mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Myasnikov Daniil
a4c6a07b51
Add runAsNonRoot/runAsUser/seccompProfile to the bootstrap-token and talos-reconcile hook Jobs so they satisfy PodSecurity "restricted" (matching the csr-signer sidecar). Drop the keyEncipherment usage from the Ed25519 trustd Certificate (RFC 9295 - Ed25519 keys cannot do key encipherment). Correct the stale talos-pki comment that claimed the reconcile hook patches spec.ipAddresses: the cert carries DNS SANs only and workers route to trustd via the Service DNS name, as the reconcile job's own routing note explains. Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
How to test packages local
cd packages/core/installer
make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
make apply
kubectl delete po -l app=source-controller -n cozy-fluxcd