k8s-and-chill

gitea_admin/k8s-and-chill

Fork 0

Commit graph

Author	SHA1	Message	Date
Felix Wolf	33c52be1c5	feat(pss): drop 5 namespaces from PSS privileged to restricted argocd, cert-manager, cloudnative-pg already compliant — label flip only. ocis: add overlay injecting seccompProfile=RuntimeDefault, drop ALL caps, allowPrivilegeEscalation=false across all chart Deployments/CronJobs; patch idm initContainer; harden custom precheck Job; refactor s3-backup to rclone/rclone image (avoids apk-add-as-root). victoria-metrics-single: overlay sets full restricted SC on the StatefulSet that ships with empty securityContext: {}. forgejo, traefik, kube-system stay privileged (hostPort / CSI driver). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-03 01:24:59 +02:00
Felix Wolf	1122c3f0e2	feat: Implement S3 to Storage Box backup Introduces a daily Kubernetes CronJob that utilizes rclone to perform compressed backups of oCIS S3 data to a Hetzner Storage Box via SFTP. This new backup mechanism requires the manual creation of an 'ocis-storagebox-credentials' secret, which holds the Storage Box host, user, and SSH private key. A check is added to the secret initialization job to ensure this essential external secret exists.	2026-04-06 15:24:14 +02:00

Author

SHA1

Message

Date

Felix Wolf

33c52be1c5

feat(pss): drop 5 namespaces from PSS privileged to restricted

argocd, cert-manager, cloudnative-pg already compliant — label flip only.
ocis: add overlay injecting seccompProfile=RuntimeDefault, drop ALL caps,
allowPrivilegeEscalation=false across all chart Deployments/CronJobs;
patch idm initContainer; harden custom precheck Job; refactor s3-backup
to rclone/rclone image (avoids apk-add-as-root).
victoria-metrics-single: overlay sets full restricted SC on the StatefulSet
that ships with empty securityContext: {}.

forgejo, traefik, kube-system stay privileged (hostPort / CSI driver).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-03 01:24:59 +02:00

Felix Wolf

1122c3f0e2

feat: Implement S3 to Storage Box backup

Introduces a daily Kubernetes CronJob that utilizes rclone to perform compressed backups of oCIS S3 data to a Hetzner Storage Box via SFTP.

This new backup mechanism requires the manual creation of an 'ocis-storagebox-credentials' secret, which holds the Storage Box host, user, and SSH private key. A check is added to the secret initialization job to ensure this essential external secret exists.

2026-04-06 15:24:14 +02:00

2 commits