jklein
b5eba4cbf1
Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem, capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads that lacked it: apache-tika, cyberchef, gotenberg, homeassistant, matrix-delegation-nginx, paperless-server, paperless-consume cronjob (plus automountServiceAccountToken false), patchmon-frontend, urlaubsverwaltung and zipline. All contexts are configurable via securityContext.pod / securityContext.container in values.yaml; writable paths are provided as emptyDirs. Image-forced deviations (Home Assistant root start for s6-overlay + NET_RAW for discovery, paperless root init container for /run ownership) are documented in the charts' values.yaml. Major version bump for every changed published chart.
49 lines
2.1 KiB
YAML
49 lines
2.1 KiB
YAML
{{- if .Values.smbConnection.enabled }}
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-consume-cronjob
|
|
spec:
|
|
schedule: {{ .Values.smbConnection.cronJob }}
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- toYaml .Values.smbConnection.cron.securityContext.pod | nindent 12 }}
|
|
containers:
|
|
- name: paperless-consume-cronjob
|
|
image: busybox:1.28
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
{{- toYaml .Values.smbConnection.cron.securityContext.container | nindent 16 }}
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- if [ "$(find /mnt/smb -maxdepth 1 -name "*.pdf" -print)" ]; then mv /mnt/smb/*.pdf /mnt/consume; fi
|
|
volumeMounts:
|
|
- name: smb-share
|
|
mountPath: "/mnt/smb"
|
|
readOnly: false
|
|
- name: consume-folder
|
|
mountPath: "/mnt/consume"
|
|
readOnly: false
|
|
resources:
|
|
requests:
|
|
memory: "{{ .Values.smbConnection.cron.resources.requests.memory }}"
|
|
cpu: "{{ .Values.smbConnection.cron.resources.requests.cpu }}"
|
|
ephemeral-storage: "{{ .Values.smbConnection.cron.resources.requests.ephemeralStorage }}"
|
|
limits:
|
|
memory: "{{ .Values.smbConnection.cron.resources.limits.memory }}"
|
|
cpu: "{{ .Values.smbConnection.cron.resources.limits.cpu }}"
|
|
ephemeral-storage: "{{ .Values.smbConnection.cron.resources.limits.ephemeralStorage }}"
|
|
restartPolicy: Never
|
|
volumes:
|
|
- name: smb-share
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Release.Name }}-{{ .Chart.Name }}-smb-volume-claim
|
|
- name: consume-folder
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Release.Name }}-{{ .Chart.Name }}-consume-volume-claim
|
|
{{- end }} |