jklein
b5eba4cbf1
Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem, capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads that lacked it: apache-tika, cyberchef, gotenberg, homeassistant, matrix-delegation-nginx, paperless-server, paperless-consume cronjob (plus automountServiceAccountToken false), patchmon-frontend, urlaubsverwaltung and zipline. All contexts are configurable via securityContext.pod / securityContext.container in values.yaml; writable paths are provided as emptyDirs. Image-forced deviations (Home Assistant root start for s6-overlay + NET_RAW for discovery, paperless root init container for /run ownership) are documented in the charts' values.yaml. Major version bump for every changed published chart.
52 lines
1.2 KiB
YAML
52 lines
1.2 KiB
YAML
patchmon:
|
|
storage:
|
|
size: 10Gi
|
|
storageClass: null
|
|
frontend:
|
|
# The frontend image is based on nginx-unprivileged; the pod runs as its
|
|
# nginx user (uid 101). The image's root-only init script (it would chown
|
|
# the shared assets volume) is replaced by fsGroup 1000: the same group
|
|
# the backend runs with, so both can read/write the shared assets.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 128Mi
|
|
ephemeral-storage: 10Mi
|
|
limits:
|
|
cpu: 0.5
|
|
memory: 265Mi
|
|
ephemeral-storage: 100Mi
|
|
backend:
|
|
resources:
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 512Mi
|
|
ephemeral-storage: 10Mi
|
|
limits:
|
|
cpu: 1
|
|
memory: 768Mi
|
|
ephemeral-storage: 100Mi
|
|
|
|
ingress:
|
|
clusterIssuer: null
|
|
domain: null
|
|
|
|
secrets:
|
|
redisSecretRef: null
|
|
postgresSecretRef: null
|
|
oidcSecretRef: null
|
|
patchmonSecretRef: null |