Merge pull request #148 from jk-cluster/feat/seccomp-runtime-default-batch1

Acht Charts: seccompProfile RuntimeDefault im Pod-Context und qualifizierte Images

calibre-web-automated/Chart.yaml

@@ -5,7 +5,7 @@ name: calibre-web-automated
 description: A Helm chart to deploy calibere-web-automated
 icon: https://raw.githubusercontent.com/crocodilestick/Calibre-Web-Automated/main/README_images/cwa-logo-round-dark.png
 
-version: 5.0.0+upv4.0.6
+version: 6.0.0+upv4.0.6
 appVersion: v4.0.6
 
 maintainers:

calibre-web-automated/templates/_helpers.tpl

@@ -230,7 +230,8 @@ default probe needs no further context.
 {{- $given := (fromYaml (include "calibre-web-automated.subBlock" (dict "block" . "key" "pod" "path" "cwa.securityContext"))).value -}}
 {{- $defaults := dict
       "fsGroup" 1000
-      "fsGroupChangePolicy" "Always" -}}
+      "fsGroupChangePolicy" "Always"
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "calibre-web-automated.defaultedDict" (dict "defaults" $defaults "given" $given "path" "cwa.securityContext.pod") -}}
 {{- end -}}
 

calibre-web-automated/values.yaml

@@ -65,6 +65,20 @@ cwa:
     pod:
       fsGroup: 1000
       fsGroupChangePolicy: Always
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      #
+      # It is orthogonal to the readOnlyRootFilesystem: false deviation above:
+      # the filter restricts syscalls, not mount flags, so the s6 init keeps
+      # its writable root filesystem and the PUID/PGID remapping to uid 1000
+      # stays active. Verified against v4.0.6 under the filter.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: false

minecraft-router/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://avatars.githubusercontent.com/u/988985
 
 type: application
 
-version: 3.0.0+up1.46.4
+version: 4.0.0+up1.46.4
 appVersion: "1.46.4"
 
 maintainers:

minecraft-router/templates/_helpers.tpl

@@ -224,7 +224,8 @@ the base image.
       "runAsUser" 10000
       "runAsGroup" 10000
       "fsGroup" 10000
-      "fsGroupChangePolicy" "Always" -}}
+      "fsGroupChangePolicy" "Always"
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "minecraft-router.defaultedDict" (dict "defaults" $defaults "given" $given "path" "server.securityContext.pod") -}}
 {{- end -}}
 

minecraft-router/templates/minecraft-router.deployment.yaml

@@ -27,7 +27,7 @@ spec:
         {{- include "minecraft-router.podSecurityContext" .Values.server.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
-          image: "itzg/mc-router:{{ .Chart.AppVersion }}"
+          image: "docker.io/itzg/mc-router:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           args:
             - "--port"

minecraft-router/values.yaml

@@ -108,6 +108,15 @@ server:
       # Keeps the mounted routing-config ConfigMap readable for that gid.
       fsGroup: 10000
       fsGroupChangePolicy: Always
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       # No deviation needed: the image ships nothing but the static binary and

outline/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/outline/outline/main/public/images/icon-
 
 type: application
 
-version: 6.0.0+up1.9.2
+version: 7.0.0+up1.9.2
 appVersion: 1.9.2
 
 maintainers:

outline/templates/_helpers.tpl

@@ -217,7 +217,8 @@ there is no dependency-free alternative to fall back to.
       "runAsUser" 1001
       "runAsGroup" 1001
       "fsGroup" 1001
-      "fsGroupChangePolicy" "Always" -}}
+      "fsGroupChangePolicy" "Always"
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "outline.defaultedDict" (dict "defaults" $defaults "given" $given "path" "outline.securityContext.pod") -}}
 {{- end -}}
 

outline/templates/outline.sfs.yaml

@@ -21,7 +21,7 @@ spec:
         {{- include "outline.podSecurityContext" .Values.outline.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
-          image: "outlinewiki/outline:{{ .Chart.AppVersion }}"
+          image: "docker.io/outlinewiki/outline:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           env:
             - name: PORT

outline/values.yaml

@@ -30,6 +30,15 @@ outline:
       runAsGroup: 1001
       fsGroup: 1001
       fsGroupChangePolicy: Always
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true

patchmon/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/PatchMon/PatchMon/main/frontend/public/a
 
 type: application
 
-version: 6.1.0+up2.1.3
+version: 7.0.0+up2.1.3
 appVersion: "2.1.3"
 
 maintainers:

patchmon/templates/_helpers.tpl

@@ -217,7 +217,8 @@ helpers take dict "given" <block|nil> "root" $.
 {{- $defaults := dict
       "runAsNonRoot" true
       "runAsUser" 65532
-      "runAsGroup" 65532 -}}
+      "runAsGroup" 65532
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "patchmon.defaultedDict" (dict "defaults" $defaults "given" $given "path" "patchmon.server.securityContext.pod") -}}
 {{- end -}}
 

patchmon/values.yaml

@@ -22,6 +22,17 @@ patchmon:
         runAsNonRoot: true
         runAsUser: 65532
         runAsGroup: 65532
+        # RuntimeDefault applies the container runtime's default seccomp
+        # filter, which blocks the syscalls a normal workload never makes. It
+        # sits in the pod context on purpose: from here it covers every
+        # container in the pod - the server and the optional guacd sidecar
+        # alike - including init containers, while a container-level
+        # seccompProfile would have to be repeated for each one (and silently
+        # missed on the next one added). A container that genuinely needs a
+        # different filter can still override it under
+        # securityContext.container, which wins over this value.
+        seccompProfile:
+          type: RuntimeDefault
       container:
         allowPrivilegeEscalation: false
         readOnlyRootFilesystem: true
@@ -88,7 +99,7 @@ patchmon:
     enabled: false
     # guacd is an independent upstream application, so its image is not tied
     # to the chart's appVersion. Pinned to the version upstream ships with.
-    image: guacamole/guacd:1.6.0
+    image: docker.io/guacamole/guacd:1.6.0
     # The image runs as its own unprivileged user (uid 1000); it only needs a
     # writable /tmp, which the chart provides as an emptyDir.
     securityContext:

satisfactory/Chart.yaml

@@ -3,7 +3,7 @@ name: satisfactory
 description: A Helm chart to deploy a Satisfactory Gameserver on Kubernetes
 icon: https://raw.githubusercontent.com/wolveix/satisfactory-server/main/.github/logo.png
 type: application
-version: 5.0.0+upv1.9.10
+version: 6.0.0+upv1.9.10
 appVersion: "v1.9.10"
 maintainers:
   - name: jklein

satisfactory/templates/_helpers.tpl

@@ -224,7 +224,8 @@ Probe specifics that a rebuilt default must not lose:
       "runAsUser" 1000
       "runAsGroup" 1000
       "fsGroup" 1000
-      "fsGroupChangePolicy" "OnRootMismatch" -}}
+      "fsGroupChangePolicy" "OnRootMismatch"
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "satisfactory.defaultedDict" (dict "defaults" $defaults "given" $given "path" "securityContext.pod") -}}
 {{- end -}}
 

satisfactory/values.yaml

@@ -97,6 +97,15 @@ securityContext:
     # entrypoint.
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
+    # RuntimeDefault applies the container runtime's default seccomp filter,
+    # which blocks the syscalls a normal workload never makes. It sits in the
+    # pod context on purpose: from here it covers every container in the pod
+    # including init containers, while a container-level seccompProfile would
+    # have to be repeated for each one (and silently missed on the next one
+    # added). A container that genuinely needs a different filter can still
+    # override it under securityContext.container, which wins over this value.
+    seccompProfile:
+      type: RuntimeDefault
   container:
     allowPrivilegeEscalation: false
     # Works because the chart mounts emptyDirs at /tmp and the steam user's

urlaubsverwaltung/Chart.yaml

@@ -4,5 +4,5 @@ description: A Helm chart to deploy urlaubsverwaltung on Kubernetes
 icon: https://raw.githubusercontent.com/urlaubsverwaltung/urlaubsverwaltung/main/src/main/resources/static/favicons/apple-touch-icon.png
 type: application
 
-version: 7.0.0+up6.7.0
+version: 8.0.0+up6.7.0
 appVersion: 6.7.0

urlaubsverwaltung/templates/_helpers.tpl

@@ -213,7 +213,8 @@ is only the fallback for the case where an override has erased the block.
 {{- $defaults := dict
       "runAsNonRoot" true
       "runAsUser" 1002
-      "runAsGroup" 1001 -}}
+      "runAsGroup" 1001
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "urlaubsverwaltung.defaultedDict" (dict "defaults" $defaults "given" $given "path" "urlaubsverwaltung.securityContext.pod") -}}
 {{- end -}}
 

urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml

@@ -20,7 +20,7 @@ spec:
         {{- include "urlaubsverwaltung.podSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
-          image: "urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}"
+          image: "docker.io/urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           securityContext:
             {{- include "urlaubsverwaltung.containerSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 12 }}

urlaubsverwaltung/values.yaml

@@ -29,6 +29,15 @@ urlaubsverwaltung:
       runAsNonRoot: true
       runAsUser: 1002
       runAsGroup: 1001
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true

voucher-vault/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/l4rm4nd/VoucherVault/main/myapp/static/a
 
 type: application
 
-version: 5.0.0+up1.30.1
+version: 6.0.0+up1.30.1
 appVersion: "1.30.1"
 
 maintainers:

voucher-vault/templates/_helpers.tpl

@@ -217,7 +217,8 @@ header, otherwise the pod never becomes ready.
       "runAsUser" 33
       "runAsGroup" 33
       "fsGroup" 33
-      "fsGroupChangePolicy" "Always" -}}
+      "fsGroupChangePolicy" "Always"
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "voucher-vault.defaultedDict" (dict "defaults" $defaults "given" $given "path" "voucherVault.securityContext.pod") -}}
 {{- end -}}
 

voucher-vault/templates/voucher-vault.sfs.yaml

@@ -27,7 +27,7 @@ spec:
         # entrypoint's collectstatic only adds what is missing, e.g. the
         # Django admin static files). See securityContext in values.yaml.
         - name: init-static
-          image: "l4rm4nd/vouchervault:{{ .Chart.AppVersion }}"
+          image: "docker.io/l4rm4nd/vouchervault:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           # Copies the children (not ".") so cp never tries to set metadata
           # on the mountpoint itself, which the non-root uid may not own.
@@ -48,7 +48,7 @@ spec:
               ephemeral-storage: 10Mi
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
-          image: "l4rm4nd/vouchervault:{{ .Chart.AppVersion }}"
+          image: "docker.io/l4rm4nd/vouchervault:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           env:
             {{- range $value := .Values.voucherVault.env }}

voucher-vault/values.yaml

@@ -74,6 +74,15 @@ voucherVault:
       runAsGroup: 33
       fsGroup: 33
       fsGroupChangePolicy: Always
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true

zipline/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 6.0.0+up4.7.0
+version: 7.0.0+up4.7.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

zipline/templates/_helpers.tpl

@@ -218,7 +218,8 @@ a database outage must not restart the pod.
       "runAsUser" 1000
       "runAsGroup" 1000
       "fsGroup" 1000
-      "fsGroupChangePolicy" "Always" -}}
+      "fsGroupChangePolicy" "Always"
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "zipline.defaultedDict" (dict "defaults" $defaults "given" $given "path" "zipline.securityContext.pod") -}}
 {{- end -}}
 

zipline/values.yaml

@@ -26,6 +26,15 @@ zipline:
       runAsGroup: 1000
       fsGroup: 1000
       fsGroupChangePolicy: Always
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true