From 1cdfba55c618c191a94440e5eac738e25b8c9d77 Mon Sep 17 00:00:00 2001 From: Benedikt Fichtner <0xffffffff@calloc.de> Date: Sat, 8 Aug 2026 21:02:30 +0200 Subject: [PATCH 1/4] Bump librefrontier Helm chart to 0.3.4-alpha.1 * Upgrade librefrontier Container-Image to v0.0.2-dev * Empty default Helm-Values field 'image.tag' --- charts/librefrontier/Chart.yaml | 4 ++-- charts/librefrontier/README.md | 4 ++-- charts/librefrontier/values.yaml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/charts/librefrontier/Chart.yaml b/charts/librefrontier/Chart.yaml index f91d4ad..842c545 100644 --- a/charts/librefrontier/Chart.yaml +++ b/charts/librefrontier/Chart.yaml @@ -15,10 +15,10 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.3.3-alpha.1 +version: 0.3.4-alpha.1 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "0.0.1-dev" +appVersion: "0.0.2-dev" diff --git a/charts/librefrontier/README.md b/charts/librefrontier/README.md index 3167105..f8fafba 100644 --- a/charts/librefrontier/README.md +++ b/charts/librefrontier/README.md @@ -5,7 +5,7 @@ Custom Helm-Chart for Librefrontier > [!IMPORTANT] > Only configured for Traefik-Ingress, since **IngressRoute** is being used. -![Version: 0.3.3-alpha.1](https://img.shields.io/badge/Version-0.3.3--alpha.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.1-dev](https://img.shields.io/badge/AppVersion-0.0.1--dev-informational?style=flat-square) +![Version: 0.3.4-alpha.1](https://img.shields.io/badge/Version-0.3.4--alpha.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.2-dev](https://img.shields.io/badge/AppVersion-0.0.2--dev-informational?style=flat-square) ## Values @@ -32,7 +32,7 @@ Custom Helm-Chart for Librefrontier | containers.librefrontier.additionalVolumeMounts | object | `{}` | Additional Volume-Mounts for Container | | containers.librefrontier.image.pullPolicy | string | `"IfNotPresent"` | Container-Image pull-policy | | containers.librefrontier.image.repository | string | `"ghcr.io/lukas-fichtner/librefrontier"` | Container-Image-Repository | -| containers.librefrontier.image.tag | string | `"v0.0.1-dev"` | Container-Image-Tag (by default `.Chart.AppVersion` will be used) | +| containers.librefrontier.image.tag | string | `""` | Container-Image-Tag (by default `.Chart.AppVersion` will be used) | | containers.librefrontier.resources | object | `{}` | Container resource requests and limits | | containers.librefrontier.securityContext | object | `{"allowPrivilegeEscalation":false,"privileged":false,"runAsGroup":0,"runAsUser":0}` | Container Security Context | diff --git a/charts/librefrontier/values.yaml b/charts/librefrontier/values.yaml index f7f427b..e8f72ef 100644 --- a/charts/librefrontier/values.yaml +++ b/charts/librefrontier/values.yaml @@ -71,7 +71,7 @@ containers: # # -- Container-Image-Tag (by default `.Chart.AppVersion` will be used) # @section -- Librefrontier-Container specifications - tag: v0.0.1-dev + tag: '' # # -- Container-Image pull-policy # @section -- Librefrontier-Container specifications From fb2ef61e981c7b26746812041c72d80c79580398 Mon Sep 17 00:00:00 2001 From: Benedikt Fichtner <0xffffffff@calloc.de> Date: Sat, 8 Aug 2026 21:11:17 +0200 Subject: [PATCH 2/4] Fix typo: add 'v' before the appVersion --- charts/librefrontier/Chart.yaml | 2 +- charts/librefrontier/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/librefrontier/Chart.yaml b/charts/librefrontier/Chart.yaml index 842c545..60518f8 100644 --- a/charts/librefrontier/Chart.yaml +++ b/charts/librefrontier/Chart.yaml @@ -21,4 +21,4 @@ version: 0.3.4-alpha.1 # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "0.0.2-dev" +appVersion: "v0.0.2-dev" diff --git a/charts/librefrontier/README.md b/charts/librefrontier/README.md index f8fafba..a36ab48 100644 --- a/charts/librefrontier/README.md +++ b/charts/librefrontier/README.md @@ -5,7 +5,7 @@ Custom Helm-Chart for Librefrontier > [!IMPORTANT] > Only configured for Traefik-Ingress, since **IngressRoute** is being used. -![Version: 0.3.4-alpha.1](https://img.shields.io/badge/Version-0.3.4--alpha.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.2-dev](https://img.shields.io/badge/AppVersion-0.0.2--dev-informational?style=flat-square) +![Version: 0.3.4-alpha.1](https://img.shields.io/badge/Version-0.3.4--alpha.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.0.2-dev](https://img.shields.io/badge/AppVersion-v0.0.2--dev-informational?style=flat-square) ## Values From dfd06d448c760cf1abe3a662e3c19c106bc11336 Mon Sep 17 00:00:00 2001 From: Benedikt Fichtner <0xffffffff@calloc.de> Date: Sat, 8 Aug 2026 21:28:35 +0200 Subject: [PATCH 3/4] Adjust Security-Contexts * use UID 100 * use GUID 101 * drop all librefrontier-Container capabilities --- charts/librefrontier/README.md | 4 ++-- charts/librefrontier/values.yaml | 17 ++++++++++------- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/charts/librefrontier/README.md b/charts/librefrontier/README.md index a36ab48..caf9e34 100644 --- a/charts/librefrontier/README.md +++ b/charts/librefrontier/README.md @@ -18,7 +18,7 @@ Custom Helm-Chart for Librefrontier | nodeSelector | object | `{}` | Kubernetes only schedules the Pod onto nodes that have each of the labels you specify | | podAnnotations | object | `{}` | Additional Pod-annotations | | podLabels | object | `{}` | Additional Pod-Labels | -| podSecurityContext | object | `{}` | Pod Security Context | +| podSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":101,"runAsNonRoot":true,"runAsUser":100}` | Pod Security Context | | replicaCount | int | `1` | Number of Pods | | strategy | object | `{"type":"RollingUpdate"}` | The strategy used to replace old Pods by new ones https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy | | tolerations | list | `[]` | Tolerations allow the scheduler to schedule pods with matching taints | @@ -34,7 +34,7 @@ Custom Helm-Chart for Librefrontier | containers.librefrontier.image.repository | string | `"ghcr.io/lukas-fichtner/librefrontier"` | Container-Image-Repository | | containers.librefrontier.image.tag | string | `""` | Container-Image-Tag (by default `.Chart.AppVersion` will be used) | | containers.librefrontier.resources | object | `{}` | Container resource requests and limits | -| containers.librefrontier.securityContext | object | `{"allowPrivilegeEscalation":false,"privileged":false,"runAsGroup":0,"runAsUser":0}` | Container Security Context | +| containers.librefrontier.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"runAsGroup":101,"runAsUser":100}` | Container Security Context | ### Librefrontier-Container-Probes specifications diff --git a/charts/librefrontier/values.yaml b/charts/librefrontier/values.yaml index e8f72ef..5f399d0 100644 --- a/charts/librefrontier/values.yaml +++ b/charts/librefrontier/values.yaml @@ -20,11 +20,12 @@ strategy: # # -- Pod Security Context # @section -- Pod specifications -podSecurityContext: {} -# runAsUser: 10000 -# runAsGroup: 10000 -# fsGroup: 10000 -# runAsNonRoot: true +podSecurityContext: + runAsUser: 100 + runAsGroup: 101 + fsGroup: 101 + runAsNonRoot: true + fsGroupChangePolicy: "OnRootMismatch" # # -- Additional Pod-annotations # @section -- Pod specifications @@ -80,10 +81,12 @@ containers: # -- Container Security Context # @section -- Librefrontier-Container specifications securityContext: - runAsUser: 0 - runAsGroup: 0 + runAsUser: 100 + runAsGroup: 101 allowPrivilegeEscalation: false privileged: false + capabilities: + drop: ["ALL"] # # -- Container resource requests and limits # @section -- Librefrontier-Container specifications From d38778245795ede432f8c0a17823f48b608ebf61 Mon Sep 17 00:00:00 2001 From: Benedikt Fichtner <0xffffffff@calloc.de> Date: Sat, 8 Aug 2026 21:31:33 +0200 Subject: [PATCH 4/4] Bump librefrontier Helm chart to 0.4.0-alpha.1 At least increase Minor-Version because of the gravity of the changes. --- charts/librefrontier/Chart.yaml | 2 +- charts/librefrontier/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/librefrontier/Chart.yaml b/charts/librefrontier/Chart.yaml index 60518f8..2ae8af0 100644 --- a/charts/librefrontier/Chart.yaml +++ b/charts/librefrontier/Chart.yaml @@ -15,7 +15,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.3.4-alpha.1 +version: 0.4.0-alpha.1 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/charts/librefrontier/README.md b/charts/librefrontier/README.md index caf9e34..f613b4f 100644 --- a/charts/librefrontier/README.md +++ b/charts/librefrontier/README.md @@ -5,7 +5,7 @@ Custom Helm-Chart for Librefrontier > [!IMPORTANT] > Only configured for Traefik-Ingress, since **IngressRoute** is being used. -![Version: 0.3.4-alpha.1](https://img.shields.io/badge/Version-0.3.4--alpha.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.0.2-dev](https://img.shields.io/badge/AppVersion-v0.0.2--dev-informational?style=flat-square) +![Version: 0.4.0-alpha.1](https://img.shields.io/badge/Version-0.4.0--alpha.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.0.2-dev](https://img.shields.io/badge/AppVersion-v0.0.2--dev-informational?style=flat-square) ## Values