[deepnemesis]

Description of the change

Improve JanusGraph workload hardening by:

• Adding RuntimeDefault to the pod security context.
• Completing the optional volume-permissions init-container security context.
• Adding a configurable storageBackend.passwordFileMode with a 0440
  default.
• Updating the chart version to 1.4.12.
• Updating the README and changelog.

Benefits

• Provides pod-level seccomp protection.
• Ensures the volume-permissions security context is rendered explicitly.
• Restricts storage password-file access.
• Aligns the chart with Kubernetes Pod Security Standards and existing
  Bitnami chart patterns.

Possible drawbacks

The volume-permissions init container intentionally continues to run as root
because it performs ownership changes.

The 0440 password-file mode requires a matching pod fsGroup. Installations
that disable the pod security context may need to override
storageBackend.passwordFileMode.

Applicable issues

• fixes [bitnami/janusgraph] Harden pod and volume security contexts #36634

Additional information

The default JanusGraph and metrics container security contexts are unchanged.

Checklist

• Chart version bumped according to semver.
• New values documented in values.yaml and README.md.
• Pull request title follows the Bitnami convention.
• README regenerated with readme-generator-for-helm.
• Helm lint and template validation completed.
• Commits signed off according to the DCO.

[github-actions]

This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary.