From a856eff0c6eb2ff912beec4627680d8f7efc0a57 Mon Sep 17 00:00:00 2001
From: Audun Nes <65592364+devex-sa@users.noreply.github.com>
Date: Wed, 13 May 2026 16:45:24 +0200
Subject: [PATCH 1/2] Update Helm release connect to v2.4.1

---
 apps/1password-connect/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/1password-connect/release.yaml b/apps/1password-connect/release.yaml
index 122001af..5d0116f2 100644
--- a/apps/1password-connect/release.yaml
+++ b/apps/1password-connect/release.yaml
@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: connect
-      version: 2.0.3
+      version: 2.4.1
       sourceRef:
         kind: HelmRepository
         name: 1password-connect

From 325534120664e86e8bc53d142661d2fa21abc556 Mon Sep 17 00:00:00 2001
From: devex-sa <devex-sa@users.noreply.github.com>
Date: Wed, 13 May 2026 14:46:02 +0000
Subject: [PATCH 2/2] Update CRDs and render helm templates

---
 .../Deployment-onepassword-connect.yml        | 44 ++++++++++++-------
 .../Pod-1password-connect-health-check.yml    | 13 ++++++
 2 files changed, 42 insertions(+), 15 deletions(-)

diff --git a/apps/1password-connect/manifests/Deployment-onepassword-connect.yml b/apps/1password-connect/manifests/Deployment-onepassword-connect.yml
index 80818c7a..80ceb2ff 100644
--- a/apps/1password-connect/manifests/Deployment-onepassword-connect.yml
+++ b/apps/1password-connect/manifests/Deployment-onepassword-connect.yml
@@ -19,25 +19,37 @@ spec:
     metadata:
       labels:
         app: onepassword-connect
-        version: "1.7.3"
+        version: "1.8.2"
         app.kubernetes.io/component: connect
     spec:
       priorityClassName: cluster-infrastructure
+      securityContext:
+        fsGroup: 999
+        runAsGroup: 999
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
       volumes:
         - name: shared-data
           emptyDir: {}
         - name: credentials
           secret:
             secretName: op-credentials
+            items:
+              - key: 1password-credentials.json
+                path: 1password-credentials.json
       tolerations: []
       containers:
         - name: connect-api
-          image: 1password/connect-api:1.7.3
+          image: 1password/connect-api:1.8.2
           imagePullPolicy: IfNotPresent
           securityContext:
-            runAsUser: 999
-            runAsGroup: 999
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
           resources:
             limits:
               memory: 128Mi
@@ -45,10 +57,7 @@ spec:
               cpu: 0.2
           env:
             - name: OP_SESSION
-              valueFrom:
-                secretKeyRef:
-                  name: op-credentials
-                  key: 1password-credentials.json
+              value: /home/opuser/.op/1password-credentials.json
             - name: OP_BUS_PORT
               value: "11220"
             - name: OP_BUS_PEERS
@@ -74,22 +83,24 @@ spec:
           volumeMounts:
             - mountPath: /home/opuser/.op/data
               name: shared-data
+            - name: credentials
+              mountPath: /home/opuser/.op/1password-credentials.json
+              subPath: 1password-credentials.json
         - name: connect-sync
-          image: 1password/connect-sync:1.7.3
+          image: 1password/connect-sync:1.8.2
           imagePullPolicy: IfNotPresent
           securityContext:
-            runAsUser: 999
-            runAsGroup: 999
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
           resources: {}
           env:
             - name: OP_HTTP_PORT
               value: "8081"
             - name: OP_SESSION
-              valueFrom:
-                secretKeyRef:
-                  name: op-credentials
-                  key: 1password-credentials.json
+              value: /home/opuser/.op/1password-credentials.json
             - name: OP_BUS_PORT
               value: "11221"
             - name: OP_BUS_PEERS
@@ -112,3 +123,6 @@ spec:
           volumeMounts:
             - mountPath: /home/opuser/.op/data
               name: shared-data
+            - name: credentials
+              mountPath: /home/opuser/.op/1password-credentials.json
+              subPath: 1password-credentials.json
diff --git a/apps/1password-connect/manifests/Pod-1password-connect-health-check.yml b/apps/1password-connect/manifests/Pod-1password-connect-health-check.yml
index 0cd067e6..34f0d2e3 100644
--- a/apps/1password-connect/manifests/Pod-1password-connect-health-check.yml
+++ b/apps/1password-connect/manifests/Pod-1password-connect-health-check.yml
@@ -14,7 +14,20 @@ metadata:
     helm.sh/hook-weight: "1"
 spec:
   restartPolicy: Never
+  securityContext:
+    fsGroup: 65532
+    runAsGroup: 65532
+    runAsNonRoot: true
+    runAsUser: 65532
+    seccompProfile:
+      type: RuntimeDefault
   containers:
     - name: curl
       image: curlimages/curl:latest
       command: ["curl", "http://onepassword-connect:8080/health"]
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+        readOnlyRootFilesystem: true