800a19801744a0675639230c255a22144f97a5b3
3
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 jklein
|
6c73ef874b
|
Eight charts: seccompProfile RuntimeDefault and qualified images
Sets seccompProfile.type: RuntimeDefault in the pod security context of minecraft-router, outline, urlaubsverwaltung, zipline, voucher-vault, satisfactory, patchmon and calibre-web-automated, so the container runtime's default syscall filter applies to every container in the pod. The value lives in the pod context rather than the container context because it covers init containers and any container added later without being repeated; a container that needs a different filter can still override it under securityContext.container, which wins over the pod value. Five of the eight also get the docker.io/ prefix on their previously unqualified image references, so the pull no longer depends on the runtime's default-registry setting: itzg/mc-router, outlinewiki/outline, urlaubsverwaltung/urlaubsverwaltung, l4rm4nd/vouchervault (twice, app and init container) and guacamole/guacd:1.6.0. zipline, satisfactory and calibre-web-automated were already qualified with ghcr.io. Verified in a throwaway k3d cluster against real application work, not just a Running pod, and with Seccomp: 2 (filter mode) read from /proc/<pid>/status inside each container: - minecraft-router: a Minecraft handshake for a mapped domain travels through the router to a backend and the backend's status payload comes back to the client. - outline: all migrations apply (45 tables), OIDC discovery succeeds and the server-rendered page answers 200 with <title>Outline</title>. - urlaubsverwaltung: Liquibase applies 79 changesets (35 tables), the app seeds its settings and vacation types, /login answers 200. - zipline: 27 migrations applied, then a full round trip - first user created, login, token, upload, and the file downloaded back byte-exact from the PVC. - voucher-vault: the init container's collectstatic output is served (200, 22 KB), Django has its 22 tables and uWSGI answers 200 with <title>VoucherVault</title>. - satisfactory: application behavior is NOT proven - the image is multiple GB and pulls 10 GB+ of game files on first start, which is why the chart sits in ci/excluded-charts.txt. What is proven is that the rendered pod securityContext is accepted server-side and yields Seccomp: 2 with uid/gid 1000 on a substitute image. - patchmon: both containers run under the pod profile and both report Seccomp: 2. The server applies 47 migrations (44 tables), connects to Postgres and Redis and serves its dashboard; guacd answers a real Guacamole "select rdp" instruction with its full args list, over the same 127.0.0.1:4822 path the chart wires up. - calibre-web-automated: the readOnlyRootFilesystem: false deviation is unaffected - id abc is still uid 1000 (not the 911 the image falls back to in read-only mode), /config and the Calibre metadata.db are owned by 1000, and both the root s6 init and the uid-1000 application report Seccomp: 2. calibredb 9.1 runs and adds a book. Its IPC worker prints a traceback while doing so, but an unconfined control pod on the same image prints the same class of traceback, so it is not the filter. trivy config now reports "0 to act on" for all eight; the untouched samba still shows KSV-0104 and KSV-0030, which confirms these charts are what closed the findings. No values.schema.json needed changing: in all eight schemas securityContext.pod is type ["object", "null"] with no property restrictions, so the new key validates as it stands. The #99 null paths still hold - nulling securityContext or securityContext.pod falls back to the defaults including the new one. Renovate resolves the prefixed guacd reference: a local dry-run lookup (renovate 44.40.1, --platform=local --dry-run=lookup) reports depName docker.io/guacamole/guacd against registryUrl https://index.docker.io with lookupName guacamole/guacd, currentVersion 1.6.0 and its real release timestamp, with no warnings. The other four prefixed references live in templates, which Renovate never reads - they are tracked by the customManagers via appVersion in Chart.yaml with a depName hardcoded in renovate.json5, so they are unaffected. Major bump for all eight: runtime behavior changes. Refs #84 |
||
|
jklein
|
a76accf7ad
|
minecraft-router: strict values.schema.json and null-safe hardening
No ingress gate: this chart has no Ingress at all (clients reach it via a NodePort), and ingress.domain appears neither in its templates nor in its values. 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including the entries of the mappings list, where domain and internalUrl are required. 2. Null-safety for hardening, probes and resources (#99). Two things a rebuilt default probe must not lose, both verified: - the API port is addressed by NAME ("api-port"), so the probe keeps working when server.apiPort is overridden. - mc-router still has no /health endpoint in 1.46.4, so GET /routes is the health signal, and the "Accept: application/json" header belongs to that request. The pod context keeps pinning uid/gid 10000 even though the image declares USER 65532 since 1.46.0, so the runtime identity does not silently change with the base image. mappings stays deliberately not null-safe: the chart fails loudly on a missing or empty routing table, which is the loud class #99 excludes - a router without routes is not operable and has no sensible default. Rendering with normal values is byte-identical to 2.0.0. |
||
|
jklein
|
c20ad389f2
|
Minecraft-router chart: naming scheme, hardening, probes, values interface
Stage 2 of the Fleet migration for minecraft-router: bring the chart up to the
repo style guidelines. Chart 0.1.1+up1.25.1 -> 1.0.0+up1.25.1 (major: resource
renames, mappings becomes required, probes and security hardening change the
runtime behavior; appVersion unchanged).
- Resources renamed to {{ .Release.Name }}-{{ .Chart.Name }}-<kind>, templates
to <chart>.<kind>.yaml; the deployment label now matches its own selector.
- mappings is required and must not be empty (the old default rendered
"<nil>": "<nil>:25565"); every entry needs domain and internalUrl.
- Ports come from values: server.port (router listen port, also passed as
--port), server.backendPort (default backend port, overridable per mapping),
server.apiPort (--api-binding, used by the probes). Defaults stay 25565 /
25565 / 8080, server.outwardPort keeps its 25565 default and comment.
- _helpers.tpl added (resources/limitFactor and replicas/scaleDown helpers),
resources come from values, no CPU limit.
- replicas value plus the chart-global scaleDown flag.
- Additive env block rendered through tpl (value / secretKeyRef /
configMapKeyRef).
- Values-configurable securityContext.pod / .container with hardened defaults:
non-root uid/gid 10000, readOnlyRootFilesystem, no privilege escalation, all
capabilities dropped.
- Liveness, readiness and startup probes on the mc-router API: GET /routes with
an "Accept: application/json" header (the API router matches on that header
and answers 404 without it).
- icon added to Chart.yaml.
- CI fixture supplies mappings; README chart table entry updated.
|