(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps

* Add default common securityContext to all apps

* Adjust securityContext defaults in questions.yaml, according to values.yaml

* Add default common podSecurityContext to all apps

* Clean whitespace

* Clean more whitespace

* Adjust podSecurityContext defaults in questions.yaml, according to values.yaml

* fix pgadmin

Co-authored-by: Stavros kois <s.kois@outlook.com>

charts/stable/postgresql/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "13.4.0"
+appVersion: 13.4.0
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: PostgresSQL
 home: https://github.com/truecharts/apps/tree/master/stable/postgres
@@ -25,4 +25,4 @@ name: postgresql
 sources:
 - https://www.postgresql.org/
 type: application
-version: 2.2.5
+version: 3.0.0

charts/stable/postgresql/SCALE/ix_values.yaml

@@ -16,7 +16,7 @@ initContainers:
     securityContext:
       runAsUser: 0
       privileged: true
-      allowPrivilegeEscalation: true
+
       runAsNonRoot: false
     command:
       - /bin/sh

charts/stable/postgresql/SCALE/questions.yaml

@@ -96,8 +96,6 @@ questions:
       default: ""
       required: true
 
-
-
   - variable: service
     group: "Networking and Services"
     label: "Configure Service(s)"
@@ -202,7 +200,6 @@ questions:
                               max: 65535
                               default: 36009
 
-
   - variable: serviceexpert
     group: "Networking and Services"
     label: "Show Expert Config"
@@ -615,7 +612,6 @@ questions:
 
 # Include{persistenceList}
 
-
 # Include{ingressList}
 
   - variable: securityContext
@@ -638,12 +634,12 @@ questions:
           label: "Allow Privilege Escalation"
           schema:
             type: boolean
-            default: true
+            default: false
         - variable: runAsNonRoot
           label: "runAsNonRoot"
           schema:
             type: boolean
-            default: false
+            default: true
 
   - variable: podSecurityContext
     group: "Security and Permissions"
@@ -662,7 +658,7 @@ questions:
           description: The groupID this App of the user running the application"
           schema:
             type: int
-            default: 0
+            default: 568
         - variable: fsGroup
           label: "fsGroup"
           description: "The group that should own ALL storage."
@@ -689,6 +685,7 @@ questions:
                 description: "OnRootMismatch"
               - value: "Always"
                 description: "Always"
+
   - variable: resources
     group: "Resources and Devices"
     label: ""
@@ -730,7 +727,6 @@ questions:
                   default: "50Mi"
                   valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'
 
-
   - variable: autoscaling
     group: "Resources and Devices"
     label: "(Advanced) Horizontal Pod Autoscaler"

charts/stable/postgresql/values.yaml

@@ -3,6 +3,8 @@ image:
   pullPolicy: IfNotPresent
   tag: 13.4.0@sha256:abfb7efd31afc36a8b16aa077bb9dd165c4f635412affef37c7859605fda762c
 
+securityContext:
+  readOnlyRootFilesystem: false
 
 service:
   main:
@@ -20,7 +22,7 @@ initContainers:
     securityContext:
       runAsUser: 0
       privileged: true
-      allowPrivilegeEscalation: true
+
       runAsNonRoot: false
     command:
       - /bin/sh
@@ -38,19 +40,8 @@ initContainers:
       - name: data
         mountPath: /bitnami/postgresql
 
-
-securityContext:
-  privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
-  runAsNonRoot: false
-
 podSecurityContext:
-  runAsUser: 568
   runAsGroup: 0
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
 
 persistence:
   db:
@@ -77,7 +68,6 @@ postgresqlUsername: "test"
 postgresqlDatabase: "test"
 existingSecret: ""
 
-
 envValueFrom:
   POSTGRES_PASSWORD:
     secretKeyRef: