Harden pod and container security contexts across all workloads

0 Fork 0

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

This commit is contained in:

jklein committed 2026-08-21 21:49:05 +02:00

1 parent 6dd80e3874

commit b5eba4cbf1

31 files changed

+357 -16

No files matched your search

									
										apache-tika/Chart.yaml
									
		+1
		-1
	
												View File
												
				@@ -4,5 +4,5 @@ description: A Helm chart to deploy Apache Tika on Kubernetes

				type: application

				version: 5.0.0+up3.2.3.0.full

				version: 6.0.0+up3.2.3.0.full

				appVersion: "3.2.3.0-full"