(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps

* Add default common securityContext to all apps

* Adjust securityContext defaults in questions.yaml, according to values.yaml

* Add default common podSecurityContext to all apps

* Clean whitespace

* Clean more whitespace

* Adjust podSecurityContext defaults in questions.yaml, according to values.yaml

* fix pgadmin

Co-authored-by: Stavros kois <s.kois@outlook.com>

charts/stable/nextcloud/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "22.1.1"
+appVersion: 22.1.1
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 - condition: postgresql.enabled
   name: postgresql
   repository: https://truecharts.org/
@@ -33,4 +33,4 @@ sources:
 - https://github.com/nextcloud/docker
 - https://github.com/nextcloud/helm
 type: application
-version: 5.0.6
+version: 6.0.0

charts/stable/nextcloud/SCALE/questions.yaml

@@ -113,11 +113,8 @@ questions:
             $ref:
               - "definitions/nodeIP"
 
-
 # Include{containerConfig}
 
-
-
   - variable: service
     group: "Networking and Services"
     label: "Configure Service(s)"
@@ -587,18 +584,68 @@ questions:
                                     type: string
 
 # Include{ingressList}
+
+  - variable: securityContext
+    group: "Security and Permissions"
+    label: "Security Context"
+    schema:
+      type: dict
+      attrs:
+        - variable: privileged
+          label: "Privileged mode"
+          schema:
+            type: boolean
+            default: false
+        - variable: readOnlyRootFilesystem
+          label: "ReadOnly Root Filesystem"
+          schema:
+            type: boolean
+            default: false
+        - variable: allowPrivilegeEscalation
+          label: "Allow Privilege Escalation"
+          schema:
+            type: boolean
+            default: false
+        - variable: runAsNonRoot
+          label: "runAsNonRoot"
+          schema:
+            type: boolean
+            default: false
+
   - variable: podSecurityContext
     group: "Security and Permissions"
     label: "Pod Security Context"
     schema:
       type: dict
       attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
         - variable: fsGroup
           label: "fsGroup"
           description: "The group that should own ALL storage."
           schema:
             type: int
             default: 33
+        - variable: supplementalGroups
+          label: "supplemental Groups"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: supplementalGroupsEntry
+                label: "supplemental Group"
+                schema:
+                  type: int
         - variable: fsGroupChangePolicy
           label: "When should we take ownership?"
           schema:
@@ -609,6 +656,7 @@ questions:
                 description: "OnRootMismatch"
               - value: "Always"
                 description: "Always"
+
   - variable: resources
     group: "Resources and Devices"
     label: ""
@@ -650,8 +698,6 @@ questions:
                   default: "50Mi"
                   valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'
 
-
-
   - variable: autoscaling
     group: "Resources and Devices"
     label: "(Advanced) Horizontal Pod Autoscaler"

charts/stable/nextcloud/values.yaml

@@ -5,12 +5,14 @@ image:
   pullPolicy: IfNotPresent
   tag: 22.1.1@sha256:99d94124b2024c9f7f38dc12144a92bc0d68d110bcfd374169ebb7e8df0adf8e
 
+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
 podSecurityContext:
   runAsUser: 0
   runAsGroup: 0
   fsGroup: 33
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
 
 postgresqlImage:
   repository: bitnami/postgresql
@@ -148,7 +150,6 @@ probes:
       timeoutSeconds: 2
       failureThreshold: 5
 
-
 ## Cronjob to execute Nextcloud background tasks
 ## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
 ##