(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps

* Add default common securityContext to all apps

* Adjust securityContext defaults in questions.yaml, according to values.yaml

* Add default common podSecurityContext to all apps

* Clean whitespace

* Clean more whitespace

* Adjust podSecurityContext defaults in questions.yaml, according to values.yaml

* fix pgadmin

Co-authored-by: Stavros kois <s.kois@outlook.com>
This commit is contained in:
Kjeld Schouten-Lebbing
2021-09-26 20:05:21 +02:00
committed by GitHub
co-authored by Stavros kois
parent fe03d574fc
commit acf510ea13
314 changed files with 2675 additions and 3091 deletions
@@ -0,0 +1,7 @@
<a name="teamspeak3-0.0.3"></a>
### [teamspeak3-0.0.3](https://github.com/truecharts/apps/compare/teamspeak3-0.0.2...teamspeak3-0.0.3) (2021-09-21)
#### Chore
* update non-major deps helm releases ([#1014](https://github.com/truecharts/apps/issues/1014))
+3
View File
@@ -0,0 +1,3 @@
categories:
- voice
icon_url: https://raw.githubusercontent.com/docker-library/docs/618191cf82de051ff6661c3c8b82cfca1b663972/teamspeak/logo.png
@@ -0,0 +1,16 @@
##
# This file contains Values.yaml content that gets added to the output of questions.yaml
# It's ONLY meant for content that the user is NOT expected to change.
# Example: Everything under "image" is not included in questions.yaml but is included here.
##
image:
repository: teamspeak
tag: 3.13.6@sha256:a88d61887cbfa78012ce8bf69e6fad5988d853b7b72a9483000b1af8a6083ff8
pullPolicy: IfNotPresent
##
# Most other defaults are set in questions.yaml
# For other options please refer to the wiki, default_values.yaml or the common library chart
##
@@ -0,0 +1,728 @@
# Include{groups}
questions:
# Portal
- variable: portal
group: "Container Image"
label: "Configure Portal Button"
schema:
type: dict
hidden: true
attrs:
- variable: enabled
label: "Enable"
description: "enable the portal button"
schema:
hidden: true
editable: false
type: boolean
default: false
- variable: controller
group: "Controller"
label: ""
schema:
type: dict
attrs:
- variable: type
description: "Please specify type of workload to deploy"
label: "(Advanced) Controller Type"
schema:
type: string
default: "deployment"
required: true
enum:
- value: "deployment"
description: "Deployment"
- value: "statefulset"
description: "Statefulset"
- value: "daemonset"
description: "Daemonset"
- variable: replicas
description: "Number of desired pod replicas"
label: "Desired Replicas"
schema:
type: int
default: 1
required: true
- variable: strategy
description: "Please specify type of workload to deploy"
label: "(Advanced) Update Strategy"
schema:
type: string
default: "Recreate"
required: true
enum:
- value: "Recreate"
description: "Recreate: Kill existing pods before creating new ones"
- value: "RollingUpdate"
description: "RollingUpdate: Create new pods and then kill old ones"
- value: "OnDelete"
description: "(Legacy) OnDelete: ignore .spec.template changes"
# Include{controllerExpert}
- variable: env
group: "Container Configuration"
label: "Image Environment"
schema:
type: dict
attrs:
- variable: TZ
label: "Timezone"
schema:
type: string
default: "Etc/UTC"
$ref:
- "definitions/timezone"
- variable: TS3SERVER_LICENSE
label: "TS3SERVER_LICENSE"
description: "Accept TS3SERVER LICENSE"
schema:
hidden: true
editable: false
type: string
default: "accept"
# Include{containerConfig}
- variable: service
group: "Networking and Services"
label: "Configure Service(s)"
schema:
type: dict
attrs:
- variable: main
label: "Server Query Service"
description: "The server query service of teamspeak3"
schema:
type: dict
attrs:
- variable: enabled
label: "Enable the service"
schema:
type: boolean
default: true
hidden: true
- variable: type
label: "Service Type"
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
schema:
type: string
default: "NodePort"
enum:
- value: "NodePort"
description: "NodePort"
- value: "ClusterIP"
description: "ClusterIP"
- value: "LoadBalancer"
description: "LoadBalancer"
- variable: loadBalancerIP
label: "LoadBalancer IP"
description: "LoadBalancerIP"
schema:
show_if: [["type", "=", "LoadBalancer"]]
type: string
default: ""
- variable: externalIPs
label: "External IP's"
description: "External IP's"
schema:
show_if: [["type", "=", "LoadBalancer"]]
type: list
default: []
items:
- variable: externalIP
label: "External IP"
schema:
type: string
- variable: ports
label: "Service's Port(s) Configuration"
schema:
type: dict
attrs:
- variable: main
label: "Server Query Service Port Configuration"
schema:
type: dict
attrs:
- variable: enabled
label: "Enable the port"
schema:
type: boolean
default: true
hidden: true
- variable: protocol
label: "Port Type"
schema:
type: string
default: "TCP"
enum:
- value: HTTP
description: "HTTP"
- value: "HTTPS"
description: "HTTPS"
- value: TCP
description: "TCP"
- value: "UDP"
description: "UDP"
- variable: targetPort
label: "Target Port"
description: "This port exposes the container port on the service"
schema:
type: int
default: 10011
editable: false
hidden: true
- variable: port
label: "Container Port"
schema:
type: int
default: 10011
editable: true
required: true
- variable: nodePort
label: "Node Port (Optional)"
description: "This port gets exposed to the node. Only considered when service type is NodePort"
schema:
type: int
min: 9000
max: 65535
default: 36104
- variable: voice
label: "Voice Service"
description: "The voice service of teamspeak3"
schema:
type: dict
attrs:
- variable: enabled
label: "Enable the service"
schema:
type: boolean
default: true
hidden: true
- variable: type
label: "Service Type"
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
schema:
type: string
default: "NodePort"
enum:
- value: "NodePort"
description: "NodePort"
- value: "ClusterIP"
description: "ClusterIP"
- value: "LoadBalancer"
description: "LoadBalancer"
- variable: loadBalancerIP
label: "LoadBalancer IP"
description: "LoadBalancerIP"
schema:
show_if: [["type", "=", "LoadBalancer"]]
type: string
default: ""
- variable: externalIPs
label: "External IP's"
description: "External IP's"
schema:
show_if: [["type", "=", "LoadBalancer"]]
type: list
default: []
items:
- variable: externalIP
label: "External IP"
schema:
type: string
- variable: ports
label: "Service's Port(s) Configuration"
schema:
type: dict
attrs:
- variable: voice
label: "Voice Service Port Configuration"
schema:
type: dict
attrs:
- variable: enabled
label: "Enable the port"
schema:
type: boolean
default: true
hidden: true
- variable: protocol
label: "Port Type"
schema:
type: string
default: "UDP"
enum:
- value: HTTP
description: "HTTP"
- value: "HTTPS"
description: "HTTPS"
- value: TCP
description: "TCP"
- value: "UDP"
description: "UDP"
- variable: targetPort
label: "Target Port"
description: "This port exposes the container port on the service"
schema:
type: int
default: 9987
editable: false
hidden: true
- variable: port
label: "Container Port"
schema:
type: int
default: 9987
editable: true
required: true
- variable: nodePort
label: "Node Port (Optional)"
description: "This port gets exposed to the node. Only considered when service type is NodePort"
schema:
type: int
min: 9000
max: 65535
default: 36105
- variable: files
label: "Server File Transport Service"
description: "The file transport service of teamspeak3"
schema:
type: dict
attrs:
- variable: enabled
label: "Enable the service"
schema:
type: boolean
default: true
hidden: false
- variable: type
label: "Service Type"
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
schema:
type: string
default: "NodePort"
enum:
- value: "NodePort"
description: "NodePort"
- value: "ClusterIP"
description: "ClusterIP"
- value: "LoadBalancer"
description: "LoadBalancer"
- variable: loadBalancerIP
label: "LoadBalancer IP"
description: "LoadBalancerIP"
schema:
show_if: [["type", "=", "LoadBalancer"]]
type: string
default: ""
- variable: externalIPs
label: "External IP's"
description: "External IP's"
schema:
show_if: [["type", "=", "LoadBalancer"]]
type: list
default: []
items:
- variable: externalIP
label: "External IP"
schema:
type: string
- variable: ports
label: "Service's Port(s) Configuration"
schema:
type: dict
attrs:
- variable: files
label: "Server File Transport Service Port Configuration"
schema:
type: dict
attrs:
- variable: enabled
label: "Enable the port"
schema:
type: boolean
default: true
hidden: true
- variable: protocol
label: "Port Type"
schema:
type: string
default: "TCP"
enum:
- value: HTTP
description: "HTTP"
- value: "HTTPS"
description: "HTTPS"
- value: TCP
description: "TCP"
- value: "UDP"
description: "UDP"
- variable: targetPort
label: "Target Port"
description: "This port exposes the container port on the service"
schema:
type: int
default: 30033
editable: false
hidden: true
- variable: port
label: "Container Port"
schema:
type: int
default: 30033
editable: true
required: true
- variable: nodePort
label: "Node Port (Optional)"
description: "This port gets exposed to the node. Only considered when service type is NodePort"
schema:
type: int
min: 9000
max: 65535
default: 36106
- variable: serviceexpert
group: "Networking and Services"
label: "Show Expert Config"
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: hostNetwork
group: "Networking and Services"
label: "Host-Networking (Complicated)"
schema:
type: boolean
default: false
- variable: dnsPolicy
group: "Networking and Services"
label: "dnsPolicy"
schema:
type: string
default: ""
enum:
- value: ""
description: "Default"
- value: "ClusterFirst"
description: "ClusterFirst"
- value: "ClusterFirstWithHostNet"
description: "ClusterFirstWithHostNet"
- value: "None"
description: "None"
- variable: dnsConfig
label: "DNS Configuration"
group: "Networking and Services"
description: "Specify custom DNS configuration which will be applied to the pod"
schema:
type: dict
attrs:
- variable: nameservers
label: "Nameservers"
schema:
default: []
type: list
items:
- variable: nameserver
label: "Nameserver"
schema:
type: string
- variable: options
label: "options"
schema:
default: []
type: list
items:
- variable: option
label: "Option Entry"
schema:
type: string
- variable: searches
label: "Searches"
schema:
default: []
type: list
items:
- variable: search
label: "Search Entry"
schema:
type: string
# Include{serviceList}
- variable: persistence
label: "Integrated Persistent Storage"
group: "Storage and Persistence"
schema:
type: dict
attrs:
- variable: data
label: "App Config Storage"
description: "Stores the Application Configuration."
schema:
type: dict
attrs:
- variable: enabled
label: "Enable the storage"
schema:
type: boolean
default: true
- variable: type
label: "(Advanced) Type of Storage"
description: "Sets the persistence type"
schema:
type: string
default: "pvc"
enum:
- value: "pvc"
description: "pvc"
- value: "emptyDir"
description: "emptyDir"
- value: "hostPath"
description: "hostPath"
- variable: storageClass
label: "(Advanced) storageClass"
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
schema:
show_if: [["type", "=", "pvc"]]
type: string
default: "SCALE-ZFS"
- variable: setPermissions
label: "Automatic Permissions"
description: "Automatically set permissions on install"
schema:
show_if: [["type", "=", "hostPath"]]
type: boolean
default: true
- variable: readOnly
label: "readOnly"
schema:
type: boolean
default: false
- variable: hostPath
label: "hostPath"
description: "Path inside the container the storage is mounted"
schema:
show_if: [["type", "=", "hostPath"]]
type: hostpath
- variable: hostPathType
label: "hostPath Type"
schema:
show_if: [["type", "=", "hostPath"]]
type: string
default: ""
enum:
- value: ""
description: "Default"
- value: "DirectoryOrCreate"
description: "DirectoryOrCreate"
- value: "Directory"
description: "Directory"
- value: "FileOrCreate"
description: "FileOrCreate"
- value: "File"
description: "File"
- value: "Socket"
description: "Socket"
- value: "CharDevice"
description: "CharDevice"
- value: "BlockDevice"
description: "BlockDevice"
- variable: mountPath
label: "mountPath"
description: "Path inside the container the storage is mounted"
schema:
type: string
default: "/var/ts3server/"
hidden: true
- variable: medium
label: "EmptyDir Medium"
schema:
show_if: [["type", "=", "emptyDir"]]
type: string
default: ""
enum:
- value: ""
description: "Default"
- value: "Memory"
description: "Memory"
- variable: accessMode
label: "Access Mode (Advanced)"
description: "Allow or disallow multiple PVC's writhing to the same PV"
schema:
show_if: [["type", "=", "pvc"]]
type: string
default: "ReadWriteOnce"
enum:
- value: "ReadWriteOnce"
description: "ReadWriteOnce"
- value: "ReadOnlyMany"
description: "ReadOnlyMany"
- value: "ReadWriteMany"
description: "ReadWriteMany"
- variable: size
label: "Size quotum of storage"
schema:
show_if: [["type", "=", "pvc"]]
type: string
default: "100Gi"
# Include{persistenceList}
# Include{ingressList}
- variable: securityContext
group: "Security and Permissions"
label: "Security Context"
schema:
type: dict
attrs:
- variable: privileged
label: "Privileged mode"
schema:
type: boolean
default: false
- variable: readOnlyRootFilesystem
label: "ReadOnly Root Filesystem"
schema:
type: boolean
default: false
- variable: allowPrivilegeEscalation
label: "Allow Privilege Escalation"
schema:
type: boolean
default: false
- variable: runAsNonRoot
label: "runAsNonRoot"
schema:
type: boolean
default: false
- variable: podSecurityContext
group: "Security and Permissions"
label: "Pod Security Context"
schema:
type: dict
attrs:
- variable: runAsUser
label: "runAsUser"
description: "The UserID of the user running the application"
schema:
type: int
default: 0
- variable: runAsGroup
label: "runAsGroup"
description: The groupID this App of the user running the application"
schema:
type: int
default: 0
- variable: fsGroup
label: "fsGroup"
description: "The group that should own ALL storage."
schema:
type: int
default: 568
- variable: supplementalGroups
label: "supplemental Groups"
schema:
type: list
default: []
items:
- variable: supplementalGroupsEntry
label: "supplemental Group"
schema:
type: int
- variable: fsGroupChangePolicy
label: "When should we take ownership?"
schema:
type: string
default: "OnRootMismatch"
enum:
- value: "OnRootMismatch"
description: "OnRootMismatch"
- value: "Always"
description: "Always"
- variable: resources
group: "Resources and Devices"
label: ""
schema:
type: dict
attrs:
- variable: limits
label: "Advanced Limit Resource Consumption"
schema:
type: dict
attrs:
- variable: cpu
label: "CPU"
schema:
type: string
default: "2000m"
valid_chars: '^([0-9]+)(\.[0-9]?|m?)$'
- variable: memory
label: "Memory RAM"
schema:
type: string
default: "2Gi"
valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'
- variable: requests
label: "Advanced Request minimum resources required"
schema:
type: dict
attrs:
- variable: cpu
label: "CPU"
schema:
type: string
default: "10m"
valid_chars: '^([0-9]+)(\.[0-9]?|m?)$'
- variable: memory
label: "Memory RAM"
schema:
type: string
default: "50Mi"
valid_chars: '^([0-9.]+)([EPTGMK]i?|[EPTGMK]?|e[0-9]+)$'
- variable: autoscaling
group: "Resources and Devices"
label: "(Advanced) Horizontal Pod Autoscaler"
schema:
type: dict
attrs:
- variable: enabled
label: "enabled"
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: target
label: "Target"
description: "deployment name, defaults to main deployment"
schema:
type: string
default: ""
- variable: minReplicas
label: "Minimum Replicas"
schema:
type: int
default: 1
- variable: maxReplicas
label: "Maximum Replicas"
schema:
type: int
default: 5
- variable: targetCPUUtilizationPercentage
label: "Target CPU Utilization Percentage"
schema:
type: int
default: 80
- variable: targetMemoryUtilizationPercentage
label: "Target Memory Utilization Percentage"
schema:
type: int
default: 80
# Include{addons}