fix(wikijs): Run as non root and add probes (#2114)

* fix(wikijs): Run as non root and add probes

* add admin portal

charts/stable/wikijs/questions.yaml

@@ -7,6 +7,15 @@ portals:
       - "$kubernetes-resource_configmap_portal_host"
     ports:
       - "$kubernetes-resource_configmap_portal_port"
+    path: "/"
+  admin:
+    protocols:
+      - "$kubernetes-resource_configmap_portal_protocol"
+    host:
+      - "$kubernetes-resource_configmap_portal_host"
+    ports:
+      - "$kubernetes-resource_configmap_portal_port"
+    path: "/a/dashboard"
 questions:
   - variable: portal
     group: "Container Image"
@@ -355,7 +364,7 @@ questions:
                 label: "ReadOnly Root Filesystem"
                 schema:
                   type: boolean
-                  default: false
+                  default: true
               - variable: allowPrivilegeEscalation
                 label: "Allow Privilege Escalation"
                 schema:
@@ -365,7 +374,7 @@ questions:
                 label: "runAsNonRoot"
                 schema:
                   type: boolean
-                  default: false
+                  default: true
 # Include{securityContextAdvanced}
 
   - variable: podSecurityContext
@@ -380,13 +389,13 @@ questions:
           description: "The UserID of the user running the application"
           schema:
             type: int
-            default: 0
+            default: 568
         - variable: runAsGroup
           label: "runAsGroup"
           description: The groupID this App of the user running the application"
           schema:
             type: int
-            default: 0
+            default: 568
         - variable: fsGroup
           label: "fsGroup"
           description: "The group that should own ALL storage."

charts/stable/wikijs/values.yaml

@@ -1,23 +1,9 @@
 image:
-  # -- image repository
   repository: tccr.io/truecharts/wikijs
-  # -- image tag
   tag: v2.5.276@sha256:5caedcd71492d09be8272d754eb93c7b3eabfc8db30cf71ff00b2fd809549954
-  # -- image pull policy
   pullPolicy: IfNotPresent
 
-securityContext:
-  readOnlyRootFilesystem: false
-  runAsNonRoot: false
-
-podSecurityContext:
-  runAsUser: 0
-  runAsGroup: 0
-
-# -- environment variables. See [image docs](https://docs.linuxserver.io/images/docker-wikijs#environment-variables-e) for more details.
-# @default -- See below
 env:
-  # -- Set the container timezone
   DB_TYPE: "postgres"
   DB_NAME: "{{ .Values.postgresql.postgresqlDatabase }}"
   DB_USER: "{{ .Values.postgresql.postgresqlUsername }}"
@@ -33,8 +19,14 @@ envValueFrom:
       name: dbcreds
       key: plainhost
 
-# -- Configures service settings for the chart.
+probes:
-# @default -- See values.yaml
+  liveness:
+    path: "/healthz"
+  readiness:
+    path: "/healthz"
+  startup:
+    path: "/healthz"
+
 service:
   main:
     ports:
@@ -42,9 +34,17 @@ service:
         port: 10045
         targetPort: 3000
 
-# Enabled postgres
 postgresql:
   enabled: true
   existingSecret: "dbcreds"
   postgresqlUsername: wikijs
   postgresqlDatabase: wikijs
+
+
+# /wiki/data is a temporary dir. Without mounting as emptyDir it's only writable by root.
+# https://docs.requarks.io/en/install/config#data-paths
+persistence:
+  wikicache:
+    enabled: true
+    mountPath: "/wiki/data/"
+    type: emptyDir