gitea_admin/k8s-and-chill
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: gitea_admin:010c47b03bdb2c9363485e4d2f735e54f5e4a1c4
Branches Tags
gitea_admin:main
..
compare: gitea_admin:0389eb5d205d6ead36b2442ba5c59a18d2921a40
Branches Tags
gitea_admin:main

2 commits
010c47b03b ... 0389eb5d20

Author SHA1 Message Date
Felix Wolf 0389eb5d20 feat(monitoring): Add comprehensive oCIS monitoring 
Integrates oCIS services into the monitoring stack by:
- Adding a new scrape configuration to VictoriaMetrics to collect metrics from oCIS services in the 'ocis' namespace.
- Introducing a new "ocis Overview" Grafana dashboard. This dashboard includes panels for user experience (proxy), service health, storage activity (uploads/downloads), and resource utilization, all leveraging the VictoriaMetrics datasource.
 2026-05-03 01:25:15 +02:00
Felix Wolf 33c52be1c5 feat(pss): drop 5 namespaces from PSS privileged to restricted 
argocd, cert-manager, cloudnative-pg already compliant — label flip only.
ocis: add overlay injecting seccompProfile=RuntimeDefault, drop ALL caps,
allowPrivilegeEscalation=false across all chart Deployments/CronJobs;
patch idm initContainer; harden custom precheck Job; refactor s3-backup
to rclone/rclone image (avoids apk-add-as-root).
victoria-metrics-single: overlay sets full restricted SC on the StatefulSet
that ships with empty securityContext: {}.

forgejo, traefik, kube-system stay privileged (hostPort / CSI driver).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-03 01:24:59 +02:00
Show stats Expand all files Collapse all files

Diff content is not available