(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps

* Add default common securityContext to all apps

* Adjust securityContext defaults in questions.yaml, according to values.yaml

* Add default common podSecurityContext to all apps

* Clean whitespace

* Clean more whitespace

* Adjust podSecurityContext defaults in questions.yaml, according to values.yaml

* fix pgadmin

Co-authored-by: Stavros kois <s.kois@outlook.com>

charts/stable/plex/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.24.3.503"
+appVersion: 1.24.3.503
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Plex Media Server
 home: https://github.com/truecharts/apps/tree/master/charts/stable/plex
@@ -22,4 +22,4 @@ maintainers:
 name: plex
 sources: null
 type: application
-version: 6.0.3
+version: 7.0.0

charts/stable/plex/SCALE/questions.yaml

@@ -105,8 +105,6 @@ questions:
             default: "002"
 # Include{containerConfig}
 
-
-
   - variable: service
     group: "Networking and Services"
     label: "Configure Service(s)"
@@ -211,7 +209,6 @@ questions:
                               max: 65535
                               default: 32400
 
-
   - variable: serviceexpert
     group: "Networking and Services"
     label: "Show Expert Config"
@@ -560,8 +557,6 @@ questions:
                                   schema:
                                     type: string
 
-
-
 # Include{ingressList}
   # Specify GPU configuration
   - variable: scaleGPU
@@ -588,12 +583,12 @@ questions:
           label: "ReadOnly Root Filesystem"
           schema:
             type: boolean
-            default: false
+            default: true
         - variable: allowPrivilegeEscalation
           label: "Allow Privilege Escalation"
           schema:
             type: boolean
-            default: true
+            default: false
         - variable: runAsNonRoot
           label: "runAsNonRoot"
           schema:
@@ -644,6 +639,7 @@ questions:
                 description: "OnRootMismatch"
               - value: "Always"
                 description: "Always"
+
   - variable: resources
     group: "Resources and Devices"
     label: ""
@@ -685,7 +681,6 @@ questions:
                   default: "50Mi"
                   valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'
 
-
   - variable: autoscaling
     group: "Resources and Devices"
     label: "(Advanced) Horizontal Pod Autoscaler"

charts/stable/plex/values.yaml

@@ -5,20 +5,6 @@ image:
   pullPolicy: IfNotPresent
   tag: v1.24.3.5033-757abe6b4@sha256:23a65cc78a0aab38f26a60d38f65eefcb2db7dc4e5d99c4ac7ad8f722c677654
 
-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: true
-
-# 44=video 107=render
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: [44, 107]
-  fsGroupChangePolicy: "OnRootMismatch"
-
 service:
   main:
     ports: