Add RoleBinding for calibre anyuid SCC

- Bind calibre-sa to anyuid SecurityContextConstraints
- Enables secure non-root execution for LinuxServer containers
- Maintains production security while ensuring container compatibility
- Fixes supplementary group issues with s6-overlay

bootstrap/calibre-application.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: calibre
+  namespace: openshift-gitops
+  annotations:
+spec:
+  orphanedResources:
+    warn: false # Disable warning
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: https://gitea.apilab.us/cscott/calibre.git
+    targetRevision: main
+    path: manifests
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

manifests/deployment.yml

@@ -5,6 +5,7 @@ metadata:
   namespace: calibre
   labels:
     app: calibre
+    app.kubernetes.io/instance: calibre
     version: latest
     type: third-party
     facing: internal
@@ -21,20 +22,15 @@ spec:
         app: calibre
     spec:
       serviceAccountName: calibre-sa
-      securityContext:
+      securityContext: {}
-        runAsUser: 0
-        runAsGroup: 0
-        fsGroup: 0
       containers:
         - name: calibre
           image: docker.io/linuxserver/calibre-web:latest
           env:
-            - name: PUID
+            - name: S6_YES_I_WANT_A_WORLD_WRITABLE_RUN_BECAUSE_KUBERNETES
-              value: "1001"
+              value: "1"
-            - name: PGID
-              value: "1001"
             - name: TZ
-              value: "Europe/Bucharest"
+              value: "Australia/Sydney"
             - name: DOCKER_MODS
               value: "linuxserver/calibre-web:calibre"
           ports:
@@ -46,6 +42,8 @@ spec:
               mountPath: /config
             - name: calibre-books
               mountPath: /books
+            - name: run-dir
+              mountPath: /run
           resources:
             requests:
               memory: "128Mi"
@@ -56,7 +54,9 @@ spec:
       volumes:
         - name: calibre-config
           persistentVolumeClaim:
-            claimName: calibre-config
+            claimName: calibre-config-csi
         - name: calibre-books
           persistentVolumeClaim:
-            claimName: calibre-books
+            claimName: calibre-books-csi
+        - name: run-dir
+          emptyDir: {}

manifests/ns.yml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: calibre
+  labels:
+    app: calibre
+    type: third-party
+    facing: internal
+    argocd.argoproj.io/managed-by: openshift-gitops

manifests/pvc_books.yml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: calibre-books
+  name: calibre-books-csi
   namespace: calibre
 spec:
   accessModes:
@@ -9,5 +9,4 @@ spec:
   resources:
     requests:
       storage: 8Gi
-  storageClassName: nfs
+  storageClassName: nfs-csi
-  volumeName: calibre-books

manifests/pvc_config.yml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: calibre-config
+  name: calibre-config-csi
   namespace: calibre
 spec:
   accessModes:
@@ -9,5 +9,4 @@ spec:
   resources:
     requests:
       storage: 500Mi
-  storageClassName: nfs
+  storageClassName: nfs-csi
-  volumeName: calibre-config

manifests/rolebinding.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: calibre-anyuid-working
+  namespace: calibre
+  labels:
+    app: calibre
+    app.kubernetes.io/instance: calibre
+    type: third-party
+subjects:
+- kind: ServiceAccount
+  name: calibre-sa
+  namespace: calibre
+roleRef:
+  kind: ClusterRole
+  name: anyuid-scc-user
+  apiGroup: rbac.authorization.k8s.io

manifests/route.yaml

@@ -6,6 +6,8 @@ metadata:
   annotations:
     cert-manager.io/issuer-kind: ClusterIssuer
     cert-manager.io/issuer-name: letsencrypt-dns01-cloudflare
+  labels:
+    app.kubernetes.io/instance: calibre
 spec:
   host: calibre.apilab.us
   path: /

manifests/service.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: calibre
   labels:
     app: calibre
+    app.kubernetes.io/instance: calibre
 spec:
   selector:
     app: calibre
@@ -13,4 +14,4 @@ spec:
       protocol: TCP
       targetPort: 8083
       port: 80
-
+  type: ClusterIP

ns.yml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-    name: calibre
-    labels:
-        app: calibre
-        type: third-party
-        facing: internal

pv_books.yml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: calibre-books
-  namespace: calibre
-spec:
-  capacity:
-    storage: 8Gi
-  nfs:
-    server: 192.168.0.105
-    path: /nfs/NFS/ocp/calibre/books
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs

pv_config.yml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: calibre-config
-  namespace: calibre
-spec:
-  capacity:
-    storage: 500Mi
-  nfs:
-    server: 192.168.0.105
-    path: /nfs/NFS/ocp/calibre/config
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs

scc-updates.sh

@@ -1,2 +0,0 @@
-oc create sa calibre-sa -n calibre
-oc adm policy add-scc-to-user anyuid -z calibre-sa -n calibre