cluster

commit 2e8d73b0df139059312b7c82b6de275d0a1ebc9b
parent 3a0ec2d620eac7c5e893198387d73313a1782e71
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Wed, 18 Feb 2026 21:06:35 +0100

fix further issues with nginx

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/connectivity-tester/deployment.yaml
 | 
19
++++++++++++++++---

1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/apps/talos_cluster/connectivity-tester/deployment.yaml b/apps/talos_cluster/connectivity-tester/deployment.yaml
@@ -39,18 +39,31 @@ spec:
                 command:
                   - sleep
                   - "10"
-          # NOTE: nginx:1.27-alpine runs master as root; remove runAsNonRoot/runAsUser
-          # when switching to deno image (USER deno = UID 1000), add:
+          # NOTE: nginx:1.27-alpine master runs as root and chowns temp dirs to uid 101;
+          # capabilities drop ALL prevents that chown. Keeping CHOWN + FOWNER for now.
+          # When switching to deno image (USER deno = UID 1000), replace this entire
+          # securityContext with:
+          #   allowPrivilegeEscalation: false
+          #   readOnlyRootFilesystem: true
           #   runAsNonRoot: true
           #   runAsUser: 1000
           #   runAsGroup: 1000
-          # and change containerPort to 8000.
+          #   capabilities:
+          #     drop: [ALL]
+          #   seccompProfile:
+          #     type: RuntimeDefault
+          # and change containerPort from 3000 to 8000.
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
             capabilities:
               drop:
                 - ALL
+              add:
+                - CHOWN
+                - FOWNER
+                - SETUID
+                - SETGID
             seccompProfile:
               type: RuntimeDefault
           resources: