fix(helm): Drop initialDelaySeconds if empty

[kiblik]

If initialDelaySeconds, the default k8s MutationWebhooks drops the whole field, which isa reasonable decision.
However, charts generated via Argo are trying to enforce the existence of this field, resulting in a never-ending "OutOfSync" status.
This PR drops the whole field if it is "empty" (equal to zero).

[dryrunsecurity]

This pull request conditionally omits initialDelaySeconds for liveness and readiness probes in helm/defectdojo/templates/django-deployment.yaml, which can let Kubernetes default them to 0 and cause immediate probe failures that repeatedly restart pods or keep them unready (DoS risk) if values.yaml leaves those fields unset or set to 0. These changes are flagged as risky but non-blocking.

DoS due to premature liveness probe in helm/defectdojo/templates/django-deployment.yaml

Vulnerability

DoS due to premature liveness probe

Description

The Helm chart modification conditionally renders initialDelaySeconds for the liveness probe. If initialDelaySeconds is not explicitly set or is set to 0 in values.yaml, the field will be omitted from the generated Kubernetes manifest. Kubernetes defaults an omitted initialDelaySeconds to 0. For a complex application like Django, a 0-second initial delay for a liveness probe is highly likely to result in the probe failing immediately upon container startup, causing Kubernetes to repeatedly restart the pod and leading to a Denial of Service.

django-DefectDojo/helm/defectdojo/templates/django-deployment.yaml

Lines 228 to 231 in 43d93a4

	{{- if .Values.django.uwsgi.livenessProbe.initialDelaySeconds }}
	initialDelaySeconds: {{ .Values.django.uwsgi.livenessProbe.initialDelaySeconds }}
	{{- end }}
	periodSeconds: {{ .Values.django.uwsgi.livenessProbe.periodSeconds }}

DoS due to premature readiness probe in helm/defectdojo/templates/django-deployment.yaml

Vulnerability

DoS due to premature readiness probe

Description

The change conditionally renders the initialDelaySeconds field for the readiness probe. If .Values.django.uwsgi.readinessProbe.initialDelaySeconds is 0 or not explicitly set in the Helm values.yaml, the initialDelaySeconds field will be omitted from the Kubernetes probe definition. Kubernetes defaults an omitted initialDelaySeconds to 0. For a complex application like DefectDojo (a Django application), a 0-second initial delay is insufficient for the application to fully start and become ready to serve traffic. This will cause the readiness probe to fail immediately and continuously, preventing the pod from ever being marked as 'Ready' and thus not receiving traffic, leading to service unavailability.

django-DefectDojo/helm/defectdojo/templates/django-deployment.yaml

Lines 308 to 311 in 43d93a4

	{{- if .Values.django.uwsgi.readinessProbe.initialDelaySeconds }}
	initialDelaySeconds: {{ .Values.django.uwsgi.readinessProbe.initialDelaySeconds }}
	{{- end }}
	periodSeconds: {{ .Values.django.uwsgi.readinessProbe.periodSeconds }}

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved