mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 02:27:01 +09:00
Aleksei Sviridkin
aed0162711
The vm-disk pvc-resize, cozystack-api, seaweedfs and vm-instance update hooks (whose alpine/k8s image this PR refreshes) ran as root with no securityContext. Add a pod-level runAsNonRoot + runAsUser 65534 + seccompProfile RuntimeDefault and a container-level allowPrivilegeEscalation: false + capabilities drop ALL, mirroring the dashboard adopt hook. kubectl needs no root, so this is behavior-neutral. Each hook is lookup-gated; pin the securityContext in a per-chart helm-unittest that mocks the gating object (DaemonSet / PVC / Service) via kubernetesProvider so the guard renders without a cluster. vm-disk and vm-instance had no Makefile test target, so add 'test: helm unittest .' to both so CI runs the new suites. Scope note: other kubectl hooks on clastix/kubectl (mariadb, keycloak, kubernetes, tenant) are untouched here — they are not part of this alpine/k8s refresh and belong to a separate hardening pass. Also fix the vm-disk resize hook's backoffLimit: it was nested under the pod spec (silently ignored, leaving the Job at the default 6 retries) instead of Job.spec. Move it to Job.spec and pin it in the test. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
Virtual Machine Disk
A Virtual Machine Disk
storageClassis annotated as immutable in the chart schema — seedocs/storage-immutability.mdfor the contract and which consumers enforce it.
Parameters
Common parameters
| Name | Description | Type | Value |
|---|---|---|---|
source |
The source image location used to create a disk. | object |
{} |
source.image |
Use image by name from default collection. | *object |
null |
source.image.name |
Name of the image to use. | string |
"" |
source.upload |
Upload local image. | *object |
null |
source.http |
Download image from an HTTP source. | *object |
null |
source.http.url |
URL to download the image. | string |
"" |
source.disk |
Clone an existing vm-disk. | *object |
null |
source.disk.name |
Name of the vm-disk to clone. | string |
"" |
optical |
Defines if disk should be considered optical. | bool |
false |
storage |
The size of the disk allocated for the virtual machine. | quantity |
5Gi |
storageClass |
StorageClass used to store the data. | string |
replicated |