Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

urlaubsverwaltung/Chart.yaml

@@ -3,5 +3,5 @@ name: urlaubsverwaltung
 description: A Helm chart to deploy urlaubsverwaltung on Kubernetes
 type: application
 
-version: 2.0.0+up6.5.0
+version: 3.0.0+up6.5.0
 appVersion: 6.5.0

urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml

@@ -16,10 +16,19 @@ spec:
         app: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        {{- toYaml .Values.urlaubsverwaltung.securityContext.pod | nindent 8 }}
       containers:
         - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-container
           image: "urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          securityContext:
+            {{- toYaml .Values.urlaubsverwaltung.securityContext.container | nindent 12 }}
+          volumeMounts:
+            # The JVM (Tomcat work dir, temp files) needs a writable /tmp with
+            # a read-only root filesystem.
+            - name: tmp
+              mountPath: /tmp
           ports:
             - containerPort: 8080
               name: http
@@ -134,4 +143,7 @@ spec:
             periodSeconds: 10
             failureThreshold: 30
             timeoutSeconds: 5
+      volumes:
+        - name: tmp
+          emptyDir: {}
       restartPolicy: Always

urlaubsverwaltung/values.yaml

@@ -7,6 +7,21 @@ ingress:
   domain: null
 
 urlaubsverwaltung:
+  # The official image is built with Cloud Native Buildpacks and runs as the
+  # non-root cnb user (uid 1002, gid 1001). /tmp is a writable emptyDir for
+  # the JVM's temp/work files.
+  securityContext:
+    pod:
+      runAsNonRoot: true
+      runAsUser: 1002
+      runAsGroup: 1001
+    container:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      capabilities:
+        drop:
+          - ALL
   resources:
     requests:
       cpu: 0.1