Forte/launchpad
6
0
Fork 0
Code Issues Pull Requests Actions Packages Wiki Activity

feat(infra): forte-drop in-cluster postgres + nightly backup (prod) #17

Closed
jorgen.stensrud wants to merge 7 commits from feat/forte-drop-infra into main
pull from: feat/forte-drop-infra
merge into: Forte:main
Conversation 26 Commits 7 Files Changed 8 +4 -7
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 47d1f1ec39 - Show all commits

11
infra/overlays/upc-dev/forte-drop-postgresql/resources/postgresql.yaml
View File

@@ -43,13 +43,10 @@ spec:
containers:
jorgen.stensrud marked this conversation as resolved
gitea_admin commented 2026-05-28 13:55:37 +00:00
Review
Copy Link

Container is missing securityContext which should be set for security best practices.

      containers:
      - name: postgresql
        securityContext:
          runAsNonRoot: true
          runAsUser: 999
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: false

#ai-review-inline

Container is missing securityContext which should be set for security best practices. ```suggestion containers: - name: postgresql securityContext: runAsNonRoot: true runAsUser: 999 allowPrivilegeEscalation: false readOnlyRootFilesystem: false ``` #ai-review-inline
- name: postgresql
image: postgres:16-alpine
jorgen.stensrud marked this conversation as resolved
gitea_admin commented 2026-05-28 13:55:37 +00:00
Review
Copy Link

Container image should use a pinned digest or exact tag instead of 'postgres:16-alpine' for better security and reproducibility.

        image: postgres:16.1-alpine

#ai-review-inline

Container image should use a pinned digest or exact tag instead of 'postgres:16-alpine' for better security and reproducibility. ```suggestion image: postgres:16.1-alpine ``` #ai-review-inline
securityContext:
runAsNonRoot: true
runAsUser: 999
runAsGroup: 999
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
# NOTE: no securityContext. The official postgres image's entrypoint must
# start as root to chown a fresh /var/lib/postgresql/data, then drops to
# the postgres user (uid 70 in alpine) via gosu. Forcing runAsNonRoot here
# breaks initdb on a fresh PVC. Matches the vaultwarden-postgresql pattern.
ports:
- name: tcp-postgresql
containerPort: 5432