Support hardened frontend ports and security context

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.167.0
+version: 0.167.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -31,6 +31,44 @@ Uninstall the Kerberos Hub chart
 
     helm uninstall hub -n kerberos-hub
 
+### Hardened frontend images
+
+New shell-free frontend images run as `65532:65532` and listen on port `8080`.
+Before selecting such an image tag, set the following values together. Defaults
+remain compatible with legacy images on port `80`; this chart does not upgrade
+the frontend image automatically. The Service and ingress remain on port `80`.
+
+```yaml
+kerberoshub:
+    frontend:
+        containerPort: 8080
+        securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+                drop: ["ALL"]
+            seccompProfile:
+                type: RuntimeDefault
+        volumes:
+            - name: frontend-tmp
+              emptyDir:
+                  medium: Memory
+                  sizeLimit: 16Mi
+        volumeMounts:
+            - name: frontend-tmp
+              mountPath: /tmp
+```
+
+Merge the temporary volume into any existing branding/translation mounts rather
+than replacing them. Custom files must be readable by UID `65532`; mount them
+read-only. Only `/tmp` needs writes for generated public runtime configuration
+and nginx's PID/temp files. The web root stays read-only. Health checks can use
+`GET /healthz` on the named `http` container port. This setting applies to the
+primary frontend, not the separately configured legacy demo deployment.
+
 ### Passkeys
 
 Users and sub-users can create and manage their own passkeys in **Profile >

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -11,7 +11,7 @@ spec:
   ports:
   - protocol: TCP
     port: 80
-    targetPort: 80
+    targetPort: http
     name: http
   selector:
     app: hub-frontend
@@ -182,12 +182,16 @@ spec:
       - name: hub-frontend
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
         imagePullPolicy: {{ .Values.kerberoshub.frontend.pullPolicy }}
+        {{- with .Values.kerberoshub.frontend.securityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
         {{- with .Values.kerberoshub.frontend.resources }}
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
         ports:
-        - containerPort: 80
+        - containerPort: {{ .Values.kerberoshub.frontend.containerPort | default 80 }}
           name: http
         {{- with .Values.kerberoshub.frontend.volumeMounts}}
         volumeMounts:

charts/hub/values.yaml

@@ -474,6 +474,9 @@ kerberoshub:
     pullPolicy: IfNotPresent
     tag: "v1.13.9"
     replicas: 2
+    # Hardened frontend images listen on 8080; retain 80 for existing images.
+    containerPort: 80
+    securityContext: {}
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-frontend Service (e.g. when an
     # external/shared Service is managed elsewhere).