fix(helm): declare securityContext for fakeidp and keycloak (#2084)

[Gregory91G]

Closes #2084.

Both Deployments declared no securityContext, so their containers could escalate privileges and kept the full default capability set. Adopts the shape already used by src/backend/services/gateway/helm.

	fakeidp	keycloak
runAsNonRoot / UID / GID / fsGroup 1000	yes	yes
allowPrivilegeEscalation: false	yes	yes
capabilities.drop: ["ALL"]	yes	yes
readOnlyRootFilesystem: true	yes	no — see below

Neither image's runtime user changes: fakeidp already carries USER 1000 and upstream quay.io/keycloak/keycloak ships non-root. The charts simply never asserted it.

readOnlyRootFilesystem is omitted for keycloak because start-dev re-augments Quarkus into /opt/keycloak/lib/quarkus on every boot. Making it work needs an initContainer that pre-populates that path from the image, which is not worth the failure mode on the component that owns login. AVD-KSV-0014 stays reported for keycloak; the misconfig scan is report-only, so nothing is suppressed and no waiver file is introduced.

Test plan

• helm template renders both charts — 83 and 115 lines, no template errors
• trivy fs --scanners misconfig --severity HIGH,CRITICAL on the rendered output: 6 HIGH → 1 HIGH. fakeidp fully clean (KSV-0014 + 2× KSV-0118 gone); keycloak keeps only KSV-0014
• fakeidp under the full set, including read-only root FS (docker run --read-only --user 1000:1000 --cap-drop ALL --security-opt no-new-privileges): starts, /.well-known/openid-configuration → 200, jwks_uri → 200
• keycloak under the set as shipped here: starts in 5.9s, /kc/realms/master/.well-known/openid-configuration → 200
• keycloak with readOnlyRootFilesystem: true and no volumes: fails — ReadOnlyFileSystemException in Quarkus JarResultBuildStep
• keycloak with readOnlyRootFilesystem: true + emptyDir on /opt/keycloak/data, /opt/keycloak/lib/quarkus, /tmp: fails — NoSuchFileException: /opt/keycloak/lib/quarkus/quarkus-application.dat
• Both pods reach Ready in insight-dev after the chart rolls out

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6b96ccdf-f846-4db8-b3ac-d2dbc3e0f0b5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}