fix(chart): enforce non-root security context and resource limits #8

Merged

rs merged 6 commits from fix/chart-security into main

2026-09-02 21:50:01 +00:00

rs commented

2026-09-02 21:39:27 +00:00

Owner

Fixes the lint-and-check-kubernetes PR job for good. With the node/checkout problem solved in #6, the job now actually runs kube-linter — and fails on 4 legitimate findings that were hidden behind the earlier tooling failure (verified locally with kube-linter 0.8.3, same as builder-kube):

run-as-non-root — container awc does not enforce runAsNonRoot
no-read-only-root-fs — no readOnlyRootFilesystem
unset-cpu-requirements — no CPU request
unset-memory-requirements — no memory limit

The run-as-non-root finding even contradicted the project's own constraint C5 ("must run as a non-root user") — the image is distroless nonroot, but nothing enforced it at the cluster level.

Changes

chart/acidwaifu/templates/acidwaifu-cronjob.yaml — container-level securityContext:

securityContext:
  runAsNonRoot: true
  runAsUser: 65532        # distroless nonroot
  runAsGroup: 65532
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]
resources:
  requests: { cpu: 100m, memory: 128Mi }
  limits: { cpu: 500m, memory: 256Mi }

Read-only root filesystem is safe: the app's only file writes go to /var/log, a writable emptyDir mount
Chart version bumped 3.7.0 → 3.7.1

docs/arc42-architecture.md — §7.4 documents the enforced security context and resources, and the relationship to constraint C5 and the kube-linter gate.

.forgejo/workflows/on_pr.yaml — clone step now runs with GIT_TERMINAL_PROMPT=0, so an auth problem produces a clean non-zero error instead of hanging on a credential prompt with no TTY.

Verification

helm lint passes
helm template render checked — securityContext/resources present
kube-linter lint . on this branch: No lint errors found, exit 0 (was: 4 errors, exit 1)

Fixes the `lint-and-check-kubernetes` PR job for good. With the node/checkout problem solved in #6, the job now actually runs kube-linter — and fails on **4 legitimate findings** that were hidden behind the earlier tooling failure (verified locally with kube-linter 0.8.3, same as `builder-kube`): - `run-as-non-root` — container `awc` does not enforce `runAsNonRoot` - `no-read-only-root-fs` — no `readOnlyRootFilesystem` - `unset-cpu-requirements` — no CPU request - `unset-memory-requirements` — no memory limit The `run-as-non-root` finding even contradicted the project's own constraint C5 ("must run as a non-root user") — the image is distroless `nonroot`, but nothing enforced it at the cluster level. ## Changes **`chart/acidwaifu/templates/acidwaifu-cronjob.yaml`** — container-level `securityContext`: ```yaml securityContext: runAsNonRoot: true runAsUser: 65532 # distroless nonroot runAsGroup: 65532 allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: ["ALL"] resources: requests: { cpu: 100m, memory: 128Mi } limits: { cpu: 500m, memory: 256Mi } ``` - Read-only root filesystem is safe: the app's only file writes go to `/var/log`, a writable emptyDir mount - Chart version bumped `3.7.0` → `3.7.1` **`docs/arc42-architecture.md`** — §7.4 documents the enforced security context and resources, and the relationship to constraint C5 and the kube-linter gate. **`.forgejo/workflows/on_pr.yaml`** — clone step now runs with `GIT_TERMINAL_PROMPT=0`, so an auth problem produces a clean non-zero error instead of hanging on a credential prompt with no TTY. ## Verification - `helm lint` passes - `helm template` render checked — securityContext/resources present - `kube-linter lint .` on this branch: **No lint errors found, exit 0** (was: 4 errors, exit 1)

rs added 2 commits

2026-09-02 21:39:27 +00:00