From 2501a68528fa107d4b80f0c15f26bb095607955e Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sun, 30 Aug 2026 07:20:08 -0700
Subject: [PATCH] fix: add PodSecurity contexts to all poimen deployments

- runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault
- Drop ALL capabilities, no privilege escalation
- readOnlyRootFilesystem on memory (with /tmp emptyDir)
- git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps
- All pods use their service accounts
---
 k8s/app/deployment.yaml | 19 +++++++++++++++++++
 k8s/app/obsidian.yaml   | 22 ++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/k8s/app/deployment.yaml b/k8s/app/deployment.yaml
index 3218ae2..02a5202 100644
--- a/k8s/app/deployment.yaml
+++ b/k8s/app/deployment.yaml
@@ -19,9 +19,23 @@ spec:
       labels:
         app.kubernetes.io/name: poimen-memory
     spec:
+      serviceAccountName: poimen-memory
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 999
+        fsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: memory
           image: forgejo.riotpiao.com/rock/poimen-memory:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
           imagePullPolicy: Always
           ports:
             - containerPort: 8080
@@ -85,10 +99,15 @@ spec:
           volumeMounts:
             - name: data
               mountPath: /data
+            - name: tmp
+              mountPath: /tmp
       volumes:
         - name: data
           persistentVolumeClaim:
             claimName: poimen-memory-vault
+        - name: tmp
+          emptyDir:
+            sizeLimit: 64Mi
       # Tolerate control-plane nodes
       tolerations:
         - key: node-role.kubernetes.io/control-plane
diff --git a/k8s/app/obsidian.yaml b/k8s/app/obsidian.yaml
index 2a26218..00ecc7a 100644
--- a/k8s/app/obsidian.yaml
+++ b/k8s/app/obsidian.yaml
@@ -21,9 +21,26 @@ spec:
         app.kubernetes.io/part-of: poimen-memory
     spec:
       serviceAccountName: obsidian-server
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       initContainers:
       - name: git-sync-init
         image: alpine/git:latest
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+            add:
+              - CHOWN
+              - DAC_OVERRIDE
         command:
         - sh
         - -c
@@ -50,6 +67,11 @@ spec:
       - name: obsidian-server
         image: ppatlabs/obsidian:latest
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - name: http
           containerPort: 27124