unkinben
381734a9c7
Why: shrink the blast radius of the Puppet control-plane pods (CA keys, eyaml keys, compiled catalogs) per the security sweep in #307 — remove root where it is not required and strip cargo-culted capabilities. Changes: - puppetboard: run the cert-generator init as uid 1000 (was root + allowPrivilegeEscalation:true); add pod fsGroup 1000 and drop the trailing `chown -R 1000:1000` — the PVC is now group-owned. - puppetdb: run the create-log-dir init as uid 999 (was root); add pod fsGroup 999 and drop its `chown 999:999`. - All OpenVox capability add-lists: remove the duplicate CAP_-prefixed spellings (Kubernetes normalises both to the same kernel cap) and drop the unused AUDIT_WRITE. - Set allowPrivilegeEscalation:false and seccompProfile RuntimeDefault across the workloads. The main puppetserver/puppetdb containers and the perms-and-dirs / generate-types root containers stay root: the OpenVox entrypoint chowns root-owned baked-in dirs and drops the JVM to the puppet user via `runuser` (needs CHOWN/SETUID/SETGID), so a non-root start crashloops. Their cap sets are reduced to the minimum justified. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |