jklein
b5eba4cbf1
Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem, capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads that lacked it: apache-tika, cyberchef, gotenberg, homeassistant, matrix-delegation-nginx, paperless-server, paperless-consume cronjob (plus automountServiceAccountToken false), patchmon-frontend, urlaubsverwaltung and zipline. All contexts are configurable via securityContext.pod / securityContext.container in values.yaml; writable paths are provided as emptyDirs. Image-forced deviations (Home Assistant root start for s6-overlay + NET_RAW for discovery, paperless root init container for /run ownership) are documented in the charts' values.yaml. Major version bump for every changed published chart.
48 lines
1.1 KiB
YAML
48 lines
1.1 KiB
YAML
matrix:
|
|
serverName: null
|
|
timezone: UTC
|
|
configSecretRef: null
|
|
delegation:
|
|
enabled: false
|
|
serverUrl: null
|
|
# The delegation nginx runs as the image's unprivileged nginx user
|
|
# (uid 101) and listens on the unprivileged port 8080; pid file and temp
|
|
# paths are redirected to the /tmp emptyDir by the mounted nginx.conf.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
limits:
|
|
memory: "128Mi"
|
|
cpu: "250m"
|
|
ephemeralStorage: "100Mi"
|
|
requests:
|
|
memory: "64Mi"
|
|
cpu: "125m"
|
|
ephemeralStorage: "50Mi"
|
|
resources:
|
|
requests:
|
|
memory: "1Gi"
|
|
cpu: "1"
|
|
ephemeralStorage: "1Gi"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "2"
|
|
ephemeralStorage: "2Gi"
|
|
|
|
storage:
|
|
amount: 10Gi
|
|
storageClass: longhorn-encrypted
|
|
|
|
ingress:
|
|
domain: null
|
|
clusterIssuer: null |