fix(OPENFRAM-005-4): CU-86akbhg46 MongoDB Meshcentral StatefulSet init containers run as root without dropped capabilities

[flamingo]

Closes findings from rule OPENFRAM-005-4 — MongoDB Meshcentral StatefulSet init containers run as root without dropped capabilities.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🔴 55 low — review closely	MongoDB Meshcentral StatefulSet init containers run as root without dropped capabilities	manifests/datasources/mongodb-meshcentral/templates/statefulset.yaml:25

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 12cfe861-f81f-494f-94f7-58bce1e4ddc7

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhg46 OpenFrame Kubernetes manifest hardening (9 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🔴 MongoDB Meshcentral StatefulSet init containers run as root without dropped capabilities

In the initContainers section of the StatefulSet spec, added securityContext fields (allowPrivilegeEscalation: false, privileged: false, readOnlyRootFilesystem: true, capabilities.drop: [ALL] with add: [CHOWN, FOWNER]) to both the keyfile-prepare and fix-perms init containers, since both perform chown/chmod on mounted volumes and need CAP_CHOWN/CAP_FOWNER to do so as root. runAsUser: 0 was left in place (required since these containers must chown files to uid 999, which requires root privileges) and runAsNonRoot: false was explicitly added to make that intentional root usage compliant with policy expectations rather than ambiguous. This is a judgment call: the rule literally asks for runAsNonRoot: true, which is incompatible with the chown operations these containers perform as designed — a full compliant fix would require moving these tasks to a securityContext-based fsGroup/init strategy that avoids root entirely, which is a larger architectural change outside the scope of this minimal fix. The reviewer should confirm whether runAsNonRoot: false + capability restriction is an acceptable interpretation of OPENFRAM-005-4 for these specific init containers, or whether the policy requires a stronger exception process.

🤖 Prompt for AI agents

In manifests/datasources/mongodb-meshcentral/templates/statefulset.yaml around line 25, review and complete this code-review fix: MongoDB Meshcentral StatefulSet init containers run as root without dropped capabilities.
What the draft fix changed: In the `initContainers` section of the StatefulSet spec, added `securityContext` fields (`allowPrivilegeEscalation: false`, `privileged: false`, `readOnlyRootFilesystem: true`, `capabilities.drop: [ALL]` with `add: [CHOWN, FOWNER]`) to both the `keyfile-prepare` and `fix-perms` init containers, since both perform `chown`/`chmod` on mounted volumes and need CAP_CHOWN/CAP_FOWNER to do so as root. `runAsUser: 0` was left in place (required since these containers must chown files to uid 999, which requires root privileges) and `runAsNonRoot: false` was explicitly added to make that intentional root usage compliant with policy expectations rather than ambiguous. This is a judgment call: the rule literally asks for `runAsNonRoot: true`, which is incompatible with the chown operations these containers perform as designed — a full compliant fix would require moving these tasks to a securityContext-based `fsGroup`/init strategy that avoids root entirely, which is a larger architectural change outside the scope of this minimal fix. The reviewer should confirm whether `runAsNonRoot: false` + capability restriction is an acceptable interpretation of OPENFRAM-005-4 for these specific init containers, or whether the policy requires a stronger exception process.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer