security: fix Trivy pod-security findings (harden securityContext, Dockerfile) - #21
Merged
Merged
Conversation
…ckerfile)
Resolves the Trivy `misconfig` HIGH findings reported (report-only) by the shared
security workflow, and hardens the shipped Helm chart which ships the same posture
that the scanner cannot see through templating.
HIGH (fixed):
- DS-0029 Dockerfile builder: `apt-get install --no-install-recommends`.
- KSV-0014 Root filesystem now read-only.
- KSV-0118 Explicit pod + container securityContext (was the helm-create `{}` default).
Chart (helm/authn/values.yaml) — the real prod artifact, previously shipped
podSecurityContext:{} / securityContext:{}. Now hardened by default:
pod: runAsNonRoot, runAs{User,Group}/fsGroup 65532, seccompProfile RuntimeDefault
container: allowPrivilegeEscalation false, readOnlyRootFilesystem true,
capabilities drop ALL, runAsNonRoot, seccompProfile RuntimeDefault
Safe because the image is gcr.io/distroless/static:nonroot (UID/GID 65532), authn
persists kubeconfigs as Secrets via the API (never local disk), and it listens on an
unprivileged port. Fields are open `object` in values.schema.json — no schema change.
The dev manifest (manifests/deploy.local.yaml) mirrors the same context.
MEDIUM (accepted, documented in .trivyignore.yaml, below the CI HIGH/CRITICAL gate):
- KSV-0013 dev manifest authn:latest (local build, imagePullPolicy: Never).
- KSV-0113 authn's SA must manage namespace secrets — its core function.
- KSV-0111 testdata admin-access mapping — a test fixture, never deployed.
Verified: `trivy fs --scanners misconfig` shows 0 HIGH/CRITICAL after the fixes;
helm lint clean; chart renders the hardened contexts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se
braghettos
added a commit
to krateo-platformops/installer
that referenced
this pull request
Aug 13, 2026
Ship authn's hardened securityContext defaults (krateo-platformops/authn#21): pod + container run non-root, read-only rootfs, drop ALL caps, seccomp RuntimeDefault. crds-subchart tracks the same release tag (crd-publishing standard), so authn-crd moves with it. No CR/behaviour change — pod-security hardening only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se
braghettos
added a commit
to krateo-platformops/installer
that referenced
this pull request
Aug 13, 2026
* chore(hooks): use lightweight alpine/kubectl for lifecycle hook Jobs The installer's own hook Jobs (self-bootstrap waves + pre/post-delete teardown reapers) ran on alpine/k8s:1.31.0 (~250MB compressed / 822MB unpacked). On fresh multi-node clusters that pull blew the self-register/self-instance activeDeadlineSeconds: 300 budget, failing the install (#66). Every one of these hooks only runs `kubectl` inside `/bin/sh` poll loops — no helm, jq, yq or kustomize (verified across all four hook files). So swap the fat all-tools image for alpine/kubectl:1.36.3 (~21MB compressed, busybox shell): a ~90% smaller pull that comfortably fits the deadline. Bumped kubectl 1.31 -> 1.36 to match the installer's k8s>=1.36 floor (the old 1.31 was already skewed 5 minors). DRY: the image is a pure template constant `inst.hookImage` in _helpers.tpl, NOT a values key — so it never has to be threaded through values.schema.json / the crdgen'd Installer CRD / the composition-mode CR (that class of coupling caused #68). Verified: `helm template` renders alpine/kubectl:1.36.3 for all hook Jobs in both bootstrap and composition mode; zero alpine/k8s references remain; image confirmed to carry /bin/sh + kubectl + sleep/grep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se * chore(pins): bump authn + authn-crd 0.27.0 -> 0.27.1 Ship authn's hardened securityContext defaults (krateo-platformops/authn#21): pod + container run non-root, read-only rootfs, drop ALL caps, seccomp RuntimeDefault. crds-subchart tracks the same release tag (crd-publishing standard), so authn-crd moves with it. No CR/behaviour change — pod-security hardening only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Resolves the Trivy
misconfigHIGH findings reported (report-only) by the shared security workflow, and hardens the shipped Helm chart — which previously shippedpodSecurityContext: {}/securityContext: {}(the helm-create defaults) that Trivy can't see through templating.HIGH — fixed
go/authn/Dockerfileapt-get install --no-install-recommendsreadOnlyRootFilesystem: truesecurityContextChart hardening (
helm/authn/values.yaml)The real production artifact. Hardened defaults:
runAsNonRoot,runAs{User,Group}/fsGroup: 65532,seccompProfile: RuntimeDefaultallowPrivilegeEscalation: false,readOnlyRootFilesystem: true,capabilities.drop: [ALL],runAsNonRoot,seccompProfile: RuntimeDefaultSafe because the image is
gcr.io/distroless/static:nonroot(UID/GID 65532), authn persists kubeconfigs as Secrets via the API (never local disk), and listens on an unprivileged port.podSecurityContext/securityContextare openobjectinvalues.schema.json— no schema change.manifests/deploy.local.yamlmirrors the same context.MEDIUM — accepted, documented in
.trivyignore.yamlAll below the CI's
HIGH,CRITICALgate; recorded with per-file rationale:authn:latest(local build,imagePullPolicy: Never)Verification
trivy fs --scanners misconfig→ 0 HIGH/CRITICAL after the fixes (was 4 HIGH)helm lintclean; chart renders the hardened pod + container contexts🤖 Generated with Claude Code
https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se