From 6c73ef874ba6333a13308feffdd46ca678f80a1f Mon Sep 17 00:00:00 2001 From: jklein Date: Mon, 24 Aug 2026 13:17:14 +0200 Subject: [PATCH] Eight charts: seccompProfile RuntimeDefault and qualified images Sets seccompProfile.type: RuntimeDefault in the pod security context of minecraft-router, outline, urlaubsverwaltung, zipline, voucher-vault, satisfactory, patchmon and calibre-web-automated, so the container runtime's default syscall filter applies to every container in the pod. The value lives in the pod context rather than the container context because it covers init containers and any container added later without being repeated; a container that needs a different filter can still override it under securityContext.container, which wins over the pod value. Five of the eight also get the docker.io/ prefix on their previously unqualified image references, so the pull no longer depends on the runtime's default-registry setting: itzg/mc-router, outlinewiki/outline, urlaubsverwaltung/urlaubsverwaltung, l4rm4nd/vouchervault (twice, app and init container) and guacamole/guacd:1.6.0. zipline, satisfactory and calibre-web-automated were already qualified with ghcr.io. Verified in a throwaway k3d cluster against real application work, not just a Running pod, and with Seccomp: 2 (filter mode) read from /proc//status inside each container: - minecraft-router: a Minecraft handshake for a mapped domain travels through the router to a backend and the backend's status payload comes back to the client. - outline: all migrations apply (45 tables), OIDC discovery succeeds and the server-rendered page answers 200 with Outline. - urlaubsverwaltung: Liquibase applies 79 changesets (35 tables), the app seeds its settings and vacation types, /login answers 200. - zipline: 27 migrations applied, then a full round trip - first user created, login, token, upload, and the file downloaded back byte-exact from the PVC. - voucher-vault: the init container's collectstatic output is served (200, 22 KB), Django has its 22 tables and uWSGI answers 200 with VoucherVault. - satisfactory: application behavior is NOT proven - the image is multiple GB and pulls 10 GB+ of game files on first start, which is why the chart sits in ci/excluded-charts.txt. What is proven is that the rendered pod securityContext is accepted server-side and yields Seccomp: 2 with uid/gid 1000 on a substitute image. - patchmon: both containers run under the pod profile and both report Seccomp: 2. The server applies 47 migrations (44 tables), connects to Postgres and Redis and serves its dashboard; guacd answers a real Guacamole "select rdp" instruction with its full args list, over the same 127.0.0.1:4822 path the chart wires up. - calibre-web-automated: the readOnlyRootFilesystem: false deviation is unaffected - id abc is still uid 1000 (not the 911 the image falls back to in read-only mode), /config and the Calibre metadata.db are owned by 1000, and both the root s6 init and the uid-1000 application report Seccomp: 2. calibredb 9.1 runs and adds a book. Its IPC worker prints a traceback while doing so, but an unconfined control pod on the same image prints the same class of traceback, so it is not the filter. trivy config now reports "0 to act on" for all eight; the untouched samba still shows KSV-0104 and KSV-0030, which confirms these charts are what closed the findings. No values.schema.json needed changing: in all eight schemas securityContext.pod is type ["object", "null"] with no property restrictions, so the new key validates as it stands. The #99 null paths still hold - nulling securityContext or securityContext.pod falls back to the defaults including the new one. Renovate resolves the prefixed guacd reference: a local dry-run lookup (renovate 44.40.1, --platform=local --dry-run=lookup) reports depName docker.io/guacamole/guacd against registryUrl https://index.docker.io with lookupName guacamole/guacd, currentVersion 1.6.0 and its real release timestamp, with no warnings. The other four prefixed references live in templates, which Renovate never reads - they are tracked by the customManagers via appVersion in Chart.yaml with a depName hardcoded in renovate.json5, so they are unaffected. Major bump for all eight: runtime behavior changes. Refs #84 --- calibre-web-automated/Chart.yaml | 2 +- calibre-web-automated/templates/_helpers.tpl | 3 ++- calibre-web-automated/values.yaml | 14 ++++++++++++++ minecraft-router/Chart.yaml | 2 +- minecraft-router/templates/_helpers.tpl | 3 ++- .../templates/minecraft-router.deployment.yaml | 2 +- minecraft-router/values.yaml | 9 +++++++++ outline/Chart.yaml | 2 +- outline/templates/_helpers.tpl | 3 ++- outline/templates/outline.sfs.yaml | 2 +- outline/values.yaml | 9 +++++++++ patchmon/Chart.yaml | 2 +- patchmon/templates/_helpers.tpl | 3 ++- patchmon/values.yaml | 13 ++++++++++++- satisfactory/Chart.yaml | 2 +- satisfactory/templates/_helpers.tpl | 3 ++- satisfactory/values.yaml | 9 +++++++++ urlaubsverwaltung/Chart.yaml | 2 +- urlaubsverwaltung/templates/_helpers.tpl | 3 ++- .../templates/urlaubsverwaltung.deployment.yaml | 2 +- urlaubsverwaltung/values.yaml | 9 +++++++++ voucher-vault/Chart.yaml | 2 +- voucher-vault/templates/_helpers.tpl | 3 ++- voucher-vault/templates/voucher-vault.sfs.yaml | 4 ++-- voucher-vault/values.yaml | 9 +++++++++ zipline/Chart.yaml | 2 +- zipline/templates/_helpers.tpl | 3 ++- zipline/values.yaml | 9 +++++++++ 28 files changed, 109 insertions(+), 22 deletions(-) diff --git a/calibre-web-automated/Chart.yaml b/calibre-web-automated/Chart.yaml index 9fe216a..9d9df6a 100644 --- a/calibre-web-automated/Chart.yaml +++ b/calibre-web-automated/Chart.yaml @@ -5,7 +5,7 @@ name: calibre-web-automated description: A Helm chart to deploy calibere-web-automated icon: https://raw.githubusercontent.com/crocodilestick/Calibre-Web-Automated/main/README_images/cwa-logo-round-dark.png -version: 5.0.0+upv4.0.6 +version: 6.0.0+upv4.0.6 appVersion: v4.0.6 maintainers: diff --git a/calibre-web-automated/templates/_helpers.tpl b/calibre-web-automated/templates/_helpers.tpl index 5303011..4e79193 100644 --- a/calibre-web-automated/templates/_helpers.tpl +++ b/calibre-web-automated/templates/_helpers.tpl @@ -230,7 +230,8 @@ default probe needs no further context. {{- $given := (fromYaml (include "calibre-web-automated.subBlock" (dict "block" . "key" "pod" "path" "cwa.securityContext"))).value -}} {{- $defaults := dict "fsGroup" 1000 - "fsGroupChangePolicy" "Always" -}} + "fsGroupChangePolicy" "Always" + "seccompProfile" (dict "type" "RuntimeDefault") -}} {{- include "calibre-web-automated.defaultedDict" (dict "defaults" $defaults "given" $given "path" "cwa.securityContext.pod") -}} {{- end -}} diff --git a/calibre-web-automated/values.yaml b/calibre-web-automated/values.yaml index 7c5c264..ad59fba 100644 --- a/calibre-web-automated/values.yaml +++ b/calibre-web-automated/values.yaml @@ -65,6 +65,20 @@ cwa: pod: fsGroup: 1000 fsGroupChangePolicy: Always + # RuntimeDefault applies the container runtime's default seccomp filter, + # which blocks the syscalls a normal workload never makes. It sits in the + # pod context on purpose: from here it covers every container in the pod + # including init containers, while a container-level seccompProfile would + # have to be repeated for each one (and silently missed on the next one + # added). A container that genuinely needs a different filter can still + # override it under securityContext.container, which wins over this value. + # + # It is orthogonal to the readOnlyRootFilesystem: false deviation above: + # the filter restricts syscalls, not mount flags, so the s6 init keeps + # its writable root filesystem and the PUID/PGID remapping to uid 1000 + # stays active. Verified against v4.0.6 under the filter. + seccompProfile: + type: RuntimeDefault container: allowPrivilegeEscalation: false readOnlyRootFilesystem: false diff --git a/minecraft-router/Chart.yaml b/minecraft-router/Chart.yaml index 8768f0e..e74f7c0 100644 --- a/minecraft-router/Chart.yaml +++ b/minecraft-router/Chart.yaml @@ -5,7 +5,7 @@ icon: https://avatars.githubusercontent.com/u/988985 type: application -version: 3.0.0+up1.46.4 +version: 4.0.0+up1.46.4 appVersion: "1.46.4" maintainers: diff --git a/minecraft-router/templates/_helpers.tpl b/minecraft-router/templates/_helpers.tpl index 288413e..9cbddbf 100644 --- a/minecraft-router/templates/_helpers.tpl +++ b/minecraft-router/templates/_helpers.tpl @@ -224,7 +224,8 @@ the base image. "runAsUser" 10000 "runAsGroup" 10000 "fsGroup" 10000 - "fsGroupChangePolicy" "Always" -}} + "fsGroupChangePolicy" "Always" + "seccompProfile" (dict "type" "RuntimeDefault") -}} {{- include "minecraft-router.defaultedDict" (dict "defaults" $defaults "given" $given "path" "server.securityContext.pod") -}} {{- end -}} diff --git a/minecraft-router/templates/minecraft-router.deployment.yaml b/minecraft-router/templates/minecraft-router.deployment.yaml index 52d5ab2..c4f8a1f 100644 --- a/minecraft-router/templates/minecraft-router.deployment.yaml +++ b/minecraft-router/templates/minecraft-router.deployment.yaml @@ -27,7 +27,7 @@ spec: {{- include "minecraft-router.podSecurityContext" .Values.server.securityContext | nindent 8 }} containers: - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment - image: "itzg/mc-router:{{ .Chart.AppVersion }}" + image: "docker.io/itzg/mc-router:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent args: - "--port" diff --git a/minecraft-router/values.yaml b/minecraft-router/values.yaml index 07d4784..520a22d 100644 --- a/minecraft-router/values.yaml +++ b/minecraft-router/values.yaml @@ -108,6 +108,15 @@ server: # Keeps the mounted routing-config ConfigMap readable for that gid. fsGroup: 10000 fsGroupChangePolicy: Always + # RuntimeDefault applies the container runtime's default seccomp filter, + # which blocks the syscalls a normal workload never makes. It sits in the + # pod context on purpose: from here it covers every container in the pod + # including init containers, while a container-level seccompProfile would + # have to be repeated for each one (and silently missed on the next one + # added). A container that genuinely needs a different filter can still + # override it under securityContext.container, which wins over this value. + seccompProfile: + type: RuntimeDefault container: allowPrivilegeEscalation: false # No deviation needed: the image ships nothing but the static binary and diff --git a/outline/Chart.yaml b/outline/Chart.yaml index a679123..89280ac 100644 --- a/outline/Chart.yaml +++ b/outline/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/outline/outline/main/public/images/icon- type: application -version: 6.0.0+up1.9.2 +version: 7.0.0+up1.9.2 appVersion: 1.9.2 maintainers: diff --git a/outline/templates/_helpers.tpl b/outline/templates/_helpers.tpl index 14f2228..6efd2e8 100644 --- a/outline/templates/_helpers.tpl +++ b/outline/templates/_helpers.tpl @@ -217,7 +217,8 @@ there is no dependency-free alternative to fall back to. "runAsUser" 1001 "runAsGroup" 1001 "fsGroup" 1001 - "fsGroupChangePolicy" "Always" -}} + "fsGroupChangePolicy" "Always" + "seccompProfile" (dict "type" "RuntimeDefault") -}} {{- include "outline.defaultedDict" (dict "defaults" $defaults "given" $given "path" "outline.securityContext.pod") -}} {{- end -}} diff --git a/outline/templates/outline.sfs.yaml b/outline/templates/outline.sfs.yaml index 5fd488c..584bda4 100644 --- a/outline/templates/outline.sfs.yaml +++ b/outline/templates/outline.sfs.yaml @@ -21,7 +21,7 @@ spec: {{- include "outline.podSecurityContext" .Values.outline.securityContext | nindent 8 }} containers: - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs - image: "outlinewiki/outline:{{ .Chart.AppVersion }}" + image: "docker.io/outlinewiki/outline:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent env: - name: PORT diff --git a/outline/values.yaml b/outline/values.yaml index fdc56d4..28b1970 100644 --- a/outline/values.yaml +++ b/outline/values.yaml @@ -30,6 +30,15 @@ outline: runAsGroup: 1001 fsGroup: 1001 fsGroupChangePolicy: Always + # RuntimeDefault applies the container runtime's default seccomp filter, + # which blocks the syscalls a normal workload never makes. It sits in the + # pod context on purpose: from here it covers every container in the pod + # including init containers, while a container-level seccompProfile would + # have to be repeated for each one (and silently missed on the next one + # added). A container that genuinely needs a different filter can still + # override it under securityContext.container, which wins over this value. + seccompProfile: + type: RuntimeDefault container: allowPrivilegeEscalation: false readOnlyRootFilesystem: true diff --git a/patchmon/Chart.yaml b/patchmon/Chart.yaml index 066f84b..95b0002 100644 --- a/patchmon/Chart.yaml +++ b/patchmon/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/PatchMon/PatchMon/main/frontend/public/a type: application -version: 6.1.0+up2.1.3 +version: 7.0.0+up2.1.3 appVersion: "2.1.3" maintainers: diff --git a/patchmon/templates/_helpers.tpl b/patchmon/templates/_helpers.tpl index a1947e0..eb9d1d5 100644 --- a/patchmon/templates/_helpers.tpl +++ b/patchmon/templates/_helpers.tpl @@ -217,7 +217,8 @@ helpers take dict "given" "root" $. {{- $defaults := dict "runAsNonRoot" true "runAsUser" 65532 - "runAsGroup" 65532 -}} + "runAsGroup" 65532 + "seccompProfile" (dict "type" "RuntimeDefault") -}} {{- include "patchmon.defaultedDict" (dict "defaults" $defaults "given" $given "path" "patchmon.server.securityContext.pod") -}} {{- end -}} diff --git a/patchmon/values.yaml b/patchmon/values.yaml index d8367ab..8535ec6 100644 --- a/patchmon/values.yaml +++ b/patchmon/values.yaml @@ -22,6 +22,17 @@ patchmon: runAsNonRoot: true runAsUser: 65532 runAsGroup: 65532 + # RuntimeDefault applies the container runtime's default seccomp + # filter, which blocks the syscalls a normal workload never makes. It + # sits in the pod context on purpose: from here it covers every + # container in the pod - the server and the optional guacd sidecar + # alike - including init containers, while a container-level + # seccompProfile would have to be repeated for each one (and silently + # missed on the next one added). A container that genuinely needs a + # different filter can still override it under + # securityContext.container, which wins over this value. + seccompProfile: + type: RuntimeDefault container: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -88,7 +99,7 @@ patchmon: enabled: false # guacd is an independent upstream application, so its image is not tied # to the chart's appVersion. Pinned to the version upstream ships with. - image: guacamole/guacd:1.6.0 + image: docker.io/guacamole/guacd:1.6.0 # The image runs as its own unprivileged user (uid 1000); it only needs a # writable /tmp, which the chart provides as an emptyDir. securityContext: diff --git a/satisfactory/Chart.yaml b/satisfactory/Chart.yaml index 8dc9a24..8a4c558 100644 --- a/satisfactory/Chart.yaml +++ b/satisfactory/Chart.yaml @@ -3,7 +3,7 @@ name: satisfactory description: A Helm chart to deploy a Satisfactory Gameserver on Kubernetes icon: https://raw.githubusercontent.com/wolveix/satisfactory-server/main/.github/logo.png type: application -version: 5.0.0+upv1.9.10 +version: 6.0.0+upv1.9.10 appVersion: "v1.9.10" maintainers: - name: jklein \ No newline at end of file diff --git a/satisfactory/templates/_helpers.tpl b/satisfactory/templates/_helpers.tpl index 0064327..b098df9 100644 --- a/satisfactory/templates/_helpers.tpl +++ b/satisfactory/templates/_helpers.tpl @@ -224,7 +224,8 @@ Probe specifics that a rebuilt default must not lose: "runAsUser" 1000 "runAsGroup" 1000 "fsGroup" 1000 - "fsGroupChangePolicy" "OnRootMismatch" -}} + "fsGroupChangePolicy" "OnRootMismatch" + "seccompProfile" (dict "type" "RuntimeDefault") -}} {{- include "satisfactory.defaultedDict" (dict "defaults" $defaults "given" $given "path" "securityContext.pod") -}} {{- end -}} diff --git a/satisfactory/values.yaml b/satisfactory/values.yaml index 8c5d7aa..13ef3c4 100644 --- a/satisfactory/values.yaml +++ b/satisfactory/values.yaml @@ -97,6 +97,15 @@ securityContext: # entrypoint. fsGroup: 1000 fsGroupChangePolicy: OnRootMismatch + # RuntimeDefault applies the container runtime's default seccomp filter, + # which blocks the syscalls a normal workload never makes. It sits in the + # pod context on purpose: from here it covers every container in the pod + # including init containers, while a container-level seccompProfile would + # have to be repeated for each one (and silently missed on the next one + # added). A container that genuinely needs a different filter can still + # override it under securityContext.container, which wins over this value. + seccompProfile: + type: RuntimeDefault container: allowPrivilegeEscalation: false # Works because the chart mounts emptyDirs at /tmp and the steam user's diff --git a/urlaubsverwaltung/Chart.yaml b/urlaubsverwaltung/Chart.yaml index 884bb52..2fe6eb3 100644 --- a/urlaubsverwaltung/Chart.yaml +++ b/urlaubsverwaltung/Chart.yaml @@ -4,5 +4,5 @@ description: A Helm chart to deploy urlaubsverwaltung on Kubernetes icon: https://raw.githubusercontent.com/urlaubsverwaltung/urlaubsverwaltung/main/src/main/resources/static/favicons/apple-touch-icon.png type: application -version: 7.0.0+up6.7.0 +version: 8.0.0+up6.7.0 appVersion: 6.7.0 diff --git a/urlaubsverwaltung/templates/_helpers.tpl b/urlaubsverwaltung/templates/_helpers.tpl index 2c32068..d92d863 100644 --- a/urlaubsverwaltung/templates/_helpers.tpl +++ b/urlaubsverwaltung/templates/_helpers.tpl @@ -213,7 +213,8 @@ is only the fallback for the case where an override has erased the block. {{- $defaults := dict "runAsNonRoot" true "runAsUser" 1002 - "runAsGroup" 1001 -}} + "runAsGroup" 1001 + "seccompProfile" (dict "type" "RuntimeDefault") -}} {{- include "urlaubsverwaltung.defaultedDict" (dict "defaults" $defaults "given" $given "path" "urlaubsverwaltung.securityContext.pod") -}} {{- end -}} diff --git a/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml b/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml index 9d9653e..0b7755b 100644 --- a/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml +++ b/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml @@ -20,7 +20,7 @@ spec: {{- include "urlaubsverwaltung.podSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 8 }} containers: - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment - image: "urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}" + image: "docker.io/urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent securityContext: {{- include "urlaubsverwaltung.containerSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 12 }} diff --git a/urlaubsverwaltung/values.yaml b/urlaubsverwaltung/values.yaml index f6ca655..a83750f 100644 --- a/urlaubsverwaltung/values.yaml +++ b/urlaubsverwaltung/values.yaml @@ -29,6 +29,15 @@ urlaubsverwaltung: runAsNonRoot: true runAsUser: 1002 runAsGroup: 1001 + # RuntimeDefault applies the container runtime's default seccomp filter, + # which blocks the syscalls a normal workload never makes. It sits in the + # pod context on purpose: from here it covers every container in the pod + # including init containers, while a container-level seccompProfile would + # have to be repeated for each one (and silently missed on the next one + # added). A container that genuinely needs a different filter can still + # override it under securityContext.container, which wins over this value. + seccompProfile: + type: RuntimeDefault container: allowPrivilegeEscalation: false readOnlyRootFilesystem: true diff --git a/voucher-vault/Chart.yaml b/voucher-vault/Chart.yaml index 58b5663..36a1da0 100644 --- a/voucher-vault/Chart.yaml +++ b/voucher-vault/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/l4rm4nd/VoucherVault/main/myapp/static/a type: application -version: 5.0.0+up1.30.1 +version: 6.0.0+up1.30.1 appVersion: "1.30.1" maintainers: diff --git a/voucher-vault/templates/_helpers.tpl b/voucher-vault/templates/_helpers.tpl index 7b10ed9..6099f50 100644 --- a/voucher-vault/templates/_helpers.tpl +++ b/voucher-vault/templates/_helpers.tpl @@ -217,7 +217,8 @@ header, otherwise the pod never becomes ready. "runAsUser" 33 "runAsGroup" 33 "fsGroup" 33 - "fsGroupChangePolicy" "Always" -}} + "fsGroupChangePolicy" "Always" + "seccompProfile" (dict "type" "RuntimeDefault") -}} {{- include "voucher-vault.defaultedDict" (dict "defaults" $defaults "given" $given "path" "voucherVault.securityContext.pod") -}} {{- end -}} diff --git a/voucher-vault/templates/voucher-vault.sfs.yaml b/voucher-vault/templates/voucher-vault.sfs.yaml index 79045ec..095978d 100644 --- a/voucher-vault/templates/voucher-vault.sfs.yaml +++ b/voucher-vault/templates/voucher-vault.sfs.yaml @@ -27,7 +27,7 @@ spec: # entrypoint's collectstatic only adds what is missing, e.g. the # Django admin static files). See securityContext in values.yaml. - name: init-static - image: "l4rm4nd/vouchervault:{{ .Chart.AppVersion }}" + image: "docker.io/l4rm4nd/vouchervault:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent # Copies the children (not ".") so cp never tries to set metadata # on the mountpoint itself, which the non-root uid may not own. @@ -48,7 +48,7 @@ spec: ephemeral-storage: 10Mi containers: - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs - image: "l4rm4nd/vouchervault:{{ .Chart.AppVersion }}" + image: "docker.io/l4rm4nd/vouchervault:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent env: {{- range $value := .Values.voucherVault.env }} diff --git a/voucher-vault/values.yaml b/voucher-vault/values.yaml index 087b59b..5e0c90c 100644 --- a/voucher-vault/values.yaml +++ b/voucher-vault/values.yaml @@ -74,6 +74,15 @@ voucherVault: runAsGroup: 33 fsGroup: 33 fsGroupChangePolicy: Always + # RuntimeDefault applies the container runtime's default seccomp filter, + # which blocks the syscalls a normal workload never makes. It sits in the + # pod context on purpose: from here it covers every container in the pod + # including init containers, while a container-level seccompProfile would + # have to be repeated for each one (and silently missed on the next one + # added). A container that genuinely needs a different filter can still + # override it under securityContext.container, which wins over this value. + seccompProfile: + type: RuntimeDefault container: allowPrivilegeEscalation: false readOnlyRootFilesystem: true diff --git a/zipline/Chart.yaml b/zipline/Chart.yaml index 2e721d2..4eb8f74 100644 --- a/zipline/Chart.yaml +++ b/zipline/Chart.yaml @@ -16,7 +16,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 6.0.0+up4.7.0 +version: 7.0.0+up4.7.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/zipline/templates/_helpers.tpl b/zipline/templates/_helpers.tpl index c13c65a..ae97789 100644 --- a/zipline/templates/_helpers.tpl +++ b/zipline/templates/_helpers.tpl @@ -218,7 +218,8 @@ a database outage must not restart the pod. "runAsUser" 1000 "runAsGroup" 1000 "fsGroup" 1000 - "fsGroupChangePolicy" "Always" -}} + "fsGroupChangePolicy" "Always" + "seccompProfile" (dict "type" "RuntimeDefault") -}} {{- include "zipline.defaultedDict" (dict "defaults" $defaults "given" $given "path" "zipline.securityContext.pod") -}} {{- end -}} diff --git a/zipline/values.yaml b/zipline/values.yaml index a406274..44cd144 100644 --- a/zipline/values.yaml +++ b/zipline/values.yaml @@ -26,6 +26,15 @@ zipline: runAsGroup: 1000 fsGroup: 1000 fsGroupChangePolicy: Always + # RuntimeDefault applies the container runtime's default seccomp filter, + # which blocks the syscalls a normal workload never makes. It sits in the + # pod context on purpose: from here it covers every container in the pod + # including init containers, while a container-level seccompProfile would + # have to be repeated for each one (and silently missed on the next one + # added). A container that genuinely needs a different filter can still + # override it under securityContext.container, which wins over this value. + seccompProfile: + type: RuntimeDefault container: allowPrivilegeEscalation: false readOnlyRootFilesystem: true