From af116568105a32b51fa83be3c777b3d2d8f6be7c Mon Sep 17 00:00:00 2001
From: Ty J Everett <ty@tyweb.us>
Date: Thu, 10 Sep 2026 22:17:14 -0700
Subject: [PATCH] Harden the Kubernetes runtime

---
 infra/kubernetes/base/workload.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/infra/kubernetes/base/workload.yaml b/infra/kubernetes/base/workload.yaml
index 42301a7..44d2ddf 100644
--- a/infra/kubernetes/base/workload.yaml
+++ b/infra/kubernetes/base/workload.yaml
@@ -24,6 +24,16 @@ spec:
         app.kubernetes.io/component: api
         storage.papertrade.metanet.app/backend: s3
     spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -34,6 +44,11 @@ spec:
                   app.kubernetes.io/component: api
       containers:
         - name: papertrade
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
           image: papertrade:local
           imagePullPolicy: IfNotPresent
           ports: