Add RoleBinding for calibre anyuid SCC

- Bind calibre-sa to anyuid SecurityContextConstraints
- Enables secure non-root execution for LinuxServer containers
- Maintains production security while ensuring container compatibility
- Fixes supplementary group issues with s6-overlay

manifests/deployment.yml

@@ -22,10 +22,7 @@ spec:
         app: calibre
     spec:
       serviceAccountName: calibre-sa
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
+      securityContext: {}
       containers:
         - name: calibre
           image: docker.io/linuxserver/calibre-web:latest

manifests/rolebinding.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: calibre-anyuid-working
+  namespace: calibre
+  labels:
+    app: calibre
+    app.kubernetes.io/instance: calibre
+    type: third-party
+subjects:
+- kind: ServiceAccount
+  name: calibre-sa
+  namespace: calibre
+roleRef:
+  kind: ClusterRole
+  name: anyuid-scc-user
+  apiGroup: rbac.authorization.k8s.io