(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps

* Add default common securityContext to all apps

* Adjust securityContext defaults in questions.yaml, according to values.yaml

* Add default common podSecurityContext to all apps

* Clean whitespace

* Clean more whitespace

* Adjust podSecurityContext defaults in questions.yaml, according to values.yaml

* fix pgadmin

Co-authored-by: Stavros kois <s.kois@outlook.com>

charts/stable/pgadmin/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "5.7"
+appVersion: '5.7'
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Web-Based postgresql database management utility
 home: https://github.com/truecharts/apps/tree/master/charts/stable/pgadmin
@@ -24,4 +24,4 @@ name: pgadmin
 sources:
 - https://www.pgadmin.org/
 type: application
-version: 2.0.2
+version: 3.0.0

charts/stable/pgadmin/SCALE/questions.yaml

@@ -110,8 +110,6 @@ questions:
             default: ""
 # Include{containerConfig}
 
-
-
   - variable: service
     group: "Networking and Services"
     label: "Configure Service(s)"
@@ -216,8 +214,6 @@ questions:
                               max: 65535
                               default: 36093
 
-
-
   - variable: serviceexpert
     group: "Networking and Services"
     label: "Show Expert Config"
@@ -567,8 +563,6 @@ questions:
                                   schema:
                                     type: string
 
-
-
 # Include{ingressList}
 
   - variable: securityContext
@@ -591,7 +585,7 @@ questions:
           label: "Allow Privilege Escalation"
           schema:
             type: boolean
-            default: true
+            default: false
         - variable: runAsNonRoot
           label: "runAsNonRoot"
           schema:
@@ -604,6 +598,18 @@ questions:
     schema:
       type: dict
       attrs:
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
         - variable: fsGroup
           label: "fsGroup"
           description: "The group that should own ALL storage."
@@ -630,6 +636,7 @@ questions:
                 description: "OnRootMismatch"
               - value: "Always"
                 description: "Always"
+
   - variable: resources
     group: "Resources and Devices"
     label: ""
@@ -671,7 +678,6 @@ questions:
                   default: "50Mi"
                   valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'
 
-
   - variable: autoscaling
     group: "Resources and Devices"
     label: "(Advanced) Horizontal Pod Autoscaler"

charts/stable/pgadmin/values.yaml

@@ -6,17 +6,13 @@ image:
   tag: 5.7@sha256:64475197fc11cb8169de7e59cd4ea15872b3edafe22f87ea7bc23ba7f00bbe96
 
 securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
   runAsNonRoot: false
+  readOnlyRootFilesystem: false
 
 podSecurityContext:
   runAsUser: 0
   runAsGroup: 0
   fsGroup: 5050
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
 
 service:
   main: