(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps

* Add default common securityContext to all apps

* Adjust securityContext defaults in questions.yaml, according to values.yaml

* Add default common podSecurityContext to all apps

* Clean whitespace

* Clean more whitespace

* Adjust podSecurityContext defaults in questions.yaml, according to values.yaml

* fix pgadmin

Co-authored-by: Stavros kois <s.kois@outlook.com>

charts/stable/k8s-gateway/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "0.1.8"
+appVersion: 0.1.8
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: A Helm chart for the k8s_gateway CoreDNS plugin
 home: https://github.com/truecharts/apps/tree/master/charts/stable/k8s-gateway
@@ -20,4 +20,4 @@ name: k8s-gateway
 sources:
 - https://github.com/ori-edge/k8s_gateway
 type: application
-version: 2.0.2
+version: 3.0.0

charts/stable/k8s-gateway/SCALE/questions.yaml

@@ -168,8 +168,6 @@ questions:
                               required: true
                               default: ""
 
-
-
   - variable: service
     group: "Networking and Services"
     label: "Configure Service(s)"
@@ -344,11 +342,8 @@ questions:
 
 # Include{serviceList}
 
-
 # Include{persistenceList}
 
-
-
   - variable: securityContext
     group: "Security and Permissions"
     label: "Security Context"
@@ -364,18 +359,63 @@ questions:
           label: "ReadOnly Root Filesystem"
           schema:
             type: boolean
-            default: false
+            default: true
         - variable: allowPrivilegeEscalation
           label: "Allow Privilege Escalation"
           schema:
             type: boolean
-            default: true
+            default: false
         - variable: runAsNonRoot
           label: "runAsNonRoot"
           schema:
             type: boolean
             default: false
 
+  - variable: podSecurityContext
+    group: "Security and Permissions"
+    label: "Pod Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
+        - variable: fsGroupChangePolicy
+          label: "When should we take ownership?"
+          schema:
+            type: string
+            default: "OnRootMismatch"
+            enum:
+              - value: "OnRootMismatch"
+                description: "OnRootMismatch"
+              - value: "Always"
+                description: "Always"
+
   - variable: resources
     group: "Resources and Devices"
     label: "Resource Limits"
@@ -417,7 +457,6 @@ questions:
                   default: "50Mi"
                   valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'
 
-
   - variable: autoscaling
     group: "Resources and Devices"
     label: "(Advanced) Horizontal Pod Autoscaler"

charts/stable/k8s-gateway/values.yaml

@@ -5,12 +5,18 @@ image:
   pullPolicy: IfNotPresent
   tag: v0.1.8@sha256:4937e28bb5dc4bd9c700a72d28e50d43929b4a9e8f64b4a306346426e6ed01e2
 
+securityContext:
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 args: ["-conf", "/etc/coredns/Corefile"]
 
 # -- TTL for non-apex responses (in seconds)
 ttl: 300
 
-
 # -- Limit what kind of resources to watch, e.g. watchedResources: ["Ingress"]
 watchedResources: []
 
@@ -101,7 +107,6 @@ probes:
       successThreshold: 1
       failureThreshold: 5
 
-
   startup:
     custom: true
     spec: