chore(esphome): Enforce restricted pod security

gabe565 · Oct 20, 2024 · 4acae0f · 4acae0f
1 parent 7909935
commit 4acae0f
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 7 deletions.
diff --git a/kubernetes/gabernetes/apps/esphome/app/helmrelease.yaml b/kubernetes/gabernetes/apps/esphome/app/helmrelease.yaml
@@ -29,7 +29,10 @@ spec:
                   matchLabels:
                     app.kubernetes.io/name: esphome
       securityContext:
-        fsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile: { type: RuntimeDefault }
 
     controllers:
       esphome:
@@ -42,6 +45,7 @@ spec:
             env:
               TZ: America/Chicago
               ESPHOME_DASHBOARD_USE_PING: true
+              PLATFORMIO_CORE_DIR: .tmp/platformio
             probes:
               startup:
                 enabled: true
@@ -54,6 +58,8 @@ spec:
                 enabled: true
             securityContext:
               readOnlyRootFilesystem: true
+              allowPrivilegeEscalation: false
+              capabilities: { drop: [ALL] }
         pod:
           terminationGracePeriodSeconds: 1
           dnsConfig:
@@ -76,14 +82,16 @@ spec:
               - --disable-update-check
               - --auth=none
               - --user-data-dir=/config/.vscode
+              - --extensions-dir=/config/.vscode
               - /config
             resources:
               limits:
                 cpu: 500m
                 memory: 500Mi
             securityContext:
               readOnlyRootFilesystem: true
-              runAsUser: 0
+              allowPrivilegeEscalation: false
+              capabilities: { drop: [ALL] }
         pod:
           labels:
             policy.gabe565.com/egress-world: "true"
@@ -108,13 +116,9 @@ spec:
         accessMode: ReadWriteMany
         size: 8Gi
         retain: true
-      code-config:
+      nonexistent:
         enabled: true
         type: emptyDir
-        advancedMounts:
-          code:
-            app:
-              - path: /root/.config
 
     ingress:
       esphome:

diff --git a/kubernetes/gabernetes/apps/esphome/borgmatic/helmrelease.yaml b/kubernetes/gabernetes/apps/esphome/borgmatic/helmrelease.yaml
@@ -75,6 +75,7 @@ spec:
               - /esphome-config
             exclude_patterns:
               - /esphome-config/.esphome
+              - /esphome-config/.tmp
               - /esphome-config/build
             archive_name_format: "esphome-{now:%Y-%m-%d-%H%M%S}"
             ssh_command: ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=ERROR

diff --git a/kubernetes/gabernetes/apps/esphome/namespace.yaml b/kubernetes/gabernetes/apps/esphome/namespace.yaml
@@ -2,3 +2,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: esphome
+  labels:
+    pod-security.kubernetes.io/enforce: restricted