Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

cyberchef/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Cyberchef on Kubernetes
 
 type: application
 
-version: 2.0.0+up10.22.1
+version: 3.0.0+up10.22.1
 appVersion: "10.22.1"
 
 maintainers:

cyberchef/templates/cyberchef.deployment.yaml

@@ -16,10 +16,21 @@ spec:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        {{- toYaml .Values.cyberchef.securityContext.pod | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "ghcr.io/gchq/cyberchef:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          securityContext:
+            {{- toYaml .Values.cyberchef.securityContext.container | nindent 12 }}
+          volumeMounts:
+            # nginx needs writable cache/temp dirs and a writable pid file
+            # location when the root filesystem is read-only.
+            - name: nginx-cache
+              mountPath: /var/cache/nginx
+            - name: nginx-run
+              mountPath: /run
           ports:
             - containerPort: 80
               protocol: TCP
@@ -39,4 +50,9 @@ spec:
               memory: "{{ .Values.cyberchef.resources.limits.memory }}"
               cpu: "{{ .Values.cyberchef.resources.limits.cpu }}"
               ephemeral-storage: "{{ .Values.cyberchef.resources.limits.ephemeralStorage }}"
+      volumes:
+        - name: nginx-cache
+          emptyDir: {}
+        - name: nginx-run
+          emptyDir: {}
       restartPolicy: Always

cyberchef/values.yaml

@@ -1,4 +1,23 @@
 cyberchef:
+  # The upstream image is stock nginx (root, listening on port 80). To still
+  # run fully non-root, the pod runs as the image's nginx user (uid 101) and
+  # the safe sysctl net.ipv4.ip_unprivileged_port_start=80 lets the unprivileged
+  # nginx bind port 80 without NET_BIND_SERVICE.
+  securityContext:
+    pod:
+      runAsNonRoot: true
+      runAsUser: 101
+      runAsGroup: 101
+      sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "80"
+    container:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      capabilities:
+        drop:
+          - ALL
   livenessProbe:
     httpGet:
       path: /