Felix Wolf
|
33c52be1c5
|
feat(pss): drop 5 namespaces from PSS privileged to restricted
argocd, cert-manager, cloudnative-pg already compliant — label flip only.
ocis: add overlay injecting seccompProfile=RuntimeDefault, drop ALL caps,
allowPrivilegeEscalation=false across all chart Deployments/CronJobs;
patch idm initContainer; harden custom precheck Job; refactor s3-backup
to rclone/rclone image (avoids apk-add-as-root).
victoria-metrics-single: overlay sets full restricted SC on the StatefulSet
that ships with empty securityContext: {}.
forgejo, traefik, kube-system stay privileged (hostPort / CSI driver).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
2026-05-03 01:24:59 +02:00 |
|
|
Felix Wolf
|
25714eeef6
|
feat: Migrate Forgejo to CNPG PostgreSQL + Hetzner CSI volumes
- Add hcloud-csi prototype (Hetzner Cloud CSI driver)
- Add cloudnative-pg prototype (CNPG operator)
- Add CNPG Cluster CR for Forgejo (2 instances, lean config for 4GB nodes)
- Add 20Gi hcloud-volumes PVC for Forgejo git repos
- Switch Forgejo from SQLite to PostgreSQL (forgejo-cnpg-rw service)
- Switch Forgejo persistence to hcloud-volumes (forgejo-git-storage)
- Fix ClusterRoleBinding subject namespaces for hcloud-csi and CNPG
- Fix CNPG webhook service namespace references
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
2026-04-03 16:37:13 +02:00 |
|