vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
cozystack/packages/system/cozystack-api
History
Exact
Aleksei Sviridkin 10b9cdd481
fix(security): drop USER 65532 from cozystack-api and lineage-controller-webhook 
The previous commit (6498d37b) added `USER 65532:65532` to seven
first-party scratch images. Two of them — cozystack-api and
lineage-controller-webhook — mount their TLS serving certs as a
secret with `defaultMode: 0400` (root-only). With USER 65532, the
process can no longer read `tls.crt` / `tls.key` and the webhook
pod fails to start, manifesting downstream as
`failed calling webhook "lineage.cozystack.io": dial tcp <ServiceIP>:443: connect: operation not permitted`
during install of the tenant-root HelmRelease in e2e.

Reverts the USER directive on those two images. Properly switching them
to non-root requires either flipping the secret mount to
`defaultMode: 0440` plus `securityContext.fsGroup: 65532` on the
pod, or relaxing to 0444 — both choices touch the runtime chart and
are out of scope for a Go-deps security PR. Tracked as a follow-up.

The remaining five hardened images (backup-controller,
backupstrategy-controller, token-proxy, flux-plunger, kubeovn-plunger)
do not mount root-only secrets and continue to run as 65532.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
2026-04-26 04:41:27 +03:00
..
images/cozystack-api fix(security): drop USER 65532 from cozystack-api and lineage-controller-webhook 2026-04-26 04:41:27 +03:00
templates Disabled private key rotation in CA certs 2026-02-27 19:09:10 +05:00
.gitignore [api] Fix representation of dynamic list kinds 2025-11-13 18:04:33 +03:00
Chart.yaml Introduce Cozystack API (#460) 2024-11-04 17:33:34 +01:00
cozystack-api-openssl.cnf [api] Fix representation of dynamic list kinds 2025-11-13 18:04:33 +03:00
Makefile refactor: move scripts to hack directory 2026-01-15 16:06:56 +01:00
values.yaml Prepare release v1.3.0 2026-04-22 07:28:09 +00:00