puppet: reduce privilege in namespace workloads (#307)

Why: shrink the blast radius of the Puppet control-plane pods (CA keys,
eyaml keys, compiled catalogs) per the security sweep in #307 — remove
root where it is not required and strip cargo-culted capabilities.

Changes:
- puppetboard: run the cert-generator init as uid 1000 (was root +
  allowPrivilegeEscalation:true); add pod fsGroup 1000 and drop the
  trailing `chown -R 1000:1000` — the PVC is now group-owned.
- puppetdb: run the create-log-dir init as uid 999 (was root); add pod
  fsGroup 999 and drop its `chown 999:999`.
- All OpenVox capability add-lists: remove the duplicate CAP_-prefixed
  spellings (Kubernetes normalises both to the same kernel cap) and drop
  the unused AUDIT_WRITE.
- Set allowPrivilegeEscalation:false and seccompProfile RuntimeDefault
  across the workloads.

The main puppetserver/puppetdb containers and the perms-and-dirs /
generate-types root containers stay root: the OpenVox entrypoint chowns
root-owned baked-in dirs and drops the JVM to the puppet user via
`runuser` (needs CHOWN/SETUID/SETGID), so a non-root start crashloops.
Their cap sets are reduced to the minimum justified.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

apps/base/puppet/cronjob_generate-types.yaml

@@ -52,20 +52,16 @@ spec:
               securityContext:
                 runAsUser: 0
                 runAsNonRoot: false
+                allowPrivilegeEscalation: false
+                # Root to `gem install` into the image's root-owned gem dir and
+                # to `runuser` for `puppet generate types` (SETUID/SETGID).
                 capabilities:
                   add:
-                    - CAP_CHOWN
-                    - CAP_SETUID
-                    - CAP_SETGID
-                    - CAP_DAC_OVERRIDE
-                    - CAP_AUDIT_WRITE
-                    - CAP_FOWNER
                     - CHOWN
-                    - SETUID
-                    - SETGID
                     - DAC_OVERRIDE
-                    - AUDIT_WRITE
                     - FOWNER
+                    - SETGID
+                    - SETUID
                   drop:
                     - all
               volumeMounts:
@@ -76,6 +72,8 @@ spec:
           restartPolicy: OnFailure
           securityContext:
             fsGroup: 999
+            seccompProfile:
+              type: RuntimeDefault
           volumes:
             - name: puppet-code-volume
               persistentVolumeClaim:

apps/base/puppet/deployment_puppetboard.yaml

@@ -29,6 +29,11 @@ spec:
         app.kubernetes.io/version: 8.8.0
     spec:
       enableServiceLinks: false
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
       initContainers:
         - name: wait-puppetserver
           image: curlimages/curl:8.11.1
@@ -115,9 +120,6 @@ spec:
               chmod 600 ${CERT_DIR}/${HOSTNAME}.key
               chmod 644 ${CERT_DIR}/ca.pem
 
-              # Change ownership to puppetboard user (1000:1000)
-              chown -R 1000:1000 ${CERT_DIR}
-
               echo "Certificate generation completed for ${HOSTNAME}"
           volumeMounts:
             - name: puppetboard-certs
@@ -130,9 +132,13 @@ spec:
               cpu: 50m
               memory: 64Mi
           securityContext:
-            runAsUser: 0
-            runAsGroup: 0
-            allowPrivilegeEscalation: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - all
       containers:
         - name: puppetboard
           image: ghcr.io/voxpupuli/puppetboard:7.0.1

apps/base/puppet/deployment_puppetdb.yaml

@@ -75,18 +75,16 @@ spec:
                   name: postgres-read-credentials
           securityContext:
             allowPrivilegeEscalation: false
+            # Root entrypoint drops to the puppetdb user via `runuser` (needs
+            # SETUID/SETGID) after chowning SSL/data dirs (CHOWN). Cannot run
+            # non-root: the image entrypoint requires a root start.
             capabilities:
               add:
-                - CAP_FOWNER
-                - CAP_CHOWN
-                - CAP_SETUID
-                - CAP_SETGID
-                - CAP_DAC_OVERRIDE
-                - FOWNER
                 - CHOWN
-                - SETUID
-                - SETGID
                 - DAC_OVERRIDE
+                - FOWNER
+                - SETGID
+                - SETUID
               drop:
                 - all
           volumeMounts:
@@ -105,7 +103,7 @@ spec:
             - sh
             - -c
           args:
-            - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
+            - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
           env:
             - name: POD_NAME
               valueFrom:
@@ -119,7 +117,13 @@ spec:
               cpu: 20m
               memory: 32Mi
           securityContext:
-            runAsUser: 0
+            runAsUser: 999
+            runAsGroup: 999
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - all
           volumeMounts:
             - mountPath: /opt/puppetlabs/server/data/puppetdb
               name: puppetdb-storage
@@ -178,6 +182,11 @@ spec:
             runAsGroup: 1000
             runAsNonRoot: true
             allowPrivilegeEscalation: false
+      securityContext:
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
       volumes:
         - name: puppetdb-storage
           persistentVolumeClaim:

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -66,20 +66,16 @@ spec:
           timeoutSeconds: 20
         securityContext:
           allowPrivilegeEscalation: false
+          # Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to
+          # the puppet user via `runuser` (needs SETUID/SETGID). Cannot run
+          # non-root: the image entrypoint requires a root start.
           capabilities:
             add:
-            - CAP_CHOWN
-            - CAP_SETUID
-            - CAP_SETGID
-            - CAP_DAC_OVERRIDE
-            - CAP_AUDIT_WRITE
-            - CAP_FOWNER
             - CHOWN
-            - SETUID
-            - SETGID
             - DAC_OVERRIDE
-            - AUDIT_WRITE
             - FOWNER
+            - SETGID
+            - SETUID
             drop:
             - all
         startupProbe:
@@ -159,19 +155,13 @@ spec:
         securityContext:
           runAsUser: 0
           runAsNonRoot: false
+          allowPrivilegeEscalation: false
+          # Runs as root to chown the mounted PVC dirs to puppet:puppet before
+          # the main container starts (CHOWN); does not drop privileges itself.
           capabilities:
             add:
-            - CAP_CHOWN
-            - CAP_SETUID
-            - CAP_SETGID
-            - CAP_DAC_OVERRIDE
-            - CAP_AUDIT_WRITE
-            - CAP_FOWNER
             - CHOWN
-            - SETUID
-            - SETGID
             - DAC_OVERRIDE
-            - AUDIT_WRITE
             - FOWNER
             drop:
             - all
@@ -212,6 +202,8 @@ spec:
           name: puppet-shared-bins
       securityContext:
         fsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
       volumes:
       - name: puppet-code-volume
         persistentVolumeClaim:

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -66,20 +66,16 @@ spec:
             timeoutSeconds: 20
           securityContext:
             allowPrivilegeEscalation: false
+            # Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to
+            # the puppet user via `runuser` (needs SETUID/SETGID). Cannot run
+            # non-root: the image entrypoint requires a root start.
             capabilities:
               add:
-                - CAP_CHOWN
-                - CAP_SETUID
-                - CAP_SETGID
-                - CAP_DAC_OVERRIDE
-                - CAP_AUDIT_WRITE
-                - CAP_FOWNER
                 - CHOWN
-                - SETUID
-                - SETGID
                 - DAC_OVERRIDE
-                - AUDIT_WRITE
                 - FOWNER
+                - SETGID
+                - SETUID
               drop:
                 - all
           startupProbe:
@@ -133,19 +129,13 @@ spec:
           securityContext:
             runAsUser: 0
             runAsNonRoot: false
+            allowPrivilegeEscalation: false
+            # Runs as root to chown the mounted PVC dirs to puppet:puppet before
+            # the main container starts (CHOWN); does not drop privileges itself.
             capabilities:
               add:
-                - CAP_CHOWN
-                - CAP_SETUID
-                - CAP_SETGID
-                - CAP_DAC_OVERRIDE
-                - CAP_AUDIT_WRITE
-                - CAP_FOWNER
                 - CHOWN
-                - SETUID
-                - SETGID
                 - DAC_OVERRIDE
-                - AUDIT_WRITE
                 - FOWNER
               drop:
                 - all
@@ -157,6 +147,8 @@ spec:
               subPath: check_for_masters.sh
       securityContext:
         fsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
       volumes:
         - name: puppet-ca-storage
           persistentVolumeClaim: