jklein
b5eba4cbf1
Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem, capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads that lacked it: apache-tika, cyberchef, gotenberg, homeassistant, matrix-delegation-nginx, paperless-server, paperless-consume cronjob (plus automountServiceAccountToken false), patchmon-frontend, urlaubsverwaltung and zipline. All contexts are configurable via securityContext.pod / securityContext.container in values.yaml; writable paths are provided as emptyDirs. Image-forced deviations (Home Assistant root start for s6-overlay + NET_RAW for discovery, paperless root init container for /run ownership) are documented in the charts' values.yaml. Major version bump for every changed published chart.
56 lines
1.3 KiB
YAML
56 lines
1.3 KiB
YAML
cyberchef:
|
|
# The upstream image is stock nginx (root, listening on port 80). To still
|
|
# run fully non-root, the pod runs as the image's nginx user (uid 101) and
|
|
# the safe sysctl net.ipv4.ip_unprivileged_port_start=80 lets the unprivileged
|
|
# nginx bind port 80 without NET_BIND_SERVICE.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
sysctls:
|
|
- name: net.ipv4.ip_unprivileged_port_start
|
|
value: "80"
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
resources:
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 512Mi
|
|
ephemeralStorage: 10Mi
|
|
limits:
|
|
cpu: 1
|
|
memory: 768Mi
|
|
ephemeralStorage: 100Mi
|
|
|
|
ingress:
|
|
enabled: true
|
|
clusterIssuer: letsencrypt
|
|
domain: null |