fix(nubus): [#275] Set `seLinuxOptions` for LDAP Server and Notifier on Pod...

      type: "RuntimeDefault"

    readOnlyRootFilesystem: true

    runAsNonRoot: true

  # In this case the `seLinuxOptions` must be set at pod level (not container level) so that the

  # MCS label is applied to the volumes shared with the ldap-server.

  # umsLdapNotifier and umsLdapServer must resolve to the same SELinux level, otherwise the

  # notifier cannot read the transaction data the ldap-server writes to the shared PVC.

  podSecurityContext:

    seLinuxOptions:

      {{ .Values.seLinuxOptions.umsLdapNotifier | toYaml | nindent 6 }}

  image:

nubusLdapServer:

  additionalAnnotations:

    {{ .Values.annotations.nubusLdapServer.additional | toYaml | nindent 4 }}

  # In this case the `seLinuxOptions` must be set at pod level (not container level) so that the

  # MCS label is applied to the volumes shared with the ldap-server.

  # umsLdapNotifier and umsLdapServer must resolve to the same SELinux level, otherwise the

  # notifier cannot read the transaction data the ldap-server writes to the shared PVC.

  podSecurityContext:

    seLinuxOptions:

      {{ .Values.seLinuxOptions.umsLdapServer | toYaml | nindent 6 }}

  dhInitcontainer:

    image:

      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServerDhInitContainer.registry | quote }}

          # the expire time is then passed via the 'com.openexchange.contacts.ldap.cache.expire' property above.

          cache:

            useCache: {{ if gt (int .Values.technical.oxAppSuite.contactPicker.cacheExpirySeconds) 0 }}true{{ else }}false{{ end }}

            cachedFields: "anniversary,birthday,branches,cellular_telephone1,city_business,city_home,city_other,commercial_register,company,contextid,country_business,country_home,country_other,creationdate,department,displayname,distributionlist,email1,email2,employeetype,fax_business,fax_home,fax_other,file_as,givenname,image1,instant_messenger1,instant_messenger2,internal_userid,lastmodified,manager_name,marital_status,markasdistributionlist,middle_name,nickname,note,number_of_children,number_of_employee,number_of_images,objectid,position,postal_code_business,postal_code_home,postal_code_other,profession,room_number,sales_volume,spouse_name,state_business,state_home,state_other,street_business,street_home,street_other,suffix,surname,tax_id,telephone_assistant,telephone_business1,telephone_business2,telephone_car,telephone_company,telephone_home1,telephone_home2,telephone_ip,telephone_isdn,telephone_other,telephone_pager,telephone_telex,telephone_ttytdd,title,url,userfield01,userfield02,userfield03,userfield04,userfield05,userfield06,userfield07,userfield08,userfield09,userfield10,userfield11,userfield12,userfield13,userfield14,userfield15,userfield16,userfield17,userfield18,userfield19,userfield20"

          # Definition of addressbook folders of the contacts provider. Different folder modes are possible, each

          # one with its specific configuration settings. The template contains examples for all possible modes,

  umsKeycloakBootstrap: ~

  umsKeycloakExtensionHandler: ~

  umsKeycloakExtensionProxy: ~

  # umsLdapNotifier and umsLdapServer share a PVC (the ldap-notifier reads the transaction data the

  # ldap-server writes). On SELinux-enforcing clusters both pods must carry the SAME MCS label, so

  # these two options MUST be set to the same SELinux level, e.g. `{ level: "s0:c100,c200" }`.

  umsLdapNotifier: ~

  umsLdapServer: ~

  umsNotificationsApi: ~