(feat) Standardise and Harden default app securitycontext (#1028)

* Apply security hardened defaults to values.yaml for all apps

* Add default common securityContext to all apps

* Adjust securityContext defaults in questions.yaml, according to values.yaml

* Add default common podSecurityContext to all apps

* Clean whitespace

* Clean more whitespace

* Adjust podSecurityContext defaults in questions.yaml, according to values.yaml

* fix pgadmin

Co-authored-by: Stavros kois <s.kois@outlook.com>

charts/stable/traefik/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "2.5.3"
+appVersion: 2.5.3
 dependencies:
 - name: common
-  repository: https://truecharts.org/
-  version: 7.0.14
+  repository: https://truecharts.org
+  version: 8.0.7
 deprecated: false
 description: Test App for Traefik
 home: https://github.com/truecharts/apps/tree/master/charts/stable/traefik
@@ -22,4 +22,4 @@ sources:
 - https://github.com/traefik/traefik-helm-chart
 - https://traefik.io/
 type: application
-version: 8.0.4
+version: 9.0.0

charts/stable/traefik/SCALE/ix_values.yaml

@@ -79,8 +79,6 @@ tlsOptions:
       - TLS_CHACHA20_POLY1305_SHA256
 
 
-
-
 probes:
   # -- Liveness probe configuration
   # @default -- See below

charts/stable/traefik/SCALE/questions.yaml

@@ -66,7 +66,6 @@ questions:
                 description: "(Legacy) OnDelete: ignore .spec.template changes"
 # Include{controllerExpert}
 
-
   - variable: env
     group: "Container Configuration"
     label: "Image Environment"
@@ -282,7 +281,6 @@ questions:
                                     required: true
                                     default: ""
 
-
         - variable: forwardAuth
           label: "forwardAuth"
           schema:
@@ -517,9 +515,6 @@ questions:
                                     default: ""
 
 
-
-
-
   - variable: service
     group: "Networking and Services"
     label: "Configure Service Entrypoint"
@@ -993,7 +988,7 @@ questions:
           label: "runAsNonRoot"
           schema:
             type: boolean
-            default: false
+            default: true
 
   - variable: podSecurityContext
     group: "Security and Permissions"
@@ -1040,7 +1035,6 @@ questions:
               - value: "Always"
                 description: "Always"
 
-
   - variable: resources
     group: "Resources and Devices"
     label: ""

charts/stable/traefik/values.yaml

@@ -5,23 +5,6 @@ image:
   tag: v2.5.3@sha256:f40028d9771cb29a35392b4cbdd655625596a319b915061e306c503059d0b6f4
   pullPolicy: IfNotPresent
 
-# -- Set the container security context
-# To run the container with ports below 1024 this will need to be adjust to run as root
-securityContext:
-  capabilities:
-    drop: [ALL]
-  privileged: false
-  readOnlyRootFilesystem: true
-  allowPrivilegeEscalation: false
-  runAsNonRoot: false
-
-podSecurityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  fsGroup: 568
-  supplementalGroups: []
-  fsGroupChangePolicy: "OnRootMismatch"
-
 # -- Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x
 ingressClass:
   # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12
@@ -65,7 +48,6 @@ providers:
       # By default this Traefik service
       # pathOverride: ""
 
-
 # -- Logs
 # https://docs.traefik.io/observability/logs/
 logs:
@@ -132,7 +114,6 @@ additionalArguments:
   - "--serverstransport.insecureskipverify=true"
   - "--providers.kubernetesingress.allowexternalnameservices=true"
 
-
 # -- TLS Options to be created as TLSOption CRDs
 # https://doc.traefik.io/traefik/https/tls/#tls-options
 # Example:
@@ -200,7 +181,6 @@ service:
   udp:
     enabled: false
 
-
 probes:
   # -- Liveness probe configuration
   # @default -- See below
@@ -212,7 +192,6 @@ probes:
     # @default -- "/"
     path: "/ping"
 
-
   # -- Redainess probe configuration
   # @default -- See below
   readiness:
@@ -223,7 +202,6 @@ probes:
     # @default -- "/"
     path: "/ping"
 
-
   # -- Startup probe configuration
   # @default -- See below
   startup:
@@ -234,7 +212,6 @@ probes:
     # @default -- "/"
     path: "/ping"
 
-
 # -- Whether Role Based Access Control objects like roles and rolebindings should be created
 rbac:
   enabled: true
@@ -283,7 +260,6 @@ rbac:
         - list
         - watch
 
-
 # -- The service account the pods will use to interact with the Kubernetes API
 serviceAccount:
   enabled: true