fix(element): Update Element Web to v1.11.59 with widget sync fix and NeoBoard to 1.14.0

Signed-off-by: Milton Moura <miltonmoura@gmail.com>

.gitlab-ci.yml

@@ -3,15 +3,14 @@
 ---
 include:
   - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "main"
+    ref: "v2.3.2"
     file:
       - "ci/common/automr.yml"
       - "ci/common/lint.yml"
       - "ci/release-automation/semantic-release.yml"
+  - local: "/.gitlab/generate/generate-docs.yml"
   - project: "${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
     file: "gitlab/environments.yaml"
-    rules:
-      - if: "$INCLUDE_ENVIRONMENTS_ENABLED != 'false'"
   - local: "/.gitlab/lint/lint-opendesk.yml"
     rules:
       - if: "$JOB_OPENDESK_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'"
@@ -196,7 +195,7 @@ env-start:
     name: "${NAMESPACE}"
     on_stop: "env-stop"
   extends: ".deploy-common"
-  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
   rules:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
@@ -209,8 +208,8 @@ env-start:
       kubectl create secret
       --namespace "${NAMESPACE}"
       docker-registry external-registry
-      --docker-server "external-registry.souvap-univention.de"
-      --docker-username sovereign-workplace
+      --docker-server "${EXTERNAL_REGISTRY}"
+      --docker-username "${EXTERNAL_REGISTRY_USERNAME}"
       --docker-password "${EXTERNAL_REGISTRY_PASSWORD}"
       --dry-run=client -o yaml | kubectl apply -f -
   stage: "env"
@@ -377,7 +376,7 @@ env-stop:
   environment:
     name: "${NAMESPACE}"
     action: "stop"
-  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
   needs: []
   rules:
     - if: >
@@ -447,7 +446,10 @@ run-tests:
 avscan-prepare:
   stage: ".pre"
   rules:
-    - if: "$JOB_AVSCAN_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: >
+          $JOB_AVSCAN_ENABLED != 'false' &&
+          $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+          $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "always"
     - when: "never"
   image: "external-registry.souvap-univention.de/docker-remote/mikefarah/yq"
@@ -480,7 +482,8 @@ avscan-prepare:
       yq '.images
       | with_entries(.key |= "scan-" + .)
       | .[].extends=".container-clamav"
-      | with(.[]; .variables.CONTAINER_IMAGE = .repository | .variables.CONTAINER_TAG = .tag | .variables.CONTAINER_REGISTRY = .registry)
+      | with(.[]; .variables.CONTAINER_IMAGE = .repository
+      | .variables.CONTAINER_TAG = .tag | .variables.CONTAINER_REGISTRY = .registry)
       | del(.[].repository)
       | del(.[].tag)
       | del(.[].registry)'
@@ -493,7 +496,10 @@ avscan-prepare:
 avscan-start:
   stage: "scan"
   rules:
-    - if: "$JOB_AVSCAN_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "always"
     - when: "never"
   trigger:
@@ -506,7 +512,10 @@ generate-release-assets:
   stage: "generate-release-assets"
   image: "registry.souvap-univention.de/souvap/tooling/images/ansible:4.10.0"
   rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "on_success"
     - when: "never"
   script:
@@ -527,7 +536,7 @@ generate-release-assets:
   variables:
     ASSET_GENERATOR_REPO_PATH: "bmi/opendesk/tooling/opendesk-asset-generator"
 
-# Declare .environments which is in environments repository and only loaded when INCLUDE_ENVIRONMENTS_ENABLED not false.
+# Declare .environments which is in environments repository. In case it is not available
 # 'cache' is used because job must contain at least one key, so cache is just a dummy key.
 .environments:
   cache: {}
@@ -558,14 +567,20 @@ reuse-linter:
 
 generate-release-version:
   rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false'"
+    - if: >
+        $JOB_RELEASE_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "on_success"
 
 release:
   dependencies:
     - "generate-release-assets"
   rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "on_success"
   script:
     - >
@@ -581,7 +596,7 @@ release:
     - |
       echo -e "\n[INFO] Writing data to helm value file..."
       cat <<EOF >helmfile/environments/default/global.generated.yaml
-      # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+      # SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
       # SPDX-License-Identifier: Apache-2.0
       ---
       global:
@@ -612,7 +627,8 @@ release:
               "CHANGELOG.md",
               "charts/**/README.md",
               "helmfile/environments/default/global.generated.yaml",
-              ".kyverno/kyverno-test.yaml"
+              ".kyverno/kyverno-test.yaml",
+              "docs"
             ],
             "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
           }]
@@ -622,4 +638,5 @@ release:
     - "semantic-release"
   needs:
     - "generate-release-assets"
+    - "generate-docs"
 ...

.gitlab/common/common.yml

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+variables:
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.4.3\
+    @sha256:4630299fddf4248af1ad04528f0435d78f5b2694a154c99fe72b960260a7be61"
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.4\
+    @sha256:386e84e2c85c33537479e4bb1e1fe744c9cce5e87bcb9a3a384dcdc1727c19c0"
+
+.common:
+  cache: {}
+  needs: []
+  tags: []
+...

.gitlab/generate/generate-common.yml

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+include:
+  - local: "/.gitlab/common/common.yml"
+
+.generate-common:
+  extends: ".common"
+  stage: ".post"
+  tags: []
+...

.gitlab/generate/generate-docs.yml

@@ -0,0 +1,20 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+include:
+  - local: "/.gitlab/generate/generate-common.yml"
+
+generate-docs:
+  cache:
+    - key: "generate-docs-${CI_COMMIT_REF_SLUG}"
+      paths:
+        - "${CI_PROJECT_DIR}/docs"
+      policy: "push"
+  extends: ".generate-common"
+  image: "${OPENDESK_CI_CLI_IMAGE}"
+  rules:
+    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+      when: "on_success"
+  script:
+    - "node /app/src/index.js generate-docs -d ${CI_PROJECT_DIR}"
+...

.gitlab/lint/lint-common.yml

@@ -1,17 +1,11 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.2.0\
-    @sha256:b36b1fc8a19605306dffef2c919c2a6bf5a3099e8a42ecb39a416394410b75d7"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.1\
-    @sha256:5b1bd85cc73ba0cede1f37d79fa7eeebffa653afa7944406eea9287c29a7769a"
+include:
+  - local: "/.gitlab/common/common.yml"
 
 .lint-common:
-  cache: {}
-  needs: []
+  extends: ".common"
   stage: "lint"
-  tags:
-    - "docker"
 
 ...

.gitlab/lint/lint-kyverno.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 include:
@@ -27,7 +27,14 @@ lint-kyverno:
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${APP}"
     - "helmfile template -e test --include-needs > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
-    - "node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests -d ${CI_PROJECT_DIR}/.kyverno -t required ${APP}"
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
+      -d ${CI_PROJECT_DIR}/.kyverno
+      -t required
+      -s manifest
+      -f opendesk.yaml
+      --skip-tests true
+      ${APP}
     - "node /app/opendesk-ci-cli/src/index.js filter-for-kinds -f ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
     - "cd ${CI_PROJECT_DIR}/.kyverno"
     - "kyverno test ."

.kyverno/_apps.yaml

@@ -1,276 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-pod:
-  - resource: "mariadb"
-    kind: "StatefulSet"
-    app: "services"
-  - resource: "postgresql"
-    kind: "StatefulSet"
-    app: "services"
-  - resource: "clamav-simple"
-    kind: "StatefulSet"
-    app: "services"
-  - resource: "redis-master"
-    kind: "StatefulSet"
-    app: "services"
-  - resource: "ums-store-dav"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-ldap-server"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-ldap-notifier"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-portal-listener"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-selfservice-listener"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-provisioning-nats"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-guardian-management-api"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-guardian-management-ui"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-guardian-authorization-api"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-open-policy-agent"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "open-xchange-core-mw-default"
-    kind: "StatefulSet"
-    app: "open-xchange"
-  - resource: "jitsi-prosody"
-    kind: "StatefulSet"
-    app: "jitsi"
-  - resource: "opendesk-synapse"
-    kind: "StatefulSet"
-    app: "element"
-  - resource: "xwiki"
-    kind: "StatefulSet"
-    app: "xwiki"
-  - resource: "ox-connector"
-    kind: "StatefulSet"
-    app: "provisioning"
-  - resource: "minio"
-    kind: "Deployment"
-    app: "services"
-  - resource: "memcached"
-    kind: "Deployment"
-    app: "services"
-  - resource: "postfix"
-    kind: "Deployment"
-    app: "services"
-  - resource: "ums-keycloak"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-stack-gateway"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-udm-rest-api"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-portal-server"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-notifications-api"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-portal-frontend"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-umc-gateway"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-umc-server"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-provisioning-nats-box"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-keycloak-extensions-handler"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-keycloak-extensions-proxy"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "intercom-service"
-    kind: "Deployment"
-    app: "intercom-service"
-  - resource: "dovecot"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-documentconverter"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-guidedtours"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-imageconverter"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-gotenberg"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-ui-middleware"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-ui-middleware-updater"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-ui"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-user-guide"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-guard-ui"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-nextcloud-integration-ui"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-public-sector-ui"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "opendesk-nextcloud-apache2"
-    kind: "Deployment"
-    app: "nextcloud"
-  - resource: "opendesk-nextcloud-exporter"
-    kind: "Deployment"
-    app: "nextcloud"
-  - resource: "opendesk-nextcloud-php"
-    kind: "Deployment"
-    app: "nextcloud"
-  - resource: "collabora"
-    kind: "Deployment"
-    app: "collabora"
-  - resource: "jitsi-jibri"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "jitsi-jicofo"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "jitsi-jvb"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "jitsi-web"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "jitsi-opendesk-jitsi-keycloak-adapter"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "opendesk-element"
-    kind: "Deployment"
-    app: "element"
-  - resource: "opendesk-well-known"
-    kind: "Deployment"
-    app: "element"
-  - resource: "opendesk-synapse-web"
-    kind: "Deployment"
-    app: "element"
-  - resource: "opendesk-matrix-user-verification-service"
-    kind: "Deployment"
-    app: "element"
-  - resource: "matrix-neoboard-widget"
-    kind: "Deployment"
-    app: "element"
-  - resource: "matrix-neochoice-widget"
-    kind: "Deployment"
-    app: "element"
-  - resource: "matrix-neodatefix-widget"
-    kind: "Deployment"
-    app: "element"
-  - resource: "matrix-neodatefix-bot"
-    kind: "Deployment"
-    app: "element"
-  - resource: "openproject-web"
-    kind: "Deployment"
-    app: "openproject"
-  - resource: "openproject-worker"
-    kind: "Deployment"
-    app: "openproject"
-  - resource: "mariadb-bootstrap"
-    kind: "Job"
-    app: "services"
-  - resource: "postgresql-bootstrap"
-    kind: "Job"
-    app: "services"
-  - resource: "minio-provisioning"
-    kind: "Job"
-    app: "services"
-  - resource: "ums-stack-data-ums-1"
-    kind: "Job"
-    app: "univention-management-stack"
-  - resource: "ums-stack-data-swp-1"
-    kind: "Job"
-    app: "univention-management-stack"
-  - resource: "ums-keycloak-bootstrap-bootstrap-1"
-    kind: "Job"
-    app: "univention-management-stack"
-  - resource: "opendesk-keycloak-bootstrap-bootstrap-1"
-    kind: "Job"
-    app: "univention-management-stack"
-  - resource: "opendesk-open-xchange-bootstrap"
-    kind: "Job"
-    app: "open-xchange"
-  - resource: "opendesk-nextcloud-management-1"
-    kind: "Job"
-    app: "nextcloud"
-  - resource: "jitsi-opendesk-jitsi"
-    kind: "Job"
-    app: "jitsi"
-  - resource: "opendesk-matrix-user-verification-service-bootstrap"
-    kind: "Job"
-    app: "element"
-  - resource: "matrix-neodatefix-bot-bootstrap"
-    kind: "Job"
-    app: "element"
-  - resource: "opendesk-openproject-bootstrap-bootstrap-1"
-    kind: "Job"
-    app: "openproject-bootstrap"
-#  # Has timestamp in resource name - not supported yet.
-#  - resource: "openproject-seeder-*"
-#    kind: "Job"
-#  - resource: "ums-store-dav-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-udm-rest-api-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-portal-server-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-notifications-api-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-portal-frontend-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-provisioning-nats-test-request-reply"
-#    kind: "Pod"
-#  - resource: "ums-provisioning-provisioning-api-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-core-guidedtours-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-gotenberg-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-core-ui-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-core-user-guide-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-guard-ui-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-nextcloud-integration-ui-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-public-sector-ui-test-connection"
-#    kind: "Pod"
-#  - resource: "jitsi-prosody-test-connection"
-#    kind: "Pod"
-#  - resource: "jitsi-web-test-connection"
-#    kind: "Pod"
-#  - resource: "openproject-test-connection"
-#    kind: "Pod"
-...

.kyverno/policies/_policies.yaml

@@ -1,55 +1,292 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 pod:
   - name: "require-tag-and-digest"
     rule: "require-tag-and-digest"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "disallow-default-serviceaccount"
-    rule: "require-sa"
+    rule: "disallow-default-serviceAccountName"
     type: "required"
-  - name: "require-imagepullsecrets"
-    rule: "require-imagepullsecrets"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-imagepullsecrets"
+    rule: "template-imagePullSecrets"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "disallow-latest-tag"
-    rule: "validate-image-tag"
+    rule: "disallow-latest-tag"
     type: "required"
-  - name: "require-imagepullpolicy-always"
-    rule: "require-imagepullpolicy-always"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-latest-tag"
+    rule: "require-image-tag-or-digest"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-imagepullpolicy"
+    rule: "require-imagePullPolicy"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-health-and-liveness-check"
     rule: "require-health-and-liveness-check"
     type: "required"
-    excludeKinds:
-      - "Job"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-storage"
+    rule: "template-storageClassName-pod"
+    type: "required"
+    kinds:
+      - "PersistentVolumeClaim"
+  - name: "template-storage"
+    rule: "template-storageClassName-pvc"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+  - name: "template-storage"
+    rule: "template-requests-storage-pod"
+    type: "required"
+    kinds:
+      - "PersistentVolumeClaim"
+  - name: "template-storage"
+    rule: "template-requests-storage-pvc"
+    type: "required"
+    kinds:
+      - "StatefulSet"
   - name: "require-requests-limits"
     rule: "validate-resources"
     type: "required"
-  - name: "restrict-image-registries"
-    rule: "validate-registries"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-image-registries"
+    rule: "template-image-registries"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-ro-rootfs"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-no-privilege-escalation"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-all-capabilities-dropped"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-no-privileged"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-run-as-user"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-run-as-group"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-seccomp-profile"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-run-as-non-root"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "require-empty-seLinuxOptions"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "require-default-procMount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "restrict-sysctls"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-docker-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-containerd-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-crio-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-dockerd-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-namespaces"
+    rule: "disallow-host-namespaces"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-path"
+    rule: "disallow-host-path"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-ports"
+    rule: "disallow-host-ports"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-process"
+    rule: "disallow-host-process"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-ingress"
+    rule: "template-ingressClassName"
+    type: "required"
+    kinds:
+      - "Ingress"
+  - name: "template-ingress"
+    rule: "template-tls-secretName"
+    type: "required"
+    kinds:
+      - "Ingress"
+  - name: "template-replicas"
+    rule: "template-replicas"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
 ...

.kyverno/policies/disallow-container-sock-mounts.yaml

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-container-sock-mounts"
+  annotations:
+    policies.kyverno.io/title: "Disallow CRI socket mounts"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Container daemon socket bind mounts allow access to the container engine on the node.
+      This access can be used for privilege escalation and to manage containers outside of Kubernetes, and hence should
+      not be allowed.
+      This policy validates that the sockets used for CRI engines Docker, Containerd, and CRI-O are not used.
+      In addition to or replacement of this policy, preventing users from mounting the parent directories
+      (/var/run and /var) may be necessary to completely prevent socket bind mounts.
+spec:
+  background: true
+  rules:
+    - name: "validate-docker-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Docker Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/docker.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-containerd-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Containerd Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/containerd/containerd.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-crio-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the CRI-O Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/crio/crio.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-dockerd-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Docker CRI socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/cri-dockerd.sock"
+          - spec:
+              =(volumes):

.kyverno/policies/disallow-default-serviceaccount.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "disallow-default-serviceaccount"
+  annotations:
+    policies.kyverno.io/title: "Prevent default ServiceAccount privilege escalation"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Kubernetes automatically creates a ServiceAccount object named default for every namespace in your cluster.
+      These default service accounts get no permissions by default.
+      Accidental or intended assignment of permissions on the default service account results in elevated permissions
+      for all pods with default service account assigned.
+      This risk can be mitigated by creating a custom ServiceAccount for each application or reduce the risk by disable
+      auto mounting the default service account into the pod.
 spec:
   background: true
   rules:
@@ -12,11 +22,15 @@ spec:
         resources:
           kinds:
             - "Pod"
-      name: "require-sa"
+      name: "disallow-default-serviceAccountName"
       validate:
-        message: "serviceAccountName must be set to anything other than 'default'."
-        pattern:
-          spec:
-            serviceAccountName: "!default"
+        message: >-
+          Field serviceAccountName must be set to anything other than 'default'.
+          When serviceAccountName is 'default' then automountServiceAccountToken must set to 'false' .
+        anyPattern:
+          - spec:
+              serviceAccountName: "!default"
+          - spec:
+              automountServiceAccountToken: "false"
   validationFailureAction: "audit"
 ...

.kyverno/policies/disallow-host-namespaces.yaml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-namespaces"
+  annotations:
+    policies.kyverno.io/title: "Disallow Host Namespaces"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access
+      to shared information and can be used to elevate privileges.
+      Pods should not be allowed access to host namespaces.
+      This policy ensures fields which make use of these host namespaces are unset or set to `false`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-namespaces"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
+          spec.hostIPC, and spec.hostPID must be unset or set to `false`.
+        pattern:
+          spec:
+            =(hostPID): "false"
+            =(hostIPC): "false"
+            =(hostNetwork): "false"

.kyverno/policies/disallow-host-path.yaml

@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-path"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostPath"
+    policies.kyverno.io/subject: "Pod,Volume"
+    policies.kyverno.io/description: >-
+      HostPath volumes let Pods use host directories and volumes in containers.
+      Using host resources can be used to access shared data or escalate privileges and should not be allowed.
+      This policy ensures no hostPath volumes are in use.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-path"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.
+        anyPattern:
+          - spec:
+              =(volumes):
+                - X(hostPath): "null"
+          - spec:
+              =(volumes):

.kyverno/policies/disallow-host-ports.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-ports"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostPorts"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Access to host ports allows potential snooping of network traffic and should not be allowed, or at minimum
+      restricted to a known list. This policy ensures the `hostPort` field is unset or set to `0`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-ports"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort
+          , spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
+          must either be unset or set to `0`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(ports):
+                  - =(hostPort): 0
+            =(initContainers):
+              - =(ports):
+                  - =(hostPort): 0
+            containers:
+              - =(ports):
+                  - =(hostPort): 0

.kyverno/policies/disallow-host-process.yaml

@@ -0,0 +1,45 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-process"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostProcess"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node.
+      Privileged access to the host is disallowed in the baseline policy.
+      HostProcess pods are an alpha feature as of Kubernetes v1.22.
+      This policy ensures the `hostProcess` field, if present, is set to `false`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-process"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess,
+          spec.containers[*].securityContext.windowsOptions.hostProcess,
+          spec.initContainers[*].securityContext.windowsOptions.hostProcess, and
+          spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must either be undefined or set to
+          `false`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"
+            =(initContainers):
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"
+            containers:
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"

.kyverno/policies/disallow-latest-tag.yaml

@@ -1,10 +1,18 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "disallow-latest-tag"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      The ':latest' tag is mutable and can lead to unexpected errors if the image changes.
+      A best practice is to use an immutable tag that maps to a specific version of an application Pod.
+      This policy validates that the image specifies a tag and that it is not called `latest`.
+      Defining no image tag or digest result in the container engine retrieving the latest tag.
 spec:
   background: true
   rules:
@@ -12,7 +20,7 @@ spec:
         resources:
           kinds:
             - "Pod"
-      name: "validate-image-tag"
+      name: "disallow-latest-tag"
       validate:
         message: "Using a mutable image tag e.g. 'latest' is not allowed."
         pattern:
@@ -23,5 +31,27 @@ spec:
               - image: "!*:latest"
             containers:
               - image: "!*:latest"
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "require-image-tag-or-digest"
+      validate:
+        message: "A image tag or a digest is required, otherwise latest tag is chosen."
+        anyPattern:
+          - spec:
+              =(ephemeralContainers):
+                - image: "*:*"
+              =(initContainers):
+                - image: "*:*"
+              containers:
+                - image: "*:*"
+          - spec:
+              =(ephemeralContainers):
+                - image: "*@*"
+              =(initContainers):
+                - image: "*@*"
+              containers:
+                - image: "*@*"
   validationFailureAction: "audit"
 ...

.kyverno/policies/require-containersecuritycontext.yaml

@@ -1,10 +1,16 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-containersecuritycontext"
+  annotations:
+    policies.kyverno.io/title: "ContainerSecurityContext best practices are set."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      The containerSecurityContext is the most important security-related section because it has the highest precedence
+      and restricts the container to its minimal privileges.
 spec:
   background: true
   rules:
@@ -169,5 +175,70 @@ spec:
               - securityContext:
                   runAsNonRoot: true
 
+    - name: "require-empty-seLinuxOptions"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: "SELinux options have to be unset."
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - securityContext:
+                  seLinuxOptions:
+            =(initContainers):
+              - securityContext:
+                  seLinuxOptions:
+            containers:
+              - securityContext:
+                  seLinuxOptions:
+
+    - name: "require-default-procMount"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: >-
+          Changing the proc mount from the default is not allowed. The fields
+          spec.containers[*].securityContext.procMount, spec.initContainers[*].securityContext.procMount,
+          and spec.ephemeralContainers[*].securityContext.procMount must be unset or
+          set to `Default`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(securityContext):
+                  =(procMount): "Default"
+            =(initContainers):
+              - =(securityContext):
+                  =(procMount): "Default"
+            containers:
+              - =(securityContext):
+                  =(procMount): "Default"
+
+    - name: "restrict-sysctls"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: >-
+          Setting additional sysctls above the allowed type is not allowed.
+          The field spec.securityContext.sysctls must be unset or not use any other names
+          than kernel.shm_rmid_forced, net.ipv4.ip_local_port_range,
+          net.ipv4.ip_unprivileged_port_start, net.ipv4.tcp_syncookies and
+          net.ipv4.ping_group_range.
+        pattern:
+          spec:
+            =(securityContext):
+              =(sysctls):
+                - =(name): >-
+                    kernel.shm_rmid_forced |
+                    net.ipv4.ip_local_port_range |
+                    net.ipv4.ip_unprivileged_port_start |
+                    net.ipv4.tcp_syncookies |
+                    net.ipv4.ping_group_range
+
   validationFailureAction: "audit"
 ...

.kyverno/policies/require-health-and-liveness-check.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-health-and-liveness-check"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Liveness and readiness probes need to be configured to correctly manage a Pod's lifecycle during deployments,
+      restarts, and upgrades.
+      For each Pod, a periodic `livenessProbe` is performed by the kubelet to determine if the Pod's containers are
+      running or need to be restarted.
+      A `readinessProbe` is used by Services and Pods to determine if the Pod is ready to receive network traffic.
+      This policy validates that all containers have livenessProbe and readinessProbe defined.
 spec:
   background: true
   rules:
@@ -14,8 +24,9 @@ spec:
             - "Pod"
       name: "require-health-and-liveness-check"
       validate:
-        message: "Liveness and readiness probes are required. spec.containers[*].livenessProbe.periodSeconds
-          must be set to a value greater than 0."
+        message: >-
+          Liveness and readiness probes are required. spec.containers[*].livenessProbe.periodSeconds must be set to a
+          value greater than 0.
         pattern:
           spec:
             containers:

.kyverno/policies/require-imagepullpolicy-always.yaml

@@ -1,40 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-apiVersion: "kyverno.io/v1"
-kind: "ClusterPolicy"
-metadata:
-  name: "require-imagepullpolicy-always"
-spec:
-  background: true
-  rules:
-    - match:
-        resources:
-          kinds:
-            - "Pod"
-      name: "require-imagepullpolicy-always"
-      validate:
-        message: "The imagePullPolicy must be set to `Always` when the tag `latest` is used."
-        anyPattern:
-          - spec:
-              =(ephemeralContainers):
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-              =(initContainers):
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-              containers:
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-          - spec:
-              =(ephemeralContainers):
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-              =(initContainers):
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-              containers:
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-  validationFailureAction: "audit"
-...

.kyverno/policies/require-imagepullpolicy.yaml

@@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "require-imagepullpolicy"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      If the `latest` tag is allowed for images, it is a good idea to have the imagePullPolicy field set to `Always` to
+      ensure later pulls get an updated image in case the latest tag gets updated.
+      This policy validates the imagePullPolicy is set to `Always` when the `latest` tag is specified explicitly or
+      where a tag is not defined at all.
+      Additionally this policy checks if the variable `.Values.global.imagePullPolicy` is used in templates.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "require-imagePullPolicy"
+      validate:
+        message: >-
+          The imagePullPolicy must be set to `Always` when the `latest` tag is used, otherwise the value from
+          `.Values.global.imagePullPolicy` has to be used.
+        anyPattern:
+          - spec:
+              =(ephemeralContainers):
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+              =(initContainers):
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+              containers:
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+          - spec:
+              =(ephemeralContainers):
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+              =(initContainers):
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+              containers:
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+  validationFailureAction: "audit"
+...

.kyverno/policies/require-imagepullsecets.yaml

@@ -1,23 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-apiVersion: "kyverno.io/v1"
-kind: "ClusterPolicy"
-metadata:
-  name: "require-imagepullsecrets"
-spec:
-  background: true
-  rules:
-    - match:
-        resources:
-          kinds:
-            - "Pod"
-      name: "require-imagepullsecrets"
-      validate:
-        message: "ImagePullSecrets are required."
-        pattern:
-          spec:
-            imagePullSecrets:
-              - name: "*"
-  validationFailureAction: "audit"
-...

.kyverno/policies/require-requests-limits.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-requests-limits"
+  annotations:
+    policies.kyverno.io/title: "Require resources cpu/memory request and limits."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      As application workloads share cluster resources, it is important to limit resources requested and consumed by
+      each Pod.
+      It is recommended to require resource requests and limits per Pod, especially for memory and CPU.
+      If a Namespace level request or limit is specified, defaults will automatically be applied to each Pod based on
+      the LimitRange configuration.
+      This policy validates that all containers have specified requests for memory and CPU and a limit for memory.
 spec:
   background: true
   rules:

.kyverno/policies/require-tag-and-digest.yaml

@@ -1,10 +1,18 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-tag-and-digest"
+  annotations:
+    policies.kyverno.io/title: "Require tag and digest for image."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      To ensure that containers are not compromised in container registry by pushing malicious code to the same tag, it
+      is required to reference images by setting a sha256 hashed digest.
+      Setting only the digest is complicated for humans to compare software versions, therefore in openDesk it is
+      required to reference container images by tag and digest.
 spec:
   background: true
   rules:

.kyverno/policies/template-image-registries.yaml

@@ -1,10 +1,16 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
-  name: "restrict-image-registries"
+  name: "template-image-registries"
+  annotations:
+    policies.kyverno.io/title: "Check image registry template"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that a custom external registry can be template to allow downloads from a private registry or
+      cache.
 spec:
   background: true
   rules:
@@ -12,7 +18,7 @@ spec:
         resources:
           kinds:
             - "Pod"
-      name: "validate-registries"
+      name: "template-image-registries"
       validate:
         message: "Unknown image registry."
         pattern:

.kyverno/policies/template-ingress.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-ingress"
+  annotations:
+    policies.kyverno.io/title: "Validate openDesk Ingress templating"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that ingress variables are templated.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Ingress"
+      name: "template-ingressClassName"
+      validate:
+        message: "Verifies that ingressClassName can be customized by `.Values.ingress.ingressClassName` variable."
+        pattern:
+          spec:
+            ingressClassName: "kyverno"
+    - match:
+        resources:
+          kinds:
+            - "Ingress"
+      name: "template-tls-secretName"
+      validate:
+        message: "Verifies that tls.secretName can be customized by `.Values.ingress.tls.secretName` variable."
+        pattern:
+          spec:
+            tls:
+              - secretName: "kyverno-tls"
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-replicas.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-replicas"
+  annotations:
+    policies.kyverno.io/title: "Validate openDesk Pod replicas templating"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that `.Values.replicas.<app>` variables are templated.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Deployment"
+            - "StatefulSet"
+      name: "template-replicas"
+      validate:
+        message: "Verifies that replica count can be customized by `.Values.replicas.<app>` variable."
+        pattern:
+          spec:
+            replicas: 42
+
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-require-imagepullsecets.yaml

@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-imagepullsecrets"
+  annotations:
+    policies.kyverno.io/title: "ImagePullSecrets template variable have to be implemented."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      It is recommended to cache images to ensure continuous image availability during network partitions, rate limiting
+      or registry outages.
+      These caches as well as a company proxy may require authentication which will be provided as ImagePullSecrets.
+      This is a openDesk test to ensure that environment variables are templated in Helmfile deployment.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "template-imagePullSecrets"
+      validate:
+        message: "ImagePullSecrets are required."
+        pattern:
+          spec:
+            imagePullSecrets:
+              - name: "kyverno-test"
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-storage.yaml

@@ -0,0 +1,67 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-storage"
+  annotations:
+    policies.kyverno.io/title: "Validate storageClass and size templates."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy validates if `.Values.persistence.storageClassNames` variables are used in templates and if the size
+      of volumes can be customized by `.Values.persistence.size` variable.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "StatefulSet"
+      name: "template-storageClassName-pod"
+      validate:
+        message: "VolumeClaims inside pods needs to have storageClass set when templated."
+        pattern:
+          spec:
+            (volumeClaimTemplates):
+              - spec:
+                  storageClassName: "kyverno-test"
+    - match:
+        resources:
+          kinds:
+            - "PersistentVolumeClaim"
+      name: "template-storageClassName-pvc"
+      validate:
+        message: "PersistentVolumeClaim needs to have storageClassName set when templated."
+        pattern:
+          spec:
+            storageClassName: "kyverno-test"
+
+    - match:
+        resources:
+          kinds:
+            - "StatefulSet"
+      name: "template-requests-storage-pod"
+      validate:
+        message: "VolumeClaims inside pods needs to have storageClass set when templated."
+        pattern:
+          spec:
+            (volumeClaimTemplates):
+              - spec:
+                  resources:
+                    requests:
+                      storage: "42Gi"
+    - match:
+        resources:
+          kinds:
+            - "PersistentVolumeClaim"
+      name: "template-requests-storage-pvc"
+      validate:
+        message: "PersistentVolumeClaim needs to have storageClassName set when templated."
+        pattern:
+          spec:
+            resources:
+              requests:
+                storage: "42Gi"
+  validationFailureAction: "audit"
+...

CHANGELOG.md

@@ -1,3 +1,65 @@
+## [0.5.78](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.77...v0.5.78) (2024-02-23)
+
+
+### Bug Fixes
+
+* **ci:** Move main development repo OpenCoDE ([43718b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/43718b8da2966b87fab8e206df449c923f6615e7))
+* **ci:** Run release pipeline only on pushes to main ([13dcb00](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13dcb004419b4efd8ded8c25e7afa41d10156be8))
+* **ci:** Update kyverno rules ([d9263c9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d9263c90110df241adaef8d1a5df8e8d8ceda11b))
+* **docs:** Add missing footnote regarding Nubus ([bc6e4f8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc6e4f8e5dcc32cc476de579fd56dbade79b7c31))
+* **nextcloud:** Set admin priviledges for users in central IAM ([a3e415d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a3e415d575ba24b99e741994fb29d0f0cfd11d8a))
+* **univention-management-stack:** Scaling udm-rest-api ([57d0f61](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/57d0f61b2c3e789b72a0098907817c97fee69268))
+* **univention-management-stack:** Set Keycloak CSP header to allow session continuation in admin portal. ([a398e5a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a398e5aaf131c1f00b09e1776d6daf10f2c343ad))
+* **univention-management-stack:** UMS portal-server scalability ([b1b4c28](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b1b4c28618e0eca31b59719e9e1f2db8ecff7f5c))
+* **univention-management-stack:** Univention Portal upstream codefixes version bump ([c2f62f7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c2f62f7c9487b2119b0d3efd98b40c92efb97c5d))
+* **univention-management-stack:** Update provisioning to fix high CPU usage when in idle ([d9c23bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d9c23bdf0b955c0b5e4c82dd1ee785b75ce18a3b))
+
+## [0.5.77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.76...v0.5.77) (2024-02-16)
+
+
+### Bug Fixes
+
+* **ci:** Complete CI var usage for external registry ([3bcdcd0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3bcdcd06b7c4829686f11b8f065ec38829b5a5a6))
+* **ci:** Update openDesk CI Lint to v2.3.1 ([250ef2b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/250ef2bc3fe9047b49b236b606ec3e3fa28e13ce))
+* **collabora:** Add chart validation ([0159902](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01599022f14d447dfdadf390ca9e8e29668dfb07))
+* **collabora:** Bump to 23.05.9.1.1 ([b525a81](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b525a814fc25867c068579d5cbd8d1a993144519))
+* **cryptpad:** Update chart to v0.0.18 ([6f0b1f3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6f0b1f37fc06c40bf537dbaed60f314341211e41))
+* **docs:** Add functional component table referencing the component versions to README.md ([bc7eeb8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc7eeb8c9d3dd19f625d6f7ba94b15eb4b782d20))
+* **docs:** Add generated security-context.md ([d9e07ff](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d9e07ff7bd0e8be090f4fe2c370fa9978c22dfd5))
+* **element:** Change name of neodatefix bot job ([dd535da](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd535daac0bb0e602eefa45e8dc448fd07fbdd33))
+* **element:** Disable e2ee ([ba0824b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ba0824bac30ae1fc43458bdc8c09a143076e874c))
+* **helmfile:** Add additional provisioning components and configuration ([110ff56](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/110ff56f7487e7ac89b1b75c8c63d04e1c2a41c0))
+* **helmfile:** Add seLinuxOptions for all applications ([02d04fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02d04faa2a8d8a0b3bfc179cc8efb3fec086bc70))
+* **helmfile:** Annotations in image.yaml ([7ebbd03](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ebbd03bdcb11abf4e459035c459b74adf8cfcda))
+* **helmfile:** Bump Collabora Chart to 1.11.1 and Image to 23.05.8.4.1 ([d2b1f0b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d2b1f0b07b5ebe4b98b2dc29b916857e28ce5706))
+* **helmfile:** Fix annotations in images.yaml ([acaec3b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/acaec3b8ac6e0ecd58167fca874cd56caa15fa98))
+* **helmfile:** Fix umsPortalFrontend image annotation ([8f83261](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8f832619864504eaa04945a9a79d6790d2ab8a48))
+* **helmfile:** Improve debugging ([56f5e35](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/56f5e35895c712440c1a7d249be672c86fc34eeb))
+* **nextcloud:** Bump openincryptpad to 0.3.3 and disable circles app ([f2b8acf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f2b8acfba85d384ed425779fa52133935e553e86))
+* **nextcloud:** Set backchannel logout url ([c0fc225](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c0fc225349794034feea1d0c05b29068b9a455af))
+* **nextcloud:** Update image, nextcloud apps and chart ([fd2a66f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fd2a66f8f2a987aa71872122267f29aee3d5f22a))
+* **nextcloud:** Update nextcloud image and chart to support upgrades ([5d95e7a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5d95e7ab2a71097d8c6231bff8c3a6aa3b6f163a))
+* **nextcloud:** Update to Nextcloud to v28 ([7c9f38f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7c9f38f06e1f0d000992ecdfd77921d6fc28015c))
+* **open-xchange:** Bump Gotenberg image ([49f126d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/49f126d169759b3e9dd130101e64892822750d7b))
+* **open-xchange:** Dovecot image on OpenCoDE without mirror ([1396071](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/139607186549f7a9a129023f1f72aff82cf36460))
+* **openproject:** Bump version to 13.3.0 ([c2087ef](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c2087efcf95bf2eef19556ba1a1d26b7807021c4))
+* **univention-management-stack:** New device login notifications on first login with 2FA ([ee1a337](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ee1a337ab5dea7001045860eb6a5bee1dfc84219))
+* **univention-management-stack:** Patches not applied to uldap ([2909e1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2909e1d821397797244d7c11c0935a3bbc902bb1))
+* **univention-management-stack:** Support for object-storage icons and portal files ([83ac645](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/83ac645faec748e773dd7940ca0ca1102bd6dff3))
+* **univention-management-stack:** Update NGINX Helm chart to 15.9.3 ([c16c0ac](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c16c0ac7955e64254214d7129ae70d5dd8808743))
+* **univention-management-stack:** Update otterize to allow umc-server communication with memcached ([6c15dc1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6c15dc1d668623ddd95090e321d1bb268e681db5))
+* **xwiki:** Add bottom border to top nav bar to be aligned with the other components ([affa92c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/affa92cde2caa175707f8ae0e8d4adedbdceb608))
+* **xwiki:** Bump XWiki chart to 1.3.0 ([cabee0c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cabee0c9da3a32e180931b3bd490ba8f83aadb79))
+
+## [0.5.76](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.75...v0.5.76) (2024-01-24)
+
+
+### Bug Fixes
+
+* **nextcloud:** Correct indent in monitoring resources ([bea1413](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bea1413b860aa69cab3bb4a9dfb6d8593594cc25))
+* **services:** Monitoring for minio with correct labels and there are no prometheusRule ([af63e5c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/af63e5c18dbd6d7d1e1ebd79ad91c4f994fe7003))
+* **univention-management-stack:** Fix external registry for nats charts ([cbb33b9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cbb33b922d397467d01a9227f3eb18d789cdc39c))
+
 ## [0.5.75](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.74...v0.5.75) (2024-01-24)
 
 

README.md

@@ -5,65 +5,60 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>openDesk Deployment Automation</h1>
 
-openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the "Projektgruppe für
-Aufbau ZenDiS" of Germany's Federal Ministry of the Interior.
-
-It features:
-- Fully integrated Identity Management (Univention)
-- File storage (Nextcloud)
-- Weboffice (Collabora)
-- Videoconference (Nordeck w/ Jitsi)
-- Chat and Collaboration (Element w/ Nordeck)
-- Groupware (OX Appsuite)
-- Wiki (XWiki)
-- Project Management (OpenProject)
-- Notes and Diagrams (Cryptpad)
-
-openDesk integrates these components and is working towards a seamless user experience.
-
-While not all components are perfectly shaped for the execution inside containers, one of the project objectives is to
-align the applications with the best practises regarding container design and operations.
-
-This documentation aims to give you all that is needed to set up your own instance of the openDesk.
-Basic knowledge of Kubernetes and Devops is required though.
-
 <!-- TOC -->
-* [Active development notice](#active-development-notice)
-* [Feedback](#feedback)
+* [Overview](#overview)
+* [Disclaimer](#disclaimer)
 * [Requirements](#requirements)
 * [Getting started](#getting-started)
 * [Advanced customization](#advanced-customization)
 * [Releases](#releases)
 * [Components](#components)
+* [Feedback](#feedback)
 * [License](#license)
 * [Copyright](#copyright)
+* [Footnotes](#footnotes)
 <!-- TOC -->
 
-# Active development notice
+# Overview
+
+openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the "Projektgruppe für
+Aufbau ZenDiS" of Germany's Federal Ministry of the Interior.
+
+openDesk currently features the following functional main components:
+
+| Function             | Functional Component        | Component<br/>Version | Upstream Documentation |
+| -------------------- | --------------------------- | --------------------- | ----------------- |
+| Chat & collaboration | Element ft. Nordeck widgets | [1.11.52](https://github.com/element-hq/element-desktop/blob/develop/CHANGELOG.md#changes-in-11152-2023-12-19) | [For the most recent release](https://element.io/user-guide) |
+| Diagram editor       | Cryptpad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0) | [For the most recent release](https://docs.cryptpad.org/en/) |
+| File management      | Nextcloud                   | [28.0.2](https://nextcloud.com/de/changelog/#28-0-2) | [Nextcloud 28](https://docs.nextcloud.com/) |
+| Groupware            | OX Appsuite                 | [8.20](https://documentation.open-xchange.com/appsuite/releases/8.20/) | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
+| Knowledge management | XWiki                       | [15.10.4](https://www.xwiki.org/xwiki/bin/view/Blog/XWiki15104Released) | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation) |
+| Portal & IAM         | Nubus                       | Product Preview[^1]   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html) |
+| Project management   | OpenProject                 | [13.3.0](https://www.openproject.org/docs/release-notes/13-3-0/) | [For the most recent release](https://www.openproject.org/docs/user-guide/) |
+| Videoconferencing    | Jitsi                       | [2.0.8922](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_8922) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/) |
+| Weboffice            | Collabora                   | [23.05.9.1.1](https://www.collaboraoffice.com/collabora-online-23-05-release-notes/) | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/) |
+
+While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
+align the applications with best practises regarding container design and operations.
+
+This documentation aims to give you all that is needed to set up your own instance of the openDesk.
+
+Basic knowledge of Kubernetes and DevOps processes is required though.
+
+# Disclaimer
+
 openDesk will face breaking changes in the near future without upgrade paths before
 [technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
 v1.0.0 is reached.
 
 While most components support upgrades, major configuration or component changes may occur, therefore we recommend
-at the moment always installing from scratch.
+from scratch installations for now.
 
-Components that are going to be replaced soon are:
-- the Nextcloud community container is going to be replaced by an openDesk specific Nextcloud distroless container and
-- Dovecot Community is going to be replaced by a Dovecot container tailored for the needs of the public sector.
+In the next months, we not only expect to integrate upstream updates of the functional components to include their
+most recent feature and security sets, but also to address operational topics like scalability for the openDesk
+platform.
 
-In the next months, we not only expect upstream updates of the functional components within their feature scope, but we
-are also going to address operational issues like monitoring and network policies.
-
-Of course, further development also includes enhancing the documentation.
-
-# Feedback
-
-We love to get feedback from you!
-Related to the deployment / contents of this repository,
-please use the [issues within this project](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues).
-
-If you want to address other topics, please check the section
-["Rückmeldungen und Beteiligung" of the Infos' project OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung).
+Of course, further development also includes enhancing the documentation itself.
 
 # Requirements
 
@@ -93,16 +88,35 @@ The following release artefacts are provided beside the default source code asse
 - `chart-index.json`: An overview of all Helm charts used by the release.
 - `image-index.json`: An overview of all container images used by the release.
 
-⟶ Visit out detailed [Workflow](./docs/workflow.md) docs.
+⟶ Visit our detailed [Workflow](./docs/workflow.md) docs.
 
 # Components
 
 ⟶ Visit our detailed [Component](./docs/components.md) docs.
 
+# Feedback
+
+We love to get feedback from you!
+
+Related to the deployment / contents of this repository,
+please use the [issues within this project](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues).
+
+If you want to address other topics, please check the section
+["Rückmeldungen und Beteiligung" of the Infos' project OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung).
 
 # License
 
 This project uses the following license: Apache-2.0
 
 # Copyright
-Copyright (C) 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+
+Copyright (C) 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+
+# Footnotes
+
+[^1]: Nubus is the Cloud Portal and IAM from Univention.
+It is currently integrated as a product preview within openDesk therefore,
+not all resources like documentation and structured release notes are available,
+while the
+[source code can already be found on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/component-code/crossfunctional/univention).
+Please find updates regarding the Nubus at https://nubus.io.

docs/components.md

@@ -58,12 +58,14 @@ Some use cases require inter component integration.
 ```mermaid
 flowchart TD
   OXAppSuiteFrontend-->|SilentLogin, Filepicker, CentralNavigation|IntercomService
+  Element-->|CentralNavigation|IntercomService
   IntercomService-->|SilentLogin, TokenExchange|IdP
   IntercomService-->|Filepicker|Nextcloud
   IntercomService-->|CentralNavigation|Portal
   OXAppSuiteBackend-->|Filepicker|Nextcloud
   Nextcloud-->|CentralNavigation|Portal
   OpenProject-->|CentralNavigation|Portal
+  OpenProject-->|Filestore|Nextcloud
   XWiki-->|CentralNavigation|Portal
   Nextcloud-->|CentralContacts|OXAppSuiteBackend
   OXAppSuiteFrontend-->|Filepicker|OXAppSuiteBackend
@@ -124,7 +126,7 @@ flowchart TD
     A[OX AppSuite]-->L
     D[OX Dovecot]-->L
     P[Portal/Admin]-->L
-    X[XWiki]-->|in 2023|L
+    X[XWiki]-->L
     A-->K
     N-->K
     D-->K

docs/debugging.md

@@ -0,0 +1,83 @@
+<!--
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+-->
+<h1>Debugging</h1>
+
+* [Disclaimer](#disclaimer)
+* [Enable debugging](#enable-debugging)
+* [Components](#components)
+  * [MariaDB](#mariadb)
+  * [Nextcloud](#nextcloud)
+  * [OpenProject](#openproject)
+  * [PostgreSQL](#postgresql)
+
+# Disclaimer
+
+This document collects information how to deal with debugging an openDesk deployment.
+
+It will be extended over time as we have to deal with debugging cases.
+
+We for sure do not want to reinvent the wheel, so we might link to external sources that contain helpful
+information where available.
+
+**Note:** You should never enable debug in production environments! By looking up `debug.enable` in the deployment you
+will find the various places changes are applied when enabling debugging. So outside of development and test
+environments you may want to make use of them in a very thoughtful and selective manner if needed.
+
+# Enable debugging
+
+Set `debug.enable` to `true` in [`debug.yaml`](../helmfile/environments/default/debug.yaml) to set the
+component's loglevel to debug and it get some features like:
+- The `/admin` console is routed for Keycloak.
+- An ingress for `http://minio-console.<your_domain>` is configured.
+and set the loglevel for components to "Debug".
+
+**Note:** All containers should write their log output to STDOUT, if you find (valuable) logs inside a container, please let us know!
+
+# Components
+
+## MariaDB
+
+When using the openDesk bundled MariaDB you can explore database(s) using the MariaDB interactive terminal from the pod's command line: `mariadb -u root -p`. As password provide the value for `MARIADB_ROOT_PASSWORD` set in the pod's environment.
+
+While you will find all details for the CLI tool in [the online documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some quick commands are:
+
+- `help`: Get help on the psql command set
+- `show databases`: Lists all databases
+- `use <databasename>`: Connect to `<databasename>`
+- `show tables`: Lists tables within the currently connected database
+- `quit`: Quit the client
+
+## Nextcloud
+
+`occ` is the CLI for Nextcloud, all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
+
+You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`
+
+## OpenProject
+
+OpenProject is a Ruby on Rails application. Therefore you can make use of the Rails console from the pod's command line `bundle exec rails console`
+
+and run debug code like this:
+
+```
+uri = URI('https://nextcloud.url/index.php/apps/integration_openproject/check-config')
+Net::HTTP.start(uri.host, uri.port,
+  :use_ssl => uri.scheme == 'https') do |http|
+  request = Net::HTTP::Get.new uri
+  response = http.request request # Net::HTTPResponse object
+end
+```
+
+## PostgreSQL
+
+When using the openDesk bundled PostgreSQL you can explore database(s) using the PostgreSQL interactive terminal from the pod's command line: `psql -U postgres`.
+
+While you will find all details in the [psql subsection](https://www.postgresql.org/docs/current/app-psql.html)) of the PostgreSQL documentation, some quick commands are:
+
+- `\?`: Get help on the psql command set
+- `\l`: Lists all databases
+- `\c <databasename>`: Connect to `<databasename>`
+- `\dt`: List (describe) tables within the currently connected database
+- `\q`: Quit the client

docs/getting-started.md

@@ -356,17 +356,12 @@ by your specified subdomain.
 # Replace with your namespace
 NAMESPACE=your-namespace
 
-# Get credentials from ConfigMap
-kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
-  | yq '.properties.username,.properties.password'
-# default.user
-# 40615..............................e9e2f
-# ---
-# default.admin
-# bdbbb..............................04db6
+# Get ConfigMap with credentials
+kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}'
 ```
 
-Now you can log in with obtained credentials:
+Renders you a two part ConfigMap where the `username` and `password` attributes in the `properties`
+section provide you with the desired information to login with the two default user roles:
 
 | Username        | Password                                   | Description      |
 |-----------------|--------------------------------------------|------------------|

docs/scaling.md

@@ -20,38 +20,42 @@ Verified positive effects are marke with a check-mark in `Scaling (verified)` co
 marked with a gear.
 
 
-| Component        | Name                                     | Scaling (effective) | Scaling (verified) |
-|------------------|------------------------------------------|:-------------------:|:------------------:|
-| ClamAV           | `replicas.clamav`                        | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.clamd`                         | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.freshclam`                     |         :x:         |        :x:         |
-|                  | `replicas.icap`                          | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.milter`                        | :white_check_mark:  | :white_check_mark: |
-| Collabora        | `replicas.collabora`                     | :white_check_mark:  |       :gear:       |
-| CryptPad         | `replicas.cryptpad`                      | :white_check_mark:  |       :gear:       |
-| Dovecot          | `replicas.dovecot`                       |         :x:         |       :gear:       |
-| Element          | `replicas.element`                       | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.matrixNeoBoardWidget`          | :white_check_mark:  |       :gear:       |
-|                  | `replicas.matrixNeoChoiceWidget`         | :white_check_mark:  |       :gear:       |
-|                  | `replicas.matrixNeoDateFixBot`           | :white_check_mark:  |       :gear:       |
-|                  | `replicas.matrixNeoDateFixWidget`        | :white_check_mark:  |       :gear:       |
-|                  | `replicas.matrixUserVerificationService` | :white_check_mark:  |       :gear:       |
-|                  | `replicas.synapse`                       |         :x:         |       :gear:       |
-|                  | `replicas.synapseWeb`                    | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.wellKnown`                     | :white_check_mark:  | :white_check_mark: |
-| Intercom Service | `replicas.intercomService`               | :white_check_mark:  |       :gear:       |
-| Jitsi            | `replicas.jibri`                         | :white_check_mark:  |       :gear:       |
-|                  | `replicas.jicofo`                        | :white_check_mark:  |       :gear:       |
-|                  | `replicas.jitsi `                        | :white_check_mark:  |       :gear:       |
-|                  | `replicas.jitsiKeycloakAdapter`          | :white_check_mark:  |       :gear:       |
-|                  | `replicas.jvb `                          |         :x:         |        :x:         |
-| Keycloak         | `replicas.keycloak`                      | :white_check_mark:  |       :gear:       |
-| Memcached        | `replicas.memcached`                     |       :gear:        |       :gear:       |
-| Minio            | `replicas.minioDistributed`              | :white_check_mark:  | :white_check_mark: |
-| Nextcloud        | `replicas.nextcloudApache2`              | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.nextcloudExporter`             | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.nextcloudPHP`                  | :white_check_mark:  | :white_check_mark: |
-| OpenProject      | `replicas.openproject`                   | :white_check_mark:  | :white_check_mark: |
-| Postfix          | `replicas.postfix`                       |         :x:         |       :gear:       |
-| Redis            | `replicas.redis`                         |       :gear:        |       :gear:       |
-| XWiki            | `replicas.xwiki`                         |         :x:         |       :gear:       |
+| Component                   | Name                                     | Scaling (effective) | Scaling (verified) |
+|-----------------------------|------------------------------------------|:-------------------:|:------------------:|
+| ClamAV                      | `replicas.clamav`                        | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.clamd`                         | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.freshclam`                     |         :x:         |        :x:         |
+|                             | `replicas.icap`                          | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.milter`                        | :white_check_mark:  | :white_check_mark: |
+| Collabora                   | `replicas.collabora`                     | :white_check_mark:  |       :gear:       |
+| CryptPad                    | `replicas.cryptpad`                      | :white_check_mark:  |       :gear:       |
+| Dovecot                     | `replicas.dovecot`                       |         :x:         |       :gear:       |
+| Element                     | `replicas.element`                       | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.matrixNeoBoardWidget`          | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoChoiceWidget`         | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoDateFixBot`           | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoDateFixWidget`        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixUserVerificationService` | :white_check_mark:  |       :gear:       |
+|                             | `replicas.synapse`                       |         :x:         |       :gear:       |
+|                             | `replicas.synapseWeb`                    | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.wellKnown`                     | :white_check_mark:  | :white_check_mark: |
+| Intercom Service            | `replicas.intercomService`               | :white_check_mark:  | :white_check_mark: |
+| Jitsi                       | `replicas.jibri`                         | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jicofo`                        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jitsi `                        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jitsiKeycloakAdapter`          | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jvb `                          |         :x:         |        :x:         |
+| Keycloak                    | `replicas.keycloak`                      | :white_check_mark:  |       :gear:       |
+| Memcached                   | `replicas.memcached`                     |       :gear:        |       :gear:       |
+| Minio                       | `replicas.minioDistributed`              | :white_check_mark:  | :white_check_mark: |
+| Nextcloud                   | `replicas.nextcloudApache2`              | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.nextcloudExporter`             | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.nextcloudPHP`                  | :white_check_mark:  | :white_check_mark: |
+| OpenProject                 | `replicas.openproject`                   | :white_check_mark:  | :white_check_mark: |
+| Postfix                     | `replicas.postfix`                       |         :x:         |       :gear:       |
+| Redis                       | `replicas.redis`                         |       :gear:        |       :gear:       |
+| Univention Management Stack |                                          |       :gear:        |       :gear:       |
+|                             | `replicas.umsPortalFrontend`             | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.umsPortalServer`               | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.umsUdmRestApi`                 | :white_check_mark:  | :white_check_mark: |
+| XWiki                       | `replicas.xwiki`                         |         :x:         |       :gear:       |

docs/security-context.md

@@ -0,0 +1,227 @@
+<!--
+SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+-->
+<h1>Kubernetes Security Context</h1>
+
+* [Container Security Context](#container-security-context)
+  * [allowPrivilegeEscalation](#allowprivilegeescalation)
+  * [capabilities](#capabilities)
+  * [privileged](#privileged)
+  * [runAsUser](#runasuser)
+  * [runAsGroup](#runasgroup)
+  * [seccompProfile](#seccompprofile)
+  * [readOnlyRootFilesystem](#readonlyrootfilesystem)
+  * [runAsNonRoot](#runasnonroot)
+* [Status quo](#status-quo)
+
+# Container Security Context
+
+
+The containerSecurityContext is the most important security-related section because it has the highest precedence and restricts the container to its minimal privileges.
+
+## allowPrivilegeEscalation
+
+
+Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed (Linux only) at any time.
+
+```yaml
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+```
+
+## capabilities
+
+
+Containers must drop ALL capabilities, and are only permitted to add back the `NET_BIND_SERVICE` capability (Linux only).
+
+
+**Optimal:**
+
+```yaml
+containerSecurityContext:
+  capabilities:
+    drop:
+      - "ALL"
+```
+
+
+**Allowed:**
+
+```yaml
+containerSecurityContext:
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "NET_BIND_SERVICE"
+```
+
+## privileged
+
+
+Privileged Pods disable most security mechanisms and must be disallowed.
+
+```yaml
+containerSecurityContext:
+  privileged: false
+```
+
+## runAsUser
+
+
+Containers should set a user id >= 1000 and never use 0 (root) as user.
+
+```yaml
+containerSecurityContext:
+  runAsUser: 1000
+```
+
+## runAsGroup
+
+
+Containers should set a group id >= 1000 and never use 0 (root) as user.
+
+```yaml
+containerSecurityContext:
+  runAsGroup: 1000
+```
+
+## seccompProfile
+
+
+Seccomp profile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
+
+```yaml
+containerSecurityContext:
+  seccompProfile:
+    type: "RuntimeDefault"
+```
+
+
+or
+
+```yaml
+containerSecurityContext:
+  seccompProfile:
+    type: "Localhost"
+```
+
+## readOnlyRootFilesystem
+
+
+Containers should have an immutable file systems, so that attackers could not modify application code or download malicious code.
+
+```yaml
+containerSecurityContext:
+  readOnlyRootFilesystem: true
+```
+
+## runAsNonRoot
+
+
+Containers must be required to run as non-root users.
+
+```yaml
+containerSecurityContext:
+  runAsNonRoot: true
+```
+
+# Status quo
+
+
+openDesk aims to achieve that all security relevant settings are explicitly templated and comply with security recommendations.
+
+
+The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are also properly templated by the given Helm charts.
+
+
+This list gives you an overview of templated security settings and if they comply with security standards:
+
+
+ - **yes**: Value is set to `true`
+ - **no**: Value is set to `false`
+ - **n/a**: No explicitly templated in openDesk and default is used.
+
+| process | status | allowPrivilegeEscalation | privileged | readOnlyRootFilesystem | runAsNonRoot | runAsUser | runAsGroup | seccompProfile | capabilities |
+| ------- | ------ | ------------------------ | ---------- | ---------------------- | ------------ | --------- | ---------- | -------------- | ------------ |
+| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT","MKNOD"] |
+| **cryptpad**/cryptpad | :x: | no | no | no | yes | 4001 | 4001 | yes | yes |
+| **element**/matrix-neoboard-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **element**/matrix-neochoice-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **element**/matrix-neodatefix-bot | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **element**/matrix-neodatefix-bot-bootstrap | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **element**/matrix-neodatefix-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **element**/opendesk-element | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **element**/opendesk-matrix-user-verification-service | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **element**/opendesk-matrix-user-verification-service-bootstrap | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
+| **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **element**/opendesk-well-known | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **intercom-service**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
+| **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
+| **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
+| **jitsi**/jitsi/jitsi/jvb | :x: | no | no | no | no | 0 | 0 | yes | no |
+| **jitsi**/jitsi/jitsi/prosody | :x: | no | no | no | no | 0 | 0 | yes | no |
+| **jitsi**/jitsi/jitsi/web | :x: | no | no | no | no | 0 | 0 | yes | no |
+| **jitsi**/jitsi/patchJVB | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 65532 | 65532 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
+| **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/open-xchange/appsuite/core-imageconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
+| **open-xchange**/open-xchange/appsuite/core-mw/gotenberg | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **open-xchange**/open-xchange/appsuite/core-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/open-xchange/appsuite/core-ui-middleware | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/open-xchange/appsuite/core-user-guide | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/open-xchange/appsuite/guard-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **provisioning**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
+| **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services**/minio | :x: | no | no | no | yes | 1000 | 0 | yes | yes |
+| **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
+| **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums-guardian-authorization-api | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-guardian-management-api | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-guardian-management-ui | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums-keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums-keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums-keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums-ldap-notifier | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **univention-management-stack**/ums-ldap-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-notifications-api | :x: | no | no | no | no | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums-open-policy-agent | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-portal-frontend | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-portal-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-provisioning/dispatcher | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums-provisioning/events-and-consumer-api | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums-provisioning/udm-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **univention-management-stack**/ums-stack-data-ums | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **univention-management-stack**/ums-stack-gateway | :x: | no | no | no | yes | 1001 | 1001 | yes | yes |
+| **univention-management-stack**/ums-store-dav | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-udm-rest-api | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums-umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |
+
+
+This file is auto-generated by [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli)

docs/security.md

@@ -15,89 +15,21 @@ This document should cover the current status of security measurements.
 
 # Helm Chart Trust Chain
 
-Helm charts are signed and validated against GPG keys which could be found in `helmfile/files/gpg-pubkeys`.
+Helm charts are signed and validated against GPG keys which can be found in `helmfile/files/gpg-pubkeys`.
 
-All charts except these are verifiable:
+For more details on Chart validation please visit: https://helm.sh/docs/topics/provenance/
+
+All charts except the ones mentioned below are verifiable:
 
 | Repository        | Verifiable |
 |-------------------|:----------:|
-| collabora-repo    |     no     |
 | open-xchange-repo |     no     |
 
 # Kubernetes Security Enforcements
 
 This list gives you an overview of default security settings and if they comply with security standards:
 
-
-| Component                   | Process                       |         =          | allowPrivilegeEscalation (`false`) |                                                           capabilities (`drop: ALL`)                                                           | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
-|-----------------------------|-------------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
-| ClamAV                      | clamd                         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|                             | freshclam                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|                             | icap                          | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|                             | milter                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-| Collabora                   | collabora                     |        :x:         |                :x:                 | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   100   |
-| CryptPad                    | cryptpad                      |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   4001    |    4001    |  4001   |
-| Dovecot                     | dovecot                       |        :x:         |         :white_check_mark:         |                          :x: (`CHOWN`, `DAC_OVERRIDE`, `KILL`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`)                           |        :white_check_mark:         |       :white_check_mark:        |          :x:          |     -     |     -      |  1000   |
-| Element                     | element                       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-|                             | synapse                       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   10991   |     -      |  10991  |
-|                             | synapseWeb                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-|                             | wellKnown                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-| IntercomService             | intercom-service              | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-| Jitsi                       | jibri                         |        :x:         |                :x:                 |                                                               :x: (`SYS_ADMIN`)                                                                |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | jicofo                        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | jitsiKeycloakAdapter          | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1993    |    1993    |    -    |
-|                             | jvb                           |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | prosody                       |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | web                           |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-| MariaDB                     | mariadb                       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
-| Memcached                   | memcached                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     -      |  1001   |
-| Minio                       | minio                         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-| Nextcloud                   | opendesk-nextcloud-apache2    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   65532   |   65532    |  65532  |
-|                             | opendesk-nextcloud-cron       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   65532   |   65532    |  65532  |
-|                             | opendesk-nextcloud-exporter   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   65532   |   65532    |  65532  |
-|                             | opendesk-nextcloud-management |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   65532   |   65532    |  65532  |
-|                             | opendesk-nextcloud-php        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   65532   |   65532    |  65532  |
-| Open-Xchange                | core-documentconverter        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
-|                             | core-guidedtours              | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | core-imageconverter           |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
-|                             | core-mw-default               |        :x:         |                :x:                 |                                                                      :x:                                                                       |                :x:                |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | core-ui                       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | core-ui-middleware            | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | core-ui-middleware-updater    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | core-user-guide               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | gotenberg                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | guard-ui                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | nextlcoud-integration-ui      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | public-sector-ui              | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-| OpenProject                 | openproject                   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|                             | opendeskOpenprojectBootstrap  | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-| Postfix                     | postfix                       |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   |
-| PostgreSQL                  | postgresql                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
-| Redis                       | redis                         |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     0      |  1001   |
-| Univention Management Stack | guardian-authorization-api    |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | guardian-management-api       |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | guardian-management-ui        |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | keycloak                      |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|                             | keycloak-bootstrap            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|                             | keycloak-extension-handler    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | keycloak-extension-proxy      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                             | ldap-notifier                 |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | ldap-server                   |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | notifications-api             |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | opendesk-keycloak-bootstrap   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|                             | open-policy-agent             |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | portal-frontend               |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | portal-listener               |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | portal-server                 |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | provisioning-api              |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | selfservice-listener          |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | stack-gateway                 | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
-|                             | store-dav                     |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | udm-rest-api                  |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | umc-gateway                   |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                             | umc-server                    |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-| XWiki                       | xwiki                         |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   101   |
-|                             | xwiki initContainers          |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   |
+⟶ Visit our generated detailed [Security Context](./security-context.md) overview.
 
 # NetworkPolicies
 

helmfile/apps/collabora/helmfile.yaml

@@ -8,6 +8,8 @@ repositories:
   # Collabora Online
   # Source: https://github.com/CollaboraOnline/online
   - name: "collabora-online-repo"
+    keyring: "../../files/gpg-pubkeys/collaboraoffice-com.gpg"
+    verify: {{ .Values.charts.collabora.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true

helmfile/apps/collabora/values.yaml.gotmpl

@@ -126,7 +126,7 @@ securityContext:
       - "NET_RAW"
       - "SYS_CHROOT"
       - "MKNOD"
-
+  seLinuxOptions: {{ .Values.seLinuxOptions.collabora }}
 serviceAccount:
   create: true
 ...

helmfile/apps/cryptpad/helmfile.yaml

@@ -13,7 +13,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/\
+      {{ .Values.charts.cryptpad.repository }}"
 
 releases:
   - name: "cryptpad"

helmfile/apps/cryptpad/values.yaml.gotmpl

@@ -63,12 +63,14 @@ securityContext:
   capabilities:
     drop:
       - "ALL"
+  privileged: false
   seccompProfile:
     type: "RuntimeDefault"
-  # readOnlyRootFilesystem: true
+  readOnlyRootFilesystem: false
   runAsNonRoot: true
   runAsUser: 4001
   runAsGroup: 4001
+  seLinuxOptions: {{ .Values.seLinuxOptions.cryptpad }}
 
 serviceAccount:
   create: true

helmfile/apps/element/helmfile.yaml

@@ -13,35 +13,40 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/\
+      {{ .Values.charts.element.repository }}"
   - name: "element-well-known-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.elementWellKnown.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/\
+      {{ .Values.charts.elementWellKnown.repository }}"
   - name: "synapse-web-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseWeb.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/\
+      {{ .Values.charts.synapseWeb.repository }}"
   - name: "synapse-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapse.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/\
+      {{ .Values.charts.synapse.repository }}"
   - name: "synapse-create-account-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseCreateAccount.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/\
+      {{ .Values.charts.synapseCreateAccount.repository }}"
 
   # openDesk Matrix Widgets
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
@@ -59,28 +64,32 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
+      {{ .Values.charts.matrixNeoboardWidget.repository }}"
   - name: "matrix-neochoice-widget-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
+      {{ .Values.charts.matrixNeoboardWidget.repository }}"
   - name: "matrix-neodatefix-widget-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/\
+      {{ .Values.charts.matrixNeodatefixWidget.repository }}"
   - name: "matrix-neodatefix-bot-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/\
+      {{ .Values.charts.matrixNeodatefixBot.repository }}"
 
 
 releases:

helmfile/apps/element/values-element.yaml.gotmpl

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 configuration:
+  endToEndEncryption: true
   additionalConfiguration:
     logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
 
@@ -14,9 +15,6 @@ configuration:
           portal_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/"
         custom_css_variables:
           --cpd-color-text-action-accent: {{ .Values.theme.colors.primary | quote }}
-        widget_types:
-          - jitsi
-          - net.nordeck
 
     "net.nordeck.element_web.module.widget_lifecycle":
       widget_permissions:
@@ -109,6 +107,7 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.element }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl

@@ -14,6 +14,7 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoBoardWidget }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl

@@ -14,6 +14,7 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoChoiceWidget }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl

@@ -21,4 +21,20 @@ image:
   tag: {{ .Values.images.synapseCreateUser.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
+fullnameOverride: "matrix-neodatefix-bot-bootstrap"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  privileged: false
+  readOnlyRootFilesystem: true
+  runAsGroup: 101
+  runAsNonRoot: true
+  runAsUser: 101
+  seccompProfile:
+    type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.synapseCreateUser }}
+
 ...

helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl

@@ -35,6 +35,7 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoDateFixBot }}
 
 extraEnvVars:
   - name: "ACCESS_TOKEN"

helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl

@@ -18,6 +18,7 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoDateFixWidget }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl

@@ -35,4 +35,5 @@ securityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.synapseCreateUser }}
 ...

helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl

@@ -8,13 +8,13 @@ containerSecurityContext:
       - "ALL"
   enabled: true
   privileged: false
-  # TODO: the service can't run with read only filesystem or as non-root
-  # readOnlyRootFilesystem: true
-  # runAsGroup: 101
-  # runAsNonRoot: true
-  # runAsUser: 101
+  readOnlyRootFilesystem: false
+  runAsGroup: 0
+  runAsNonRoot: false
+  runAsUser: 0
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.matrixUserVerificationService }}
 
 extraEnvVars:
   - name: "UVS_ACCESS_TOKEN"

helmfile/apps/element/values-synapse-web.yaml.gotmpl

@@ -14,6 +14,7 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.synapseWeb }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/element/values-synapse.yaml.gotmpl

@@ -76,8 +76,10 @@ containerSecurityContext:
   readOnlyRootFilesystem: true
   runAsNonRoot: true
   runAsUser: 10991
+  runAsGroup: 10991
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.synapse }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/element/values-well-known.yaml.gotmpl

@@ -3,7 +3,7 @@
 ---
 configuration:
   e2ee:
-    forceDisable: true
+    forceDisable: false
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -18,6 +18,7 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.wellKnown }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/intercom-service/helmfile.yaml

@@ -13,7 +13,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/\
+      {{ .Values.charts.intercomService.repository }}"
 
 releases:
   - name: "intercom-service"

helmfile/apps/intercom-service/values.yaml.gotmpl

@@ -7,12 +7,14 @@ containerSecurityContext:
     drop:
       - "ALL"
   enabled: true
+  privileged: false
   runAsUser: 1000
   runAsGroup: 1000
   seccompProfile:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: true
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.intercom }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/jitsi/helmfile.yaml

@@ -13,7 +13,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/\
+      {{ .Values.charts.jitsi.repository }}"
 
 releases:
   - name: "jitsi"

helmfile/apps/jitsi/values-jitsi.yaml.gotmpl

@@ -14,6 +14,7 @@ containerSecurityContext:
   allowPrivilegeEscalation: false
   enabled: true
   readOnlyRootFilesystem: true
+  privileged: false
   capabilities:
     drop:
       - "ALL"
@@ -22,6 +23,7 @@ containerSecurityContext:
   runAsUser: 1993
   runAsGroup: 1993
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.jitsiKeycloakAdapter }}
 
 cleanup:
   deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
@@ -63,8 +65,17 @@ jitsi:
     resources:
       {{ .Values.resources.jitsi | toYaml | nindent 6 }}
     securityContext:
+      allowPrivilegeEscalation: false
+      capabilities: {}
+      enabled: true
+      privileged: false
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.jitsi }}
   prosody:
     image:
       repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
@@ -102,8 +113,17 @@ jitsi:
       size: {{ .Values.persistence.size.prosody | quote }}
       storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
     securityContext:
+      allowPrivilegeEscalation: false
+      capabilities: {}
+      enabled: true
+      privileged: false
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.prosody }}
   jicofo:
     replicaCount: {{ .Values.replicas.jicofo }}
     image:
@@ -115,8 +135,17 @@ jitsi:
     resources:
       {{ .Values.resources.jicofo | toYaml | nindent 6 }}
     securityContext:
+      allowPrivilegeEscalation: false
+      capabilities: {}
+      enabled: true
+      privileged: false
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.jicofo }}
   jvb:
     replicaCount: {{ .Values.replicas.jvb }}
     image:
@@ -129,8 +158,17 @@ jitsi:
     service:
       type: {{ .Values.cluster.service.type | quote }}
     securityContext:
+      allowPrivilegeEscalation: false
+      capabilities: {}
+      enabled: true
+      privileged: false
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.jvb }}
   jibri:
     replicaCount: {{ .Values.replicas.jibri }}
     image:
@@ -143,8 +181,9 @@ jitsi:
     resources:
       {{ .Values.resources.jibri | toYaml | nindent 6 }}
     securityContext:
-      seccompProfile:
-        type: "RuntimeDefault"
+      # Chart does not allow to template more
+      capabilities:
+        add: ["SYS_ADMIN"]
   imagePullSecrets:
   {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
@@ -156,10 +195,18 @@ patchJVB:
     loadbalancerStatusField: {{ .Values.cluster.networking.loadBalancerStatusField | quote }}
   containerSecurityContext:
     allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
     enabled: true
+    privileged: false
     readOnlyRootFilesystem: true
+    runAsUser: 1001
+    runAsGroup: 1001
+    runAsNonRoot: true
     seccompProfile:
       type: "RuntimeDefault"
+    seLinuxOptions: {{ .Values.seLinuxOptions.jitsiPatchJVB }}
   image:
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}

helmfile/apps/nextcloud/helmfile.yaml

@@ -13,14 +13,16 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/\
+      {{ .Values.charts.nextcloudManagement.repository }}"
   - name: "nextcloud-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.nextcloud.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/\
+      {{ .Values.charts.nextcloud.repository }}"
 
 releases:
   - name: "opendesk-nextcloud-management"

helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl

@@ -14,6 +14,9 @@ global:
 additionalAnnotations:
   intents.otterize.com/service-name: "opendesk-nextcloud-php"
 
+cleanup:
+  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+
 configuration:
   administrator:
     username: "nextcloud"
@@ -44,6 +47,7 @@ configuration:
   ldap:
     host: {{ .Values.ldap.host | quote }}
     password: {{ .Values.secrets.univentionManagementStack.ldapSearch.nextcloud | quote }}
+    adminGroupName: "managed-by-attribute-FileshareAdmin"
   objectstore:
     auth:
       accessKey:
@@ -77,12 +81,17 @@ containerSecurityContext:
     drop:
       - "ALL"
   enabled: true
+  privileged: false
   runAsUser: 65532
   runAsGroup: 65532
   seccompProfile:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: false
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudManagement }}
+
+debug:
+  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
 
 image:
   registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudManagement.registry | quote }}
@@ -95,4 +104,5 @@ theme:
 
 resources:
   {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
+
 ...

helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl

@@ -18,12 +18,14 @@ exporter:
       drop:
         - "ALL"
     enabled: true
+    privileged: false
     runAsUser: 65532
     runAsGroup: 65532
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudExporter }}
   image:
     registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudExporter.registry | quote }}
     repository: "{{ .Values.images.nextcloudExporter.repository }}"
@@ -33,12 +35,12 @@ exporter:
     serviceMonitor:
       enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
       labels:
-        {{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
+        {{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 8 }}
     prometheusRule:
       enabled: {{ .Values.prometheus.prometheusRules.enabled }}
       additionalLabels:
-        {{- toYaml .Values.prometheus.prometheusRules.labels | nindent 6 }}
-  replicas: {{ .Values.replicas.nextcloudExporter }}
+        {{- toYaml .Values.prometheus.prometheusRules.labels | nindent 8 }}
+  replicaCount: {{ .Values.replicas.nextcloudExporter }}
   resources:
     {{ .Values.resources.nextcloudExporter | toYaml | nindent 4 }}
 
@@ -69,12 +71,18 @@ php:
       drop:
         - "ALL"
     enabled: true
+    privileged: false
     runAsUser: 65532
     runAsGroup: 65532
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudPHP }}
+  cron:
+    successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
+  debug:
+    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
   image:
     registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudPHP.registry | quote }}
     repository: "{{ .Values.images.nextcloudPHP.repository }}"
@@ -84,12 +92,12 @@ php:
     serviceMonitor:
       enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
       labels:
-        {{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
+        {{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 8 }}
     prometheusRule:
       enabled: {{ .Values.prometheus.prometheusRules.enabled }}
       additionalLabels:
-        {{- toYaml .Values.prometheus.prometheusRules.labels | nindent 6 }}
-  replicas: {{ .Values.replicas.nextcloudPHP }}
+        {{- toYaml .Values.prometheus.prometheusRules.labels | nindent 8 }}
+  replicaCount: {{ .Values.replicas.nextcloudPHP }}
   resources:
     {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
 
@@ -103,12 +111,14 @@ apache2:
       drop:
         - "ALL"
     enabled: true
+    privileged: false
     runAsUser: 65532
     runAsGroup: 65532
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudApache2 }}
   ingress:
     enabled: {{ .Values.ingress.enabled }}
     ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -120,7 +130,7 @@ apache2:
     repository: {{ .Values.images.nextcloudApache2.repository | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudApache2.tag | quote }}
-  replicas: {{ .Values.replicas.nextcloudApache2 }}
+  replicaCount: {{ .Values.replicas.nextcloudApache2 }}
   resources:
     {{ .Values.resources.nextcloudApache2 | toYaml | nindent 4 }}
 ...

helmfile/apps/open-xchange/helmfile.yaml

@@ -13,14 +13,16 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/\
+      {{ .Values.charts.dovecot.repository }}"
 
   # Open-Xchange
   - name: "open-xchange-repo"
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/\
+      {{ .Values.charts.openXchangeAppSuite.repository }}"
 
   # openDesk Open-Xchange Bootstrap
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-open-xchange-bootstrap

helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl

@@ -66,6 +66,7 @@ containerSecurityContext:
   readOnlyRootFilesystem: true
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.dovecot }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -32,12 +32,15 @@ nextcloud-integration-ui:
     capabilities:
       drop:
         - "ALL"
-    readOnlyRootFilesystem: true
+    privileged: false
+    readOnlyRootFilesystem: false
     runAsGroup: 1000
     runAsNonRoot: true
     runAsUser: 1000
+    privileged: false
     seccompProfile:
       type: "RuntimeDefault"
+    seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeNextcloudIntegrationUI }}
 
 public-sector-ui:
   image:
@@ -56,12 +59,15 @@ public-sector-ui:
     capabilities:
       drop:
         - "ALL"
+    privileged: false
     readOnlyRootFilesystem: true
     runAsGroup: 1000
     runAsNonRoot: true
     runAsUser: 1000
+    privileged: false
     seccompProfile:
       type: "RuntimeDefault"
+    seLinuxOptions: {{ .Values.seLinuxOptions.openxchangePublicSectorUI }}
 
 appsuite:
   appsuite-toolkit:
@@ -121,8 +127,11 @@ appsuite:
         readOnlyRootFilesystem: true
         runAsNonRoot: true
         runAsUser: 1001
+        runAsGroup: 1001
+        privileged: false
         seccompProfile:
           type: "RuntimeDefault"
+        seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeGotenberg }}
     hooks:
       beforeAppsuiteStart:
         create-guard-dir.sh: |
@@ -344,8 +353,10 @@ appsuite:
       runAsGroup: 1000
       runAsNonRoot: true
       runAsUser: 1000
+      privileged: false
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeCoreUI }}
 
   core-ui-middleware:
     enabled: true
@@ -384,9 +395,10 @@ appsuite:
       runAsGroup: 1000
       runAsNonRoot: true
       runAsUser: 1000
+      privileged: false
       seccompProfile:
         type: "RuntimeDefault"
-
+      seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeCoreUIMiddleware }}
   core-cacheservice:
     enabled: false
 
@@ -400,23 +412,23 @@ appsuite:
       registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeDocumentConverter.registry | quote }}
       repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
       tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
-    podSecurityContext:
+    resources:
+      {{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
+    securityContext:
       runAsGroup: 1000
       runAsNonRoot: true
       runAsUser: 987
       seccompProfile:
         type: "RuntimeDefault"
-    resources:
-      {{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
-    securityContext:
-      # missing:
-      # readOnlyRootFilesystem: true
+      readOnlyRootFilesystem: false
       allowPrivilegeEscalation: false
+      privileged: false
       capabilities:
         drop:
           - "ALL"
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeDocumentConverter }}
 
   core-documents-collaboration:
     enabled: false
@@ -455,8 +467,10 @@ appsuite:
       runAsGroup: 1000
       runAsNonRoot: true
       runAsUser: 1000
+      privileged: false
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeCoreGuidedtours }}
 
   core-imageconverter:
     enabled: true
@@ -470,23 +484,23 @@ appsuite:
           endpoint: "."
           accessKey: "."
           secretKey: "."
-    podSecurityContext:
+    resources:
+      {{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
+    securityContext:
       runAsGroup: 1000
       runAsNonRoot: true
       runAsUser: 987
       seccompProfile:
         type: "RuntimeDefault"
-    resources:
-      {{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
-    securityContext:
-      # missing:
-      # readOnlyRootFilesystem: true
+      readOnlyRootFilesystem: false
       allowPrivilegeEscalation: false
+      privileged: false
       capabilities:
         drop:
           - "ALL"
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeImageConverter }}
 
   guard-ui:
     enabled: true
@@ -509,9 +523,10 @@ appsuite:
       runAsGroup: 1000
       runAsNonRoot: true
       runAsUser: 1000
+      privileged: false
       seccompProfile:
         type: "RuntimeDefault"
-
+      seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeGuardUI }}
   core-spellcheck:
     enabled: false
 
@@ -537,6 +552,8 @@ appsuite:
       runAsGroup: 1000
       runAsNonRoot: true
       runAsUser: 1000
+      privileged: false
       seccompProfile:
         type: "RuntimeDefault"
+      seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeCoreUserGuide }}
 ...

helmfile/apps/openproject-bootstrap/helmfile.yaml

@@ -13,7 +13,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/\
+      {{ .Values.charts.openprojectBootstrap.repository }}"
 
 releases:
   - name: "opendesk-openproject-bootstrap"

helmfile/apps/openproject-bootstrap/values.yaml.gotmpl

@@ -38,6 +38,7 @@ containerSecurityContext:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: true
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.openprojectBootstrap }}
 
 image:
   registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectBootstrap.registry | quote }}

helmfile/apps/openproject/helmfile.yaml

@@ -13,7 +13,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/\
+      {{ .Values.charts.openproject.repository }}"
 
 releases:
   - name: "openproject"

helmfile/apps/openproject/values.yaml.gotmpl

@@ -9,6 +9,7 @@ global:
 
 containerSecurityContext:
   enabled: true
+  privileged: false
   runAsUser: 1000
   runAsGroup: 1000
   allowPrivilegeEscalation: false
@@ -19,11 +20,12 @@ containerSecurityContext:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: true
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.openproject }}
 
 environment:
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
-  OPENPROJECT_LOG__LEVEL: {{ .Values.debug.logLevel | lower | quote }}
+  OPENPROJECT_LOG__LEVEL: {{ if .Values.debug.enabled }}"debug"{{ else }}"info"{{ end }}
   OPENPROJECT_LOGIN__REQUIRED: "true"
   OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
   OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
@@ -142,7 +144,9 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
-replicaCount: {{ .Values.replicas.openproject }}
+backgroundReplicaCount: {{ .Values.replicas.openprojectWorker }}
+
+replicaCount: {{ .Values.replicas.openprojectWeb }}
 
 resources:
   {{ .Values.resources.openproject | toYaml | nindent 2 }}

helmfile/apps/provisioning/helmfile.yaml

@@ -10,7 +10,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/\
+      {{ .Values.charts.oxConnector.repository }}"
 
 releases:
   - name: "ox-connector"

helmfile/apps/provisioning/values-oxconnector.yaml.gotmpl

@@ -17,10 +17,10 @@ ingress:
 
 oxConnector:
   caCert: "ucctempldapstring"
-  debugLevel: "5"
+  debugLevel: {{ if .Values.debug.enabled }}"4"{{ else }}"1"{{ end }}
   domainName: {{ .Values.global.domain | quote }}
   ldapHost: {{ .Values.ldap.host | quote }}
-  logLevel: {{ .Values.debug.logLevel | quote }}
+  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
   ldapPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
   ldapBaseDn: "dc=swp-ldap,dc=internal"
   ldapHostDn: "cn=admin,dc=swp-ldap,dc=internal"
@@ -59,6 +59,8 @@ probes:
     failureThreshold: 30
     successThreshold: 1
 
+replicaCount: {{ .Values.replicas.oxConnector }}
+
 securityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -79,6 +81,11 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  readOnlyRootFilesystem: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.oxConnector }}
 
 serviceAccount:
   create: true

helmfile/apps/services/helmfile.yaml

@@ -13,7 +13,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/\
+      {{ .Values.charts.otterize.repository }}"
 
   # openDesk Certificates
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
@@ -23,7 +24,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/\
+      {{ .Values.charts.certificates.repository }}"
 
   # openDesk PostgreSQL
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
@@ -33,7 +35,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/\
+      {{ .Values.charts.postgresql.repository }}"
 
   # openDesk MariaDB
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
@@ -43,7 +46,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/\
+      {{ .Values.charts.mariadb.repository }}"
 
   # openDesk Postfix
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
@@ -53,7 +57,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/\
+      {{ .Values.charts.postfix.repository }}"
 
   # openDesk Istio Resources
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-istio-resources
@@ -63,7 +68,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.istioResources.registry }}/{{ .Values.charts.istioResources.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.istioResources.registry }}/\
+      {{ .Values.charts.istioResources.repository }}"
 
   # openDesk ClamAV
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
@@ -73,14 +79,16 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/\
+      {{ .Values.charts.clamav.repository }}"
   - name: "clamav-simple-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.clamavSimple.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/\
+      {{ .Values.charts.clamavSimple.repository }}"
 
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
@@ -90,21 +98,24 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/\
+      {{ .Values.charts.memcached.repository }}"
   - name: "redis-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.redis.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/\
+      {{ .Values.charts.redis.repository }}"
   - name: "minio-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.minio.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/\
+      {{ .Values.charts.minio.repository }}"
 
 releases:
   - name: "opendesk-otterize"

helmfile/apps/services/values-clamav-distributed.yaml.gotmpl

@@ -8,12 +8,14 @@ clamd:
       drop:
         - "ALL"
     enabled: true
+    privileged: false
     runAsUser: 100
     runAsGroup: 101
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.clamd }}
   image:
     registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
     repository: {{ .Values.images.clamd.repository | quote }}
@@ -31,6 +33,15 @@ containerSecurityContext:
   allowPrivilegeEscalation: false
   enabled: true
   readOnlyRootFilesystem: true
+  runAsUser: 0
+  runAsGroup: 0
+  seccompProfile:
+    type: "RuntimeDefault"
+  runAsNonRoot: false
+  capabilities:
+    drop: []
+  privileged: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.clamav }}
 
 freshclam:
   containerSecurityContext:
@@ -39,12 +50,14 @@ freshclam:
       drop:
         - "ALL"
     enabled: true
+    privileged: false
     runAsUser: 100
     runAsGroup: 101
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.freshclam }}
   image:
     registry: {{ .Values.global.imageRegistry | default .Values.images.freshclam.registry | quote }}
     repository: {{ .Values.images.freshclam.repository | quote }}
@@ -71,10 +84,12 @@ icap:
     enabled: true
     runAsUser: 100
     runAsGroup: 101
+    privileged: false
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.icap }}
   image:
     registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
     repository: {{ .Values.images.icap.repository | quote }}
@@ -97,10 +112,12 @@ milter:
     enabled: true
     runAsUser: 100
     runAsGroup: 101
+    privileged: false
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.milter }}
   image:
     registry: {{ .Values.global.imageRegistry | default .Values.images.milter.registry | quote }}
     repository: {{ .Values.images.milter.repository | quote }}

helmfile/apps/services/values-clamav-simple.yaml.gotmpl

@@ -7,10 +7,14 @@ containerSecurityContext:
     drop:
       - "ALL"
   enabled: true
+  privileged: false
   runAsUser: 100
   runAsGroup: 101
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.clamavSimple }}
 
 global:
   imagePullSecrets:

helmfile/apps/services/values-mariadb.yaml.gotmpl

@@ -17,6 +17,7 @@ containerSecurityContext:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: true
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.mariadb }}
 
 global:
   imagePullSecrets:
@@ -59,7 +60,7 @@ podSecurityContext:
   fsGroup: 1001
   fsGroupChangePolicy: "OnRootMismatch"
 
-replicaCount: 1
+replicaCount: {{ .Values.replicas.mariadb }}
 
 resources:
   {{ .Values.resources.mariadb | toYaml | nindent 2 }}

helmfile/apps/services/values-memcached.yaml.gotmpl

@@ -1,17 +1,22 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
+architecture: {{ if gt .Values.replicas.memcached 1 }}"high-availability"{{ else }}"standalone"{{ end }}
+
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
     drop:
       - "ALL"
   enabled: true
+  privileged: false
   runAsUser: 1001
+  runAsGroup: 1001
   runAsNonRoot: true
   seccompProfile:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.memcached }}
 
 global:
   imagePullSecrets:

helmfile/apps/services/values-minio.yaml.gotmpl

@@ -24,9 +24,12 @@ containerSecurityContext:
       - "ALL"
   privileged: false
   runAsUser: 1000
+  runAsGroup: 0
   runAsNonRoot: true
+  readOnlyRootFilesystem: false
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.minio }}
 
 defaultBuckets: "openproject,openxchange,ums,nextcloud"
 
@@ -40,6 +43,7 @@ image:
   tag: "{{ .Values.images.minio.tag }}"
   pullPolicy: "{{ .Values.global.imagePullPolicy }}"
 
+{{- if .Values.debug.enabled }}
 ingress:
   enabled: {{ .Values.ingress.enabled }}
   ingressClassName: {{ .Values.ingress.ingressClassName }}
@@ -50,6 +54,7 @@ ingress:
       secretName: "{{ .Values.ingress.tls.secretName }}"
   annotations:
     nginx.org/websocket-services: "minio"
+{{- end }}
 
 livenessProbe:
   enabled: true
@@ -57,13 +62,13 @@ livenessProbe:
   periodSeconds: 10
   timeoutSeconds: 10
 
-mode: "standalone"
+mode: {{ if gt .Values.replicas.minio 1 }}"distributed"{{ else }}"standalone"{{ end }}
 
 metrics:
   serviceMonitor:
     enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
-  prometheusRule:
-    enabled: {{ .Values.prometheus.prometheusRules.enabled }}
+    additionalLabels:
+      {{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
 
 networkPolicy:
   enabled: false
@@ -80,6 +85,8 @@ provisioning:
   enabled: true
   cleanupAfterFinished:
     enabled: true
+  extraCommands:
+    - "mc anonymous set download provisioning/ums/portal-assets"
   buckets:
     - name: "openproject"
       versioning: true
@@ -87,8 +94,8 @@ provisioning:
     - name: "openxchange"
       versioning: true
       withLock: false
-    - name: "ums"
-      versioning: true
+    - name: {{ .Values.objectstores.univentionManagementStack.bucket | quote }}
+      versioning: false
       withLock: false
     - name: "nextcloud"
       versioning: true
@@ -155,7 +162,7 @@ provisioning:
       policies:
         - "openxchange-bucket-policy"
       setPolicies: true
-    - username: "ums_user"
+    - username: {{ .Values.objectstores.univentionManagementStack.username | quote }}
       password: {{ .Values.secrets.minio.umsUser | quote }}
       disabled: false
       policies:
@@ -185,6 +192,6 @@ startupProbe:
   timeoutSeconds: 10
 
 statefulset:
-  replicaCount: {{ .Values.replicas.minioDistributed }}
+  replicaCount: {{ .Values.replicas.minio }}
 
 ...

helmfile/apps/services/values-postfix.yaml.gotmpl

@@ -14,6 +14,10 @@ containerSecurityContext:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: false
   runAsNonRoot: false
+  runAsUser: 0
+  runAsGroup: 0
+  privileged: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.postfix }}
 
 global:
   imagePullSecrets:
@@ -27,7 +31,7 @@ image:
 
 persistence:
   size: {{ .Values.persistence.size.postfix | quote }}
-  storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote}}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/services/values-postgresql.yaml.gotmpl

@@ -14,6 +14,7 @@ containerSecurityContext:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: true
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.postgresql }}
 
 job:
 
@@ -25,7 +26,7 @@ podSecurityContext:
 postgres:
   user: "postgres"
 
-replicaCount: 1
+replicaCount: {{ .Values.replicas.postgres }}
 
 global:
   imagePullSecrets:

helmfile/apps/services/values-redis.yaml.gotmpl

@@ -19,6 +19,7 @@ image:
 
 master:
   containerSecurityContext:
+    privileged: false
     readOnlyRootFilesystem: true
     runAsUser: 1001
     runAsGroup: 1001
@@ -29,6 +30,7 @@ master:
     capabilities:
       drop:
         - "ALL"
+    seLinuxOptions: {{ .Values.seLinuxOptions.redis }}
   count: {{ .Values.replicas.redis }}
   persistence:
     size: {{ .Values.persistence.size.redis | quote }}

helmfile/apps/univention-management-stack/helmfile.yaml

@@ -12,133 +12,144 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsGuardianManagementApi.registry }}/{{ .Values.charts.umsGuardianManagementApi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsGuardianManagementApi.registry }}/\
+      {{ .Values.charts.umsGuardianManagementApi.repository }}"
   - name: "ums-guardian-management-ui-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsGuardianManagementUi.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsGuardianManagementUi.registry }}/{{ .Values.charts.umsGuardianManagementUi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsGuardianManagementUi.registry }}/\
+      {{ .Values.charts.umsGuardianManagementUi.repository }}"
   - name: "ums-guardian-authorization-api-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsGuardianAuthorizationApi.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsGuardianAuthorizationApi.registry }}/{{ .Values.charts.umsGuardianAuthorizationApi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsGuardianAuthorizationApi.registry }}/\
+      {{ .Values.charts.umsGuardianAuthorizationApi.repository }}"
   - name: "ums-open-policy-agent-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsOpenPolicyAgent.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsOpenPolicyAgent.registry }}/{{ .Values.charts.umsOpenPolicyAgent.repository }}"
-  - name: "ums-store-dav-repo"
-    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
-    verify: {{ .Values.charts.umsStoreDav.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsStoreDav.registry }}/{{ .Values.charts.umsStoreDav.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsOpenPolicyAgent.registry }}/\
+      {{ .Values.charts.umsOpenPolicyAgent.repository }}"
   - name: "ums-ldap-server-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsLdapServer.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsLdapServer.registry }}/{{ .Values.charts.umsLdapServer.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsLdapServer.registry }}/\
+      {{ .Values.charts.umsLdapServer.repository }}"
   - name: "ums-ldap-notifier-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsLdapNotifier.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsLdapNotifier.registry }}/{{ .Values.charts.umsLdapNotifier.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsLdapNotifier.registry }}/\
+      {{ .Values.charts.umsLdapNotifier.repository }}"
   - name: "ums-udm-rest-api-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsUdmRestApi.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsUdmRestApi.registry }}/{{ .Values.charts.umsUdmRestApi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsUdmRestApi.registry }}/\
+      {{ .Values.charts.umsUdmRestApi.repository }}"
   - name: "ums-stack-data-ums-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsStackDataUms.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsStackDataUms.registry }}/{{ .Values.charts.umsStackDataUms.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsStackDataUms.registry }}/\
+      {{ .Values.charts.umsStackDataUms.repository }}"
   - name: "ums-stack-data-swp-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsStackDataSwp.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsStackDataSwp.registry }}/{{ .Values.charts.umsStackDataSwp.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsStackDataSwp.registry }}/\
+      {{ .Values.charts.umsStackDataSwp.repository }}"
   - name: "ums-portal-server-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsPortalServer.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsPortalServer.registry }}/{{ .Values.charts.umsPortalServer.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsPortalServer.registry }}/\
+      {{ .Values.charts.umsPortalServer.repository }}"
   - name: "ums-notifications-api-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsNotificationsApi.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsNotificationsApi.registry }}/{{ .Values.charts.umsNotificationsApi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsNotificationsApi.registry }}/\
+      {{ .Values.charts.umsNotificationsApi.repository }}"
   - name: "ums-portal-listener-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsPortalListener.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsPortalListener.registry }}/{{ .Values.charts.umsPortalListener.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsPortalListener.registry }}/\
+      {{ .Values.charts.umsPortalListener.repository }}"
   - name: "ums-portal-frontend-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsPortalFrontend.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsPortalFrontend.registry }}/{{ .Values.charts.umsPortalFrontend.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsPortalFrontend.registry }}/\
+      {{ .Values.charts.umsPortalFrontend.repository }}"
   - name: "ums-umc-gateway-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsUmcGateway.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsUmcGateway.registry }}/{{ .Values.charts.umsUmcGateway.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsUmcGateway.registry }}/\
+      {{ .Values.charts.umsUmcGateway.repository }}"
   - name: "ums-umc-server-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsUmcServer.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsUmcServer.registry }}/{{ .Values.charts.umsUmcServer.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsUmcServer.registry }}/\
+      {{ .Values.charts.umsUmcServer.repository }}"
   - name: "ums-selfservice-listener-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsSelfserviceListener.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsSelfserviceListener.registry }}/{{ .Values.charts.umsSelfserviceListener.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsSelfserviceListener.registry }}/\
+      {{ .Values.charts.umsSelfserviceListener.repository }}"
   - name: "ums-provisioning-repo"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsProvisioning.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsProvisioning.registry }}/{{ .Values.charts.umsProvisioning.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsProvisioning.registry }}/\
+      {{ .Values.charts.umsProvisioning.repository }}"
 
   # Univention Keycloak Extensions
   - name: "ums-keycloak-extensions-repo"
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsKeycloakExtensions.registry }}/{{ .Values.charts.umsKeycloakExtensions.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsKeycloakExtensions.registry }}/\
+      {{ .Values.charts.umsKeycloakExtensions.repository }}"
   # Univention Keycloak
   - name: "ums-keycloak-repo"
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
@@ -146,14 +157,16 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsKeycloak.registry }}/{{ .Values.charts.umsKeycloak.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsKeycloak.registry }}/\
+      {{ .Values.charts.umsKeycloak.repository }}"
   - name: "ums-keycloak-bootstrap-repo"
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.umsKeycloakBootstrap.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsKeycloakBootstrap.registry }}/{{ .Values.charts.umsKeycloakBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.umsKeycloakBootstrap.registry }}/\
+      {{ .Values.charts.umsKeycloakBootstrap.repository }}"
   - name: "opendesk-keycloak-bootstrap-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
@@ -170,7 +183,8 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginx.registry }}/{{ .Values.charts.nginx.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginx.registry }}/\
+      {{ .Values.charts.nginx.repository }}"
 
 releases:
   - name: "ums-keycloak"
@@ -219,15 +233,6 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
     timeout: 900
 
-  - name: "ums-store-dav"
-    chart: "ums-store-dav-repo/{{ .Values.charts.umsStoreDav.name }}"
-    version: "{{ .Values.charts.umsStoreDav.version }}"
-    values:
-      - "values-common.yaml.gotmpl"
-      - "values-store-dav.yaml.gotmpl"
-    installed: {{ .Values.univentionManagementStack.enabled }}
-    timeout: 900
-
   - name: "ums-ldap-server"
     chart: "ums-ldap-server-repo/{{ .Values.charts.umsLdapServer.name }}"
     version: "{{ .Values.charts.umsLdapServer.version }}"

helmfile/apps/univention-management-stack/values-guardian-authorization-api.yaml.gotmpl

@@ -7,7 +7,7 @@ guardianAuthorizationApi:
   guardianAuthzAdapterAppPersistencePort: "udm_data"
   guardianAuthzAdapterPolicyPort: "opa"
   guardianAuthzAdapterAuthenticationPort: "fast_api_oauth"
-  guardianAuthzLoggingLevel: {{ .Values.debug.logLevel | quote }}
+  guardianAuthzLoggingLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
   guardianAuthzLoggingStructured: false
   guardianAuthzLoggingFormat: "<green>{time:YYYY-MM-DD HH:mm:ss.SSS ZZ}</green> | <level>{level}</level> | <level>{message}</level> | {extra}"
   home: "/guardian_service_dir"
@@ -51,5 +51,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  runAsUser: 1000
+  runAsGroup: 1000
+  runAsNonRoot: true
+  readOnlyRootFilesystem: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsGuardianAuthorizationApi }}
 
 ...

helmfile/apps/univention-management-stack/values-guardian-management-api.yaml.gotmpl

@@ -16,7 +16,7 @@ guardianManagementApi:
   guardianManagementAdapterAuthenticationPort: "fast_api_oauth"
   guardianManagementAdapterAuthorizationApiUrl: "http://ums-guardian-authorization-api/guardian/authorization"
   guardianManagementAdapterResourceAuthorizationPort: "always"
-  guardianManagementLoggingLevel: "DEBUG"
+  guardianManagementLoggingLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
   guardianManagementLoggingStructured: false
   guardianManagementLoggingFormat: "<green>{time:YYYY-MM-DD HH:mm:ss.SSS ZZ}</green> | <level>{level}</level> | <level>{message}</level> | {extra}"
   guardianManagementBaseUrl: "http://0.0.0.0:8000"
@@ -69,5 +69,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  runAsUser: 1000
+  runAsGroup: 1000
+  runAsNonRoot: true
+  readOnlyRootFilesystem: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsGuardianManagementApi }}
 
 ...

helmfile/apps/univention-management-stack/values-guardian-management-ui.yaml.gotmpl

@@ -42,5 +42,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  readOnlyRootFilesystem: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsGuardianManagementUi }}
 
 ...

helmfile/apps/univention-management-stack/values-ldap-notifier.yaml.gotmpl

@@ -22,6 +22,12 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  privileged: false
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsLdapNotifier }}
 
 volumes:
   claims:

helmfile/apps/univention-management-stack/values-ldap-server.yaml.gotmpl

@@ -45,11 +45,11 @@ ldapServer:
   ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
 
 persistence:
-  data:
-    storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
+  sharedData:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
     size: {{ .Values.persistence.size.univentionManagementStack.ldapServerData | quote }}
-  shared:
-    storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
+  sharedRun:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
     size: {{ .Values.persistence.size.univentionManagementStack.ldapServerShared | quote }}
 
 securityContext:
@@ -72,6 +72,11 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsLdapServer }}
 
 service:
   type: "ClusterIP"

helmfile/apps/univention-management-stack/values-notifications-api.yaml.gotmpl

@@ -40,5 +40,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 1000
+  runAsGroup: 1000
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsNotificationsApi }}
 
 ...

helmfile/apps/univention-management-stack/values-open-policy-agent.yaml.gotmpl

@@ -42,5 +42,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 1000
+  runAsGroup: 1000
+  runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsOpenPolicyAgent }}
 
 ...

helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl

@@ -195,7 +195,7 @@ config:
         authorizationServicesEnabled: false
         attributes:
           backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/ncoidc"
+          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/index.php/apps/user_oidc/backchannel-logout/opendesk"
           post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         protocolMappers:
           - name: "context"
@@ -597,6 +597,7 @@ containerSecurityContext:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: true
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.opendeskKeycloakBootstrap }}
 
 podAnnotations:
   intents.otterize.com/service-name: "ums-keycloak-bootstrap"

helmfile/apps/univention-management-stack/values-portal-frontend.yaml.gotmpl

@@ -83,6 +83,8 @@ image:
         path: "/univention/portal/custom/"
     tls: {}
 
+replicaCount: {{ .Values.replicas.umsPortalFrontend }}
+
 resources:
   {{ .Values.resources.umsPortalFrontend | toYaml | nindent 2 }}
 
@@ -106,5 +108,9 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
-
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsPortalFrontend }}
 ...

helmfile/apps/univention-management-stack/values-portal-listener.yaml.gotmpl

@@ -23,8 +23,8 @@ persistence:
 
 portalListener:
   adminGroup: {{ printf "%s,%s" "cn=Domain Admins,cn=groups" .Values.ldap.baseDn | quote }}
-  assetsRoot: {{ printf "%s%s%s" "http://portal-listener:" .Values.secrets.univentionManagementStack.storeDavUsers.portalListener "@ums-store-dav/portal-assets/" | quote }}
-  ucsInternalUrl: {{ printf "%s%s%s" "http://portal-listener:" .Values.secrets.univentionManagementStack.storeDavUsers.portalListener "@ums-store-dav/portal-data" | quote }}
+  assetsRootPath: "portal-assets"
+  ucsInternalPath: "portal-data"
 
   ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
   ldapHost: {{ .Values.ldap.host | quote }}
@@ -35,12 +35,16 @@ portalListener:
   portalDefaultDn: {{ printf "%s,%s" "cn=domain,cn=portal,cn=portals,cn=univention" .Values.ldap.baseDn | quote }}
   udmApiUrl: "http://ums-udm-rest-api/udm/"
   udmApiUsername: "cn=admin"
-  debugLevel: "4"
+  debugLevel: {{ if .Values.debug.enabled }}"4"{{ else }}"1"{{ end }}
   tlsMode: "off"
   udmApiUrl: "http://ums-udm-rest-api/udm/"
   udmApiUsername: "cn=admin"
   umcGetUrl: "http://ums-umc-server/get"
   umcSessionUrl: "http://ums-umc-server/get/session-info"
+  objectStorageEndpoint: "http://minio:9000"
+  objectStorageBucket: "ums"
+  objectStorageAccessKeyId: "ums_user"
+  objectStorageSecretAccessKey: {{ .Values.secrets.minio.umsUser | quote }}
 
 resources:
   {{ .Values.resources.umsPortalListener | toYaml | nindent 2 }}
@@ -71,5 +75,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsPortalListener }}
 
 ...

helmfile/apps/univention-management-stack/values-portal-server.yaml.gotmpl

@@ -16,13 +16,19 @@ portalServer:
   editable: "false"
   umcGetUrl: "http://ums-umc-server/get"
   umcSessionUrl: "http://ums-umc-server/get/session-info"
-  logLevel: {{ .Values.debug.logLevel | quote }}
+  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
   adminGroup: {{ printf "%s,%s" "cn=Domain Admins,cn=groups" .Values.ldap.baseDn | quote }}
-  ucsInternalUrl: {{ printf "%s%s%s" "http://portal-server:" .Values.secrets.univentionManagementStack.storeDavUsers.portalServer "@ums-store-dav/portal-data" | quote }}
+  ucsInternalPath: "portal-data"
+  objectStorageEndpoint: "http://minio:9000"
+  objectStorageBucket: "ums"
+  objectStorageAccessKeyId: "ums_user"
+  objectStorageSecretAccessKey: {{ .Values.secrets.minio.umsUser | quote }}
   centralNavigation:
     enabled: true
     authenticatorSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
 
+replicaCount: {{ .Values.replicas.umsPortalServer }}
+
 resources:
   {{ .Values.resources.umsPortalServer | toYaml | nindent 2 }}
 
@@ -46,5 +52,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsPortalServer }}
 
 ...

helmfile/apps/univention-management-stack/values-provisioning.yaml.gotmpl

@@ -3,15 +3,110 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
-image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioning.registry | quote }}
-  repository: {{ .Values.images.umsProvisioning.repository | quote }}
-  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  tag: {{ .Values.images.umsProvisioning.tag | quote }}
-  pullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . | quote }}
-    {{- end }}
+
+dispatcher:
+  image:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningDispatcher.registry | quote }}
+    repository: {{ .Values.images.umsProvisioningDispatcher.repository | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    tag: {{ .Values.images.umsProvisioningDispatcher.tag | quote }}
+    pullSecrets:
+      {{- range .Values.global.imagePullSecrets }}
+      - name: {{ . | quote }}
+      {{- end }}
+  resources:
+    {{ .Values.resources.umsProvisioning | toYaml | nindent 4 }}
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    privileged: false
+    seccompProfile:
+      type: "RuntimeDefault"
+    runAsUser: 1000
+    runAsGroup: 1000
+    runAsNonRoot: true
+    readOnlyRootFilesystem: false
+    seLinuxOptions: {{ .Values.seLinuxOptions.umsProvisioningDispatcher }}
+
+events-and-consumer-api:
+  image:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningEventsAndConsumerApi.registry | quote }}
+    repository: {{ .Values.images.umsProvisioningEventsAndConsumerApi.repository | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    tag: {{ .Values.images.umsProvisioningEventsAndConsumerApi.tag | quote }}
+    pullSecrets:
+      {{- range .Values.global.imagePullSecrets }}
+      - name: {{ . | quote }}
+      {{- end }}
+  rootPath: "/univention/provisioning-api"
+  ingress:
+    # copied from values-common.yaml.gotmpl
+    # Intentionally not using the Ingress configuration of the UMS stack at the
+    # moment, since it does depend on rewriting capabilities of the ingress
+    # controller. Those are encapsulated into the release "stack-gateway" so that
+    # the compatibility with all ingress controllers is increased.
+    enabled: false
+    host: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
+  resources:
+    {{ .Values.resources.umsProvisioning | toYaml | nindent 4 }}
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    privileged: false
+    seccompProfile:
+      type: "RuntimeDefault"
+    runAsUser: 1000
+    runAsGroup: 1000
+    runAsNonRoot: true
+    readOnlyRootFilesystem: false
+    seLinuxOptions: {{ .Values.seLinuxOptions.umsProvisioningEventsAndConsumerApi }}
+
+udm-listener:
+  image:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningUdmListener.registry | quote }}
+    repository: {{ .Values.images.umsProvisioningUdmListener.repository | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    tag: {{ .Values.images.umsProvisioningUdmListener.tag | quote }}
+    pullSecrets:
+      {{- range .Values.global.imagePullSecrets }}
+      - name: {{ . | quote }}
+      {{- end }}
+  config:
+    ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
+    ldapHost: {{ .Values.ldap.host | quote }}
+    ldapHostDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
+    ldapPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
+  resources:
+    {{ .Values.resources.umsProvisioning | toYaml | nindent 4 }}
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+      add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+    privileged: false
+    seccompProfile:
+      type: "RuntimeDefault"
+    runAsUser: 0
+    runAsGroup: 0
+    runAsNonRoot: false
+    readOnlyRootFilesystem: false
+    seLinuxOptions: {{ .Values.seLinuxOptions.umsProvisioningUdmListener }}
 
 nats:
   global:
@@ -21,26 +116,22 @@ nats:
       registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningNats.registry | quote }}
   container:
     image:
+      registry: {{ .Values.global.imageRegistry }}
       repository: {{ .Values.images.umsProvisioningNats.repository | quote }}
       tag: {{ .Values.images.umsProvisioningNats.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   natsBox:
     container:
       image:
+        registry: {{ .Values.global.imageRegistry }}
         repository: {{ .Values.images.umsProvisioningNatsBox.repository | quote }}
         tag: {{ .Values.images.umsProvisioningNatsBox.tag | quote }}
+        pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  reloader:
+    image:
+      repository: {{ .Values.images.umsProvisioningNatsReloader.repository | quote }}
+      tag: {{ .Values.images.umsProvisioningNatsReloader.tag | quote }}
+      registry: {{ .Values.global.imageRegistry }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
-provisioningApi:
-  rootPath: "/univention/provisioning-api"
-
-resources:
-  {{ .Values.resources.umsProvisioning | toYaml | nindent 2 }}
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  privileged: false
-  seccompProfile:
-    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-selfservice-listener.yaml.gotmpl

@@ -44,7 +44,7 @@ selfserviceListener:
   machineSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
   notifierServer: {{ .Values.ldap.notifierHost | quote }}
   umcAdminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
-  debugLevel: "4"
+  debugLevel: {{ if .Values.debug.enabled }}"4"{{ else }}"1"{{ end }}
   tlsMode: "off"
   umcServerUrl: "http://ums-umc-server"
   umcAdminUser: "default.admin"
@@ -69,5 +69,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsSelfserviceListener }}
 
 ...

helmfile/apps/univention-management-stack/values-stack-data-swp.yaml.gotmpl

@@ -25,6 +25,11 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsDataLoader }}
 
 stackDataContext:
   ldapBase: "dc=swp-ldap,dc=internal"

helmfile/apps/univention-management-stack/values-stack-data-ums.yaml.gotmpl

@@ -25,6 +25,11 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsDataLoader }}
 
 stackDataContext:
   idpSamlMetadataUrlInternal: null
@@ -41,8 +46,8 @@ stackDataContext:
   umcSamlSpFqdn: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
   idpFqdn: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
   ldapSamlSpUrls: {{ printf "https://%s.%s%s" .Values.global.hosts.univentionManagementStack .Values.global.domain "/univention/saml/metadata" | quote }}
-  initialPasswordAdministrator: {{ .Values.secrets.univentionManagementStack.defaultAccounts.administratorPassword | quote }}
-
+  initialPasswordAdministrator: {{ .Values.secrets.univentionManagementStack.systemAccounts.administratorPassword | quote }}
+  initialPasswordSysIdpUser: {{ .Values.secrets.univentionManagementStack.systemAccounts.sysIdpUserPassword | quote }}
 
 stackDataUms:
   loadDevData: true

helmfile/apps/univention-management-stack/values-store-dav.yaml.gotmpl

@@ -22,8 +22,9 @@ image:
       {{- end }}
 
 persistence:
-  storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
-  size: {{ .Values.persistence.size.univentionManagementStack.storeDav | quote }}
+  data:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.univentionManagementStack.storeDav | quote }}
 
 resources:
   {{ .Values.resources.umsStoreDav | toYaml | nindent 2 }}
@@ -48,6 +49,11 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsStoreDav }}
 
 storeDav:
   auth:

helmfile/apps/univention-management-stack/values-udm-rest-api.yaml.gotmpl

@@ -27,6 +27,8 @@ image:
 resources:
   {{ .Values.resources.umsUdmRestApi | toYaml | nindent 2 }}
 
+replicaCount: {{ .Values.replicas.umsUdmRestApi }}
+
 securityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -47,6 +49,11 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsUdmRestApi }}
 
 udmRestApi:
   # TODO: Stub value currently

helmfile/apps/univention-management-stack/values-umc-gateway.yaml.gotmpl

@@ -54,5 +54,10 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsUmcGateway }}
 
 ...

helmfile/apps/univention-management-stack/values-umc-server.yaml.gotmpl

@@ -90,6 +90,11 @@ securityContext:
   privileged: false
   seccompProfile:
     type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsUmcServer }}
 
 umcServer:
   certPemFile: "/var/secrets/ssl/tls.crt"

helmfile/apps/univention-management-stack/values-ums-keycloak-bootstrap.yaml.gotmpl

@@ -60,11 +60,13 @@ containerSecurityContext:
     drop:
       - "ALL"
   readOnlyRootFilesystem: false
+  privileged: false
   runAsGroup: 1000
   runAsNonRoot: true
   runAsUser: 1000
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsKeycloakBootstrap }}
 
 podAnnotations:
   intents.otterize.com/service-name: "ums-keycloak-bootstrap"

helmfile/apps/univention-management-stack/values-ums-keycloak-extensions.yaml.gotmpl

@@ -40,9 +40,11 @@ handler:
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
+    privileged: false
     runAsUser: 1000
     runAsGroup: 1000
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler }}
   resources:
     {{ .Values.resources.umsKeycloakExtensionHandler | toYaml | nindent 4 }}
 postgresql:
@@ -59,6 +61,10 @@ proxy:
       nginx.org/proxy-buffer-size: "8k"
       nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
     paths:
+      {{- if .Values.debug.enabled }}
+      - pathType: "Prefix"
+        path: "/admin"
+      {{- end }}
       - pathType: "Prefix"
         path: "/realms"
       - pathType: "Prefix"
@@ -78,10 +84,12 @@ proxy:
         - "ALL"
     seccompProfile:
       type: "RuntimeDefault"
+    privileged: false
     readOnlyRootFilesystem: true
     runAsUser: 1000
     runAsGroup: 1000
     runAsNonRoot: true
+    seLinuxOptions: {{ .Values.seLinuxOptions.umsKeycloakExtensionProxy }}
   resources:
     {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 4 }}
 ...

helmfile/apps/univention-management-stack/values-ums-keycloak.yaml.gotmpl

@@ -25,7 +25,7 @@ config:
     user: {{ .Values.databases.keycloak.username | quote }}
     database: {{ .Values.databases.keycloak.name | quote }}
     password: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
-  logLevel: {{ .Values.debug.logLevel | quote }}
+  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
   enableMetrics: true
   # The availability of the admin console is already restricted through the path settings in the Keycloak Extensions
   # Proxy which is used in openDesk. The setting here is just relevant when Keycloak endpoints are exposed directly
@@ -39,10 +39,12 @@ containerSecurityContext:
       - "ALL"
   seccompProfile:
     type: "RuntimeDefault"
+  privileged: false
   readOnlyRootFilesystem: false
   runAsUser: 1000
   runAsGroup: 1000
   runAsNonRoot: true
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsKeycloak }}
 
 podSecurityContext:
   fsGroup: 1000

helmfile/apps/univention-management-stack/values-ums-stack-gateway.yaml.gotmpl

@@ -35,6 +35,7 @@ podSecurityContext:
 containerSecurityContext:
   enabled: true
   runAsUser: 1001
+  runAsGroup: 0
   runAsNonRoot: true
   privileged: false
   readOnlyRootFilesystem: false
@@ -44,6 +45,7 @@ containerSecurityContext:
       - "ALL"
   seccompProfile:
     type: "RuntimeDefault"
+  seLinuxOptions: {{ .Values.seLinuxOptions.umsStackGateway }}
 
 service:
   type: "ClusterIP"
@@ -171,22 +173,22 @@ serverBlock: |
     }
 
 
-    ## store-dav
+    ## object storage (minio)
     location /univention/portal/icons/entries/ {
-      rewrite ^/univention/portal(/icons/entries/.*)$ /portal-assets$1 break;
-      proxy_pass http://ums-store-dav:80;
+      rewrite ^/univention/portal(/icons/entries/.*)$ /ums/portal-assets$1 break;
+      proxy_pass http://minio:9000;
     }
     location /univention/portal/icons/logos/ {
-      rewrite ^/univention/portal(/icons/logos/.*)$ /portal-assets$1 break;
-      proxy_pass http://ums-store-dav:80;
+      rewrite ^/univention/portal(/icons/logos/.*)$ /ums/portal-assets$1 break;
+      proxy_pass http://minio:9000;
     }
     location /univention/selfservice/icons/entries/ {
-      rewrite ^/univention/selfservice(/icons/entries/.*)$ /portal-assets$1 break;
-      proxy_pass http://ums-store-dav:80;
+      rewrite ^/univention/selfservice(/icons/entries/.*)$ /ums/portal-assets$1 break;
+      proxy_pass http://minio:9000;
     }
     location /univention/selfservice/icons/logos/ {
-      rewrite ^/univention/selfservice(/icons/logos/.*)$ /portal-assets$1 break;
-      proxy_pass http://ums-store-dav:80;
+      rewrite ^/univention/selfservice(/icons/logos/.*)$ /ums/portal-assets$1 break;
+      proxy_pass http://minio:9000;
     }
 
 
@@ -278,10 +280,10 @@ serverBlock: |
       proxy_pass http://ums-portal-frontend:80/;
     }
 
-    ## provisioning-api
+    ## ums-provisioning
     location /univention/provisioning-api/ {
       rewrite ^/univention/provisioning-api(/.*)$ $1 break;
-      proxy_pass http://ums-provisioning-provisioning-api:80;
+      proxy_pass http://ums-provisioning-events-and-consumer-api:80;
     }
 
     ## guardian