Security
Chart values: security, rbac, networkPolicy.
Generated from
charts/harthelm/values.yaml at v1.5.0security
| Value | Type | Default | Description |
|---|---|---|---|
security.defaultUid | integer | 1001 | runAsUser for workspace pods (runAsGroup 0, no fsGroup). Nothing may assume this value: e2e runs use a random one. |
security.podSecurityContext | object | The platform pods set no runAsUser, so any UID the cluster assigns works; writable paths are emptyDirs. | |
security.podSecurityContext.runAsNonRoot | true | true | |
security.podSecurityContext.seccompProfile.type | string | "RuntimeDefault" | |
security.containerSecurityContext.allowPrivilegeEscalation | boolean | false | |
security.containerSecurityContext.readOnlyRootFilesystem | boolean | true | |
security.containerSecurityContext.capabilities.drop | list | ["ALL"] | |
security.admissionGuard | object | ValidatingAdmissionPolicy limiting core's ServiceAccount: it may only manage rg-* namespaces that carry the managed label, and write namespaced objects only in rg-* and in the release namespace. | |
security.admissionGuard.enabled | boolean | true | |
security.uidGuard | object | security.defaultUid cannot change while workspace volumes exist: core records the UID the volumes belong to and their count in the ConfigMap <fullname>-volume-uid, and helm upgrade refuses a different defaultUid while volumes > 0. To change it on purpose, set allowChangeFrom to the old UID for that upgrade, then re-own each team's volumes (POST /api/v1/teams/{team}/volume-owner); pods keep their volume's recorded UID meanwhile, and core records the new UID when the last volume is done. helm template and Argo CD cannot read the ConfigMap (no lookup); there, core's own start check is the guard, and state below feeds it by hand. | |
security.uidGuard.enabled | boolean | true | |
security.uidGuard.allowChangeFrom | integer or null | null | the old UID a deliberate change moves away from |
security.uidGuard.state | object | {} | {uid: 1001, volumes: 3}, replaces the ConfigMap lookup |
rbac
| Value | Type | Default | Description |
|---|---|---|---|
rbac.create | boolean | true | |
rbac.cnpg | boolean | true | managed and bundled PostgreSQL (CNPG Clusters) |
rbac.certManager | boolean | true | Certificates for custom domains (in the release namespace) |
rbac.extraClusterRules | list of object | [] | Further ClusterRole rules for kinds core renders only on some clusters (policy CRDs and the like). |
networkPolicy
NetworkPolicies of the release namespace (default deny, then exactly what the platform needs). Team namespaces get theirs from core. Needs a CNI that enforces NetworkPolicy.
| Value | Type | Default | Description |
|---|---|---|---|
networkPolicy.enabled | boolean | true | |
networkPolicy.edgeNamespaceSelector | object | {} | Namespaces of the Ingress controller or Gateway that may reach core and the router. Empty: every namespace. |
networkPolicy.metricsNamespaceSelector | object | {} | Namespaces that scrape /metrics (:9090). Empty: nobody (no rule). |
networkPolicy.cnpgNamespaceSelector | object | The CloudNativePG operator talks to the bundled database pods and to the managed databases in the team namespaces. | |
networkPolicy.cnpgNamespaceSelector.kubernetes.io/metadata.name | string | "cnpg-system" | |
networkPolicy.dns.namespaceSelector.kubernetes.io/metadata.name | string | "kube-system" | |
networkPolicy.dns.podSelector.k8s-app | string | "kube-dns" | |
networkPolicy.egress | object | Egress rules for destinations outside the release namespace. to is a list of NetworkPolicyPeer; empty means any destination on the ports. Narrow them to your IdP, Git provider and API server addresses where you can. | |
networkPolicy.egress.apiServer | object | Core, the router, the bundled database pods and the managed databases (team namespaces) talk to the API server. Some CNIs (Cilium) cannot match the API server by address in a NetworkPolicy; add their own policy through extraObjects (core renders the one of the managed databases when it detects Cilium). | |
networkPolicy.egress.apiServer.to | list of object | [] | |
networkPolicy.egress.apiServer.ports | list of integer | [443,6443] | |
networkPolicy.egress.idp.to | list of object | [] | |
networkPolicy.egress.idp.ports | list of integer | [443] | |
networkPolicy.egress.gitProvider.to | list of object | [] | |
networkPolicy.egress.gitProvider.ports | list of integer | [443] | |
networkPolicy.egress.smtp | object | The mail relay (mail.smtp.host) on mail.smtp.port, unless ports names others. | |
networkPolicy.egress.smtp.to | list of object | [] | |
networkPolicy.egress.registries | object | Container registries core resolves images from (containers). Without to, public addresses only (every IPv4 and IPv6 address except private, CGNAT, loopback and link-local ranges): a member who writes an image name picks the host, so a registry on a private address is listed here; an in-cluster or plain-HTTP registry on another port needs a rule in extra. Note that a rule without to (apiServer, idp, gitProvider, smtp, database) opens its ports to every address; hart admin doctor warns about each (check network-policy). One with ports: null as well allows all egress (every port to every address); the doctor names it with "all ports". | |
networkPolicy.egress.registries.to | list of object | [] | |
networkPolicy.egress.registries.ports | list of integer | [443] | |
networkPolicy.egress.database | object | The external database (database.mode external); the bundled one is matched by pod labels. | |
networkPolicy.egress.database.to | list of object | [] | |
networkPolicy.egress.database.ports | list of integer | [5432] | |
networkPolicy.egress.extra | list of object | [] | Further rules for core, as NetworkPolicyEgressRule objects. |
networkPolicy.egress.router | list of object | [] | Further rules for the router (forward services to allowHosts), as NetworkPolicyEgressRule objects. |