Chart: a default install that can run jobs, plus Redis auth, assistant auth, tenancy enforcement and pod hardening

[krlex]

Closes H4, M2, M3, M4, M5 and L1 from the 2026-08-19 Codex review — every
chart finding.

H4 — the default install could not run a job

forail.node.type defaulted to hybrid (the task pod runs jobs itself, through
podman inside the container) while task.privileged and task.hostCgroup both
defaulted to false. That is the one combination that cannot execute anything:
podman fails on the overlay mount and every job stays Pending. Each default was
the safer of its pair; together they made the product's main function unusable
out of the box.

Default is now control — each job runs as its own Kubernetes pod through
receptor's kubernetes-incluster-auth work type, needing no privileges anywhere.
Nothing new was required: the chart already shipped the worktype in
receptor.conf (whose comment is written for exactly this arrangement), the
namespaced pod RBAC in rbac.yaml, and MY_POD_NAMESPACE from the downward API.
The chart's default contradicted its own receptor config.

init.sh asserted the hybrid shape unconditionally — it forced the default group
back to a regular instance group on every run, so node.type=control would have
been undone by the init Job even when set explicitly. The assertions now follow
the node type, which also keeps the file correct for the compose deployment that
shares it.

hybrid without task.privileged now fails the render, with both working
configurations spelled out.

M4 — Redis had no authentication

redis-server --appendonly yes on a ClusterIP Service: any pod that could route
to it could read and write the cache, the Celery queue and the websocket channel
layer, or empty all three with one FLUSHALL. The NetworkPolicy that would have
limited this is off by default because flannel does not enforce policies, so a
stock install had no control at either layer.

requirepass is now always set, from a generated secret. Passed through the
environment rather than args (an argument is visible in the pod spec and in
kubectl describe), and the probes authenticate via REDISCLI_AUTH, so it stays
off their command line too.

M3 — the assistant answered anyone who could reach its Service

FORAIL_ASSISTANT_CHAT_TOKEN defaults to empty, which the assistant reads as "no
authentication", and the chart passed only the model and log level. Beyond
unmetered model use, the answers carry indexed documentation back out. The chart
now always sets a token and documents how a proxy supplies it — and still does
not route the assistant through the Ingress.

M2 — enabling tenancy enforced nothing

forail.tenancyEnabled was the only tenancy value, and it maps to the flag that
turns on quotas, branding and auditing. The flags that enforce a boundary
defaulted to False in the backend with no Helm value at all. Adds
forail.tenancy.{rls,strictIsolation,rateLimiting} and refuses
tenancyEnabled=true with rls=false. RLS defaults to true, so the operator now
opts out rather than having to know to opt in.

Needs forail-backend#7, which mirrors the other three flags from the environment
into the Setting registry — only TENANCY_ENABLED was synced, so these would
otherwise be set and ignored.

M5 — most workloads had no hardening

podSecurityContext and the three securityContext.* keys were empty, and
postgres, redis, OPA, the OTel collector, the init Job and Ollama had no key to
set. Every workload now has one, defaulting to the subset safe to assert without
knowing the image: all capabilities dropped, privilege escalation refused,
RuntimeDefault seccomp. The frontend keeps NET_BIND_SERVICE for :80; the
task pod skips the block entirely when task.privileged=true.

runAsNonRoot and readOnlyRootFilesystem are documented but not defaulted —
both depend on what an image writes and which user it starts as (postgres and
redis start as root and step down themselves), and asserting them blind turns a
working install into CrashLoopBackOff.

L1 — floating image tags

Neither pin changes what runs today. The collector's latest genuinely moves
(rebuilt 2026-08-18, currently 0.159.0). OPA's latest-rootless was the
opposite problem — upstream stopped publishing -rootless after 0.58.0 in
October 2023, so it has been a frozen orphan; pinning makes that visible. The
TODO this replaces suggested 0.70.0-rootless, which does not exist.

Verified

• helm lint clean; renders across default, assistant.enabled=true,
  tenancy.*, and task.privileged=true.
• Both new guards fire on exactly the combination they should and on nothing else.
• 9 hardened containers and 10 pods carrying the seccomp profile in a default
  render.

Not validated against a running cluster — the dev-cluster VM is currently
unusable (vagrant status fails on a UID mismatch). The container-group
execution path in particular should get a live job launch before this goes into a
release, and that is why runAsNonRoot / readOnlyRootFilesystem are not
switched on here.

Upgrade notes

• Redis starts requiring a password; anything outside the chart talking to that
  Service needs the credential from forail-secrets.
• Job execution changes shape. An install that wants the podman path must set
  forail.node.type=hybrid and task.privileged=true --set task.hostCgroup=true.
• assistant.storage.size 20Gi → 5Gi still applies from the Ollama split; PVCs
  cannot shrink.