Why: shrink the blast radius of the Puppet control-plane pods (CA keys,
eyaml keys, compiled catalogs) per the security sweep in #307 — remove
root where it is not required and strip cargo-culted capabilities.
Changes:
- puppetboard: run the cert-generator init as uid 1000 (was root +
allowPrivilegeEscalation:true); add pod fsGroup 1000 and drop the
trailing `chown -R 1000:1000` — the PVC is now group-owned.
- puppetdb: run the create-log-dir init as uid 999 (was root); add pod
fsGroup 999 and drop its `chown 999:999`.
- All OpenVox capability add-lists: remove the duplicate CAP_-prefixed
spellings (Kubernetes normalises both to the same kernel cap) and drop
the unused AUDIT_WRITE.
- Set allowPrivilegeEscalation:false and seccompProfile RuntimeDefault
across the workloads.
The main puppetserver/puppetdb containers and the perms-and-dirs /
generate-types root containers stay root: the OpenVox entrypoint chowns
root-owned baked-in dirs and drops the JVM to the puppet user via
`runuser` (needs CHOWN/SETUID/SETGID), so a non-root start crashloops.
Their cap sets are reduced to the minimum justified.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben