akadmin/Funk-lab
1
0
Fork 0
mirror of https://github.com/Alkatrazz24/Funk-lab.git synced 2026-07-10 23:24:43 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(stt): securityContext conforme PodSecurity restricted (ns ai)

Browse source 
runAsNonRoot + runAsUser 1000 + seccompProfile RuntimeDefault (pod),
allowPrivilegeEscalation false + drop ALL caps (conteneur).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FmcxGsyXZXogiAHQLjnZT
This commit is contained in:
Claude 2026-06-17 10:39:33 +00:00
parent ae68f4ff6b
commit 61a514f759
No known key found for this signature in database
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
k8s/apps/stt/deployment.yaml
View file

@ -17,9 +17,19 @@ spec:
# (cf. README : kubectl create secret docker-registry ghcr-pull ...) # (cf. README : kubectl create secret docker-registry ghcr-pull ...)
imagePullSecrets: imagePullSecrets:
- name: ghcr-pull - name: ghcr-pull
# Conformité PodSecurity "restricted" (namespace ai)
securityContext:
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
containers: containers:
- name: stt-server - name: stt-server
image: ghcr.io/alkatrazz24/funk-stt-server:latest image: ghcr.io/alkatrazz24/funk-stt-server:latest
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
ports: ports:
- containerPort: 8000 - containerPort: 8000
env: env: