vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
cozystack/packages
History
Exact
Aleksei Sviridkin 10b9cdd481
fix(security): drop USER 65532 from cozystack-api and lineage-controller-webhook 
The previous commit (6498d37b) added `USER 65532:65532` to seven
first-party scratch images. Two of them — cozystack-api and
lineage-controller-webhook — mount their TLS serving certs as a
secret with `defaultMode: 0400` (root-only). With USER 65532, the
process can no longer read `tls.crt` / `tls.key` and the webhook
pod fails to start, manifesting downstream as
`failed calling webhook "lineage.cozystack.io": dial tcp <ServiceIP>:443: connect: operation not permitted`
during install of the tenant-root HelmRelease in e2e.

Reverts the USER directive on those two images. Properly switching them
to non-root requires either flipping the secret mount to
`defaultMode: 0440` plus `securityContext.fsGroup: 65532` on the
pod, or relaxing to 0444 — both choices touch the runtime chart and
are out of scope for a Go-deps security PR. Tracked as a follow-up.

The remaining five hardened images (backup-controller,
backupstrategy-controller, token-proxy, flux-plunger, kubeovn-plunger)
do not mount root-only secrets and continue to run as 65532.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
2026-04-26 04:41:27 +03:00
..
apps fix(security): bump kubevirt-csi-driver to latest deps 2026-04-26 01:46:14 +03:00
core fix(security): bump first-party Dockerfile builders to golang:1.26 2026-04-26 01:53:19 +03:00
extra Prepare release v1.3.0 2026-04-22 07:28:09 +00:00
library [cozy-lib] Add a hexToInt helper 2026-03-19 07:29:50 +03:00
system fix(security): drop USER 65532 from cozystack-api and lineage-controller-webhook 2026-04-26 04:41:27 +03:00
tests/cozy-lib-tests refactor: replace Helm lookup with valuesFrom mechanism 2026-01-05 16:10:55 +01:00