false
+            default: true
         - variable: allowPrivilegeEscalation
           label: "Allow Privilege Escalation"
           schema:
             type: boolean
-            default: true
+            default: false
         - variable: runAsNonRoot
           label: "runAsNonRoot"
           schema:
@@ -623,6 +618,7 @@ questions:
                 description: "OnRootMismatch"
               - value: "Always"
                 description: "Always"
+
   - variable: resources
     group: "Resources and Devices"
     label: ""
@@ -664,7 +660,6 @@ questions:
                   default: "50Mi"
                   valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'
 
-
   - variable: autoscaling
     group: "Resources and Devices"
     label: "(Advanced) Horizontal Pod Autoscaler"

charts/stable/flood/values.yaml

@@ -13,19 +13,6 @@ image:
   # -- image tag
   tag: v4.6.1@sha256:268dc4b4eff08c6c5563b779a1b41370c5c509ff190fe38886a65f65c4174f85
 
-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
-
 # -- environment variables. See more environment variables in the [flood documentation] (https://github.com/jesec/flood/blob/v4.6.0/config.ts)
 # Note: The environmental variables are not case sensitive (e.g. FLOOD_OPTION_port=FLOOD_OPTION_PORT).
 # @default -- See below
@@ -41,7 +28,6 @@ service:
       main:
         port: 3000
 
-
 # -- Configure persistence settings for the chart under this key.
 # @default -- See values.yaml
 persistence: