aly.codes / infra
Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform. cute.haus
ansible terraform nix k8s
1
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

k8s: harden

Aly Raffauf (Jun 25, 2026, 1:06 AM EDT) da7396f6 ef4e5fd7

+93
+4
k8s/charts/aly-codes/templates/deployment.yaml
··· 14 14 labels: 15 15 app: {{ .Chart.Name }} 16 16 spec: 17 + automountServiceAccountToken: false 18 + securityContext: 19 + seccompProfile: 20 + type: RuntimeDefault 17 21 topologySpreadConstraints: 18 22 - maxSkew: 1 19 23 topologyKey: kubernetes.io/hostname
+4
k8s/charts/audiobookshelf/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 19 20 terminationGracePeriodSeconds: 30 20 21 tolerations: 21 22 - key: node.kubernetes.io/not-ready ··· 30 31 - name: {{ .Chart.Name }} 31 32 image: ghcr.io/advplyr/audiobookshelf:2.35.1@sha256:1eef6716183c52abafe5405e7d6be8390248ecd59c7488c44af871757ac8fc4d 32 33 imagePullPolicy: IfNotPresent 34 + securityContext: 35 + seccompProfile: 36 + type: RuntimeDefault 33 37 env: 34 38 - name: TZ 35 39 value: "America/New_York"
+4
k8s/charts/bluesky-pds/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 terminationGracePeriodSeconds: 15 20 24 tolerations: 21 25 - key: node.kubernetes.io/not-ready
+1
k8s/charts/collabora/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 19 20 terminationGracePeriodSeconds: 30 20 21 tolerations: 21 22 - key: node.kubernetes.io/not-ready
+4
k8s/charts/error-pages/templates/deployment.yaml
··· 14 14 labels: 15 15 app: {{ .Chart.Name }} 16 16 spec: 17 + automountServiceAccountToken: false 18 + securityContext: 19 + seccompProfile: 20 + type: RuntimeDefault 17 21 containers: 18 22 - name: {{ .Chart.Name }} 19 23 image: ghcr.io/tarampampam/error-pages:4@sha256:978c1f83e8f26742743ec3b565214ed9f2296cb5171b592071a6569dceac8c26
+3
k8s/charts/forgejo/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 19 20 terminationGracePeriodSeconds: 15 20 21 securityContext: 21 22 fsGroup: 1000 23 + seccompProfile: 24 + type: RuntimeDefault 22 25 tolerations: 23 26 - key: node.kubernetes.io/not-ready 24 27 operator: Exists
+4
k8s/charts/forward-auth/templates/deployment.yaml
··· 18 18 labels: 19 19 app: forward-auth-{{ $key }} 20 20 spec: 21 + automountServiceAccountToken: false 22 + securityContext: 23 + seccompProfile: 24 + type: RuntimeDefault 21 25 terminationGracePeriodSeconds: 15 22 26 {{- with $.Values.failover }} 23 27 tolerations:
+4
k8s/charts/gotenberg/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 containers: 20 24 - name: {{ .Chart.Name }} 21 25 image: gotenberg/gotenberg:8@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923
+4
k8s/charts/immich/templates/deployment-ml.yaml
··· 16 16 labels: 17 17 app: immich-ml 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 terminationGracePeriodSeconds: 30 20 24 enableServiceLinks: false 21 25 nodeSelector:
+4
k8s/charts/immich/templates/deployment.yaml
··· 16 16 labels: 17 17 app: immich 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 terminationGracePeriodSeconds: 30 20 24 enableServiceLinks: false 21 25 nodeSelector:
+4
k8s/charts/immich/templates/statefulset-postgres.yaml
··· 15 15 labels: 16 16 app: immich-postgres 17 17 spec: 18 + automountServiceAccountToken: false 19 + securityContext: 20 + seccompProfile: 21 + type: RuntimeDefault 18 22 terminationGracePeriodSeconds: 30 19 23 nodeSelector: 20 24 kubernetes.io/hostname: jubilife
+4
k8s/charts/jellyfin/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 terminationGracePeriodSeconds: 30 20 24 enableServiceLinks: false 21 25 nodeSelector:
+4
k8s/charts/morsels/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 dnsPolicy: Default 20 24 tolerations: 21 25 - key: node.kubernetes.io/not-ready
+3
k8s/charts/navidrome/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 19 20 terminationGracePeriodSeconds: 30 20 21 nodeSelector: 21 22 kubernetes.io/hostname: jubilife 22 23 securityContext: 23 24 fsGroup: 1000 25 + seccompProfile: 26 + type: RuntimeDefault 24 27 tolerations: 25 28 - key: node.kubernetes.io/not-ready 26 29 operator: Exists
+3
k8s/charts/nextcloud/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 19 20 terminationGracePeriodSeconds: 30 20 21 enableServiceLinks: false 21 22 securityContext: 22 23 fsGroup: 33 24 + seccompProfile: 25 + type: RuntimeDefault 23 26 tolerations: 24 27 - key: node.kubernetes.io/not-ready 25 28 operator: Exists
+3
k8s/charts/ombi/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 19 20 terminationGracePeriodSeconds: 30 20 21 securityContext: 21 22 fsGroup: 1000 23 + seccompProfile: 24 + type: RuntimeDefault 22 25 tolerations: 23 26 - key: node.kubernetes.io/not-ready 24 27 operator: Exists
+1
k8s/charts/paperless/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 19 20 initContainers: 20 21 - name: wait-deps 21 22 image: ghcr.io/paperless-ngx/paperless-ngx:latest@sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f
+4
k8s/charts/plex/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 terminationGracePeriodSeconds: 30 20 24 enableServiceLinks: false 21 25 # hostNetwork so GDM auto-discovery, DLNA and the router-forwarded
+3
k8s/charts/pocket-id/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 19 20 terminationGracePeriodSeconds: 15 20 21 securityContext: 21 22 fsGroup: 1000 23 + seccompProfile: 24 + type: RuntimeDefault 22 25 tolerations: 23 26 - key: node.kubernetes.io/not-ready 24 27 operator: Exists
+4
k8s/charts/switchyard/templates/deployment.yaml
··· 14 14 labels: 15 15 app: {{ .Chart.Name }} 16 16 spec: 17 + automountServiceAccountToken: false 18 + securityContext: 19 + seccompProfile: 20 + type: RuntimeDefault 17 21 topologySpreadConstraints: 18 22 - maxSkew: 1 19 23 topologyKey: kubernetes.io/hostname
+4
k8s/charts/tika/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 containers: 20 24 - name: {{ .Chart.Name }} 21 25 image: apache/tika:3.3.1.0-full@sha256:d8e6ed96260ad89307a93195a1b856102987a818ac648502f8efbaf313d32470
+4
k8s/charts/tranquil-pds/templates/deployment.yaml
··· 14 14 labels: 15 15 app: {{ .Chart.Name }} 16 16 spec: 17 + automountServiceAccountToken: false 18 + securityContext: 19 + seccompProfile: 20 + type: RuntimeDefault 17 21 terminationGracePeriodSeconds: 15 18 22 imagePullSecrets: 19 23 - name: atcr-pull
+4
k8s/charts/uptime-kuma/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 terminationGracePeriodSeconds: 10 20 24 tolerations: 21 25 - key: node.kubernetes.io/not-ready
+4
k8s/charts/valkey/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 terminationGracePeriodSeconds: 15 20 24 tolerations: 21 25 - key: node.kubernetes.io/not-ready
+4
k8s/charts/vaultwarden/templates/deployment.yaml
··· 16 16 labels: 17 17 app: {{ .Chart.Name }} 18 18 spec: 19 + automountServiceAccountToken: false 20 + securityContext: 21 + seccompProfile: 22 + type: RuntimeDefault 19 23 terminationGracePeriodSeconds: 10 20 24 tolerations: 21 25 - key: node.kubernetes.io/not-ready
+4
k8s/charts/watsup/templates/deployment.yaml
··· 14 14 labels: 15 15 app: {{ .Chart.Name }} 16 16 spec: 17 + automountServiceAccountToken: false 18 + securityContext: 19 + seccompProfile: 20 + type: RuntimeDefault 17 21 dnsPolicy: Default 18 22 topologySpreadConstraints: 19 23 - maxSkew: 1