fix(helm): harden default pod security and warn on default credentials (#15046)

deployment/helm/charts/onyx/Chart.yaml

@@ -5,7 +5,7 @@ home: https://www.onyx.app/
 sources:
   - "https://github.com/onyx-dot-app/onyx"
 type: application
-version: 0.8.39
+version: 0.8.40
 appVersion: latest
 annotations:
   category: Productivity
@@ -20,10 +20,12 @@ annotations:
     - name: background
       image: docker.io/onyxdotapp/onyx-backend:latest
   artifacthub.io/changes: |
-    - kind: fixed
-      description: Scope the pre-delete cleanup hook to this release's Postgres and
-        Redis resources, pin and harden its kubectl image, and add
-        postgresql.cluster.retainOnUninstall to keep the database on uninstall.
+    - kind: security
+      description: Default Onyx workloads to the RuntimeDefault seccomp profile and
+        allowPrivilegeEscalation false.
+    - kind: security
+      description: Warn after install when the default PostgreSQL or Redis passwords
+        are in use.
 dependencies:
   # Helm uses the first condition path that exists: `postgresqlOperator.enabled`
   # is unset by default, so this falls through to `postgresql.enabled`. Set it

deployment/helm/charts/onyx/templates/NOTES.txt

@@ -0,0 +1,18 @@
+Onyx {{ .Values.global.version | default .Chart.AppVersion }} is deployed as release "{{ .Release.Name }}" in namespace "{{ .Release.Namespace }}".
+{{- $pg := .Values.auth.postgresql }}
+{{- $redis := .Values.auth.redis }}
+{{- $pgDefault := and (ne (toString $pg.enabled) "false") (empty $pg.existingSecret) (eq (toString $pg.values.password) "postgres") }}
+{{- $redisDefault := and .Values.redis.enabled (ne (toString $redis.enabled) "false") (empty $redis.existingSecret) (eq (toString $redis.values.redis_password) "password") }}
+{{- if or $pgDefault $redisDefault }}
+
+WARNING: this release uses the chart's default credentials:
+{{- if $pgDefault }}
+  - PostgreSQL: auth.postgresql.values.password is "postgres"
+{{- end }}
+{{- if $redisDefault }}
+  - Redis: auth.redis.values.redis_password is "password"
+{{- end }}
+Anyone who can reach these services in the cluster can use these passwords.
+Set strong values, or point auth.<name>.existingSecret at a Secret you manage
+(for example the one that externalSecret creates).
+{{- end }}

deployment/helm/charts/onyx/templates/_helpers.tpl

@@ -84,6 +84,20 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
+{{/*
+Render a container securityContext. Kubernetes rejects
+allowPrivilegeEscalation=false alongside privileged or CAP_SYS_ADMIN, so the
+default is dropped when an override asks for either.
+*/}}
+{{- define "onyx.containerSecurityContext" -}}
+{{- $sc := deepCopy (. | default dict) -}}
+{{- $added := (get ($sc.capabilities | default dict) "add") | default list -}}
+{{- if or $sc.privileged (has "SYS_ADMIN" $added) (has "CAP_SYS_ADMIN" $added) -}}
+{{- $_ := unset $sc "allowPrivilegeEscalation" -}}
+{{- end -}}
+{{- toYaml $sc -}}
+{{- end }}
+
 {{/*
 Set secret name
 */}}

deployment/helm/charts/onyx/templates/api-deployment.yaml

@@ -67,7 +67,7 @@ spec:
       containers:
         - name: api-server
           securityContext:
-            {{- toYaml .Values.api.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.api.securityContext | nindent 12 }}
           image: "{{ .Values.api.image.repository }}:{{ .Values.api.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-beat.yaml

@@ -67,7 +67,7 @@ spec:
       containers:
         - name: celery-beat
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-worker-docfetching.yaml

@@ -58,7 +58,7 @@ spec:
       containers:
         - name: celery-worker-docfetching
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-worker-docprocessing.yaml

@@ -56,7 +56,7 @@ spec:
       containers:
         - name: celery-worker-docprocessing
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-worker-heavy.yaml

@@ -56,7 +56,7 @@ spec:
       containers:
         - name: celery-worker-heavy
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-worker-light.yaml

@@ -56,7 +56,7 @@ spec:
       containers:
         - name: celery-worker-light
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-worker-monitoring.yaml

@@ -56,7 +56,7 @@ spec:
       containers:
         - name: celery-worker-monitoring
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-worker-primary.yaml

@@ -56,7 +56,7 @@ spec:
       containers:
         - name: celery-worker-primary
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-worker-scheduled-tasks.yaml

@@ -56,7 +56,7 @@ spec:
       containers:
         - name: celery-worker-scheduled-tasks
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/celery-worker-user-file-processing.yaml

@@ -56,7 +56,7 @@ spec:
       containers:
         - name: celery-worker-user-file-processing
           securityContext:
-            {{- toYaml .Values.celery_shared.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.celery_shared.securityContext | nindent 12 }}
           image: "{{ .Values.celery_shared.image.repository }}:{{ .Values.celery_shared.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command:

deployment/helm/charts/onyx/templates/discordbot.yaml

@@ -59,7 +59,7 @@ spec:
       containers:
         - name: discordbot
           securityContext:
-            {{- toYaml .Values.discordbot.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.discordbot.securityContext | nindent 12 }}
           image: "{{ .Values.discordbot.image.repository }}:{{ .Values.discordbot.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command: [{{ include "onyx.customCACerts.commandPrefix" . }}"python", "onyx/onyxbot/discord/client.py"]

deployment/helm/charts/onyx/templates/indexing-model-deployment.yaml

@@ -80,7 +80,7 @@ spec:
           {{- end }}
         {{- if .Values.indexCapability.securityContext }}
         securityContext:
-          {{- toYaml .Values.indexCapability.securityContext | nindent 10 }}
+          {{- include "onyx.containerSecurityContext" .Values.indexCapability.securityContext | nindent 10 }}
         {{- end }}
         {{- if .Values.indexCapability.resources }}
         resources:

deployment/helm/charts/onyx/templates/inference-model-deployment.yaml

@@ -69,7 +69,7 @@ spec:
           {{- end }}
         {{- if .Values.inferenceCapability.securityContext }}
         securityContext:
-          {{- toYaml .Values.inferenceCapability.securityContext | nindent 10 }}
+          {{- include "onyx.containerSecurityContext" .Values.inferenceCapability.securityContext | nindent 10 }}
         {{- end }}
         {{- if .Values.inferenceCapability.resources }}
         resources:

deployment/helm/charts/onyx/templates/mcp-server-deployment.yaml

@@ -54,7 +54,7 @@ spec:
       containers:
         - name: mcp-server
           securityContext:
-            {{- toYaml .Values.mcpServer.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.mcpServer.securityContext | nindent 12 }}
           image: "{{ .Values.mcpServer.image.repository }}:{{ .Values.mcpServer.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command: [{{ include "onyx.customCACerts.commandPrefix" . }}"python", "onyx/mcp_server_main.py"]

deployment/helm/charts/onyx/templates/slackbot.yaml

@@ -53,7 +53,7 @@ spec:
       containers:
         - name: slackbot
           securityContext:
-            {{- toYaml .Values.slackbot.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.slackbot.securityContext | nindent 12 }}
           image: "{{ .Values.slackbot.image.repository }}:{{ .Values.slackbot.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           command: [{{ include "onyx.customCACerts.commandPrefix" . }}"python", "onyx/onyxbot/slack/listener.py"]

deployment/helm/charts/onyx/templates/webserver-deployment.yaml

@@ -63,7 +63,7 @@ spec:
       containers:
         - name: web-server
           securityContext:
-            {{- toYaml .Values.webserver.securityContext | nindent 12 }}
+            {{- include "onyx.containerSecurityContext" .Values.webserver.securityContext | nindent 12 }}
           image: "{{ .Values.webserver.image.repository }}:{{ .Values.webserver.image.tag | default .Values.global.version }}"
           imagePullPolicy: {{ .Values.global.pullPolicy }}
           ports:

deployment/helm/charts/onyx/values.yaml

@@ -247,6 +247,8 @@ inferenceCapability:
     runAsNonRoot: true
     runAsUser: 1001
     fsGroup: 1001
+    seccompProfile:
+      type: RuntimeDefault
   securityContext:
     capabilities:
       drop:
@@ -326,6 +328,8 @@ indexCapability:
     runAsNonRoot: true
     runAsUser: 1001
     fsGroup: 1001
+    seccompProfile:
+      type: RuntimeDefault
   securityContext:
     capabilities:
       drop:
@@ -457,12 +461,14 @@ webserver:
   podAnnotations: {}
   podLabels:
     scope: onyx-frontend
+  # Hardening defaults merge with your overrides; set a key to null to drop it.
   podSecurityContext:
-    {}
+    seccompProfile:
+      type: RuntimeDefault
     # fsGroup: 2000
 
   securityContext:
-    {}
+    allowPrivilegeEscalation: false
     # capabilities:
     #   drop:
     #   - ALL
@@ -574,12 +580,14 @@ api:
   # real, so size against CPU/memory.
   threadpoolSize: 0
 
+  # Hardening defaults merge with your overrides; set a key to null to drop it.
   podSecurityContext:
-    {}
+    seccompProfile:
+      type: RuntimeDefault
     # fsGroup: 2000
 
   securityContext:
-    {}
+    allowPrivilegeEscalation: false
     # capabilities:
     #   drop:
     #   - ALL
@@ -727,13 +735,18 @@ celery_shared:
     periodSeconds: 60
     failureThreshold: 5
     timeoutSeconds: 3
-  podSecurityContext: {}
+  # Hardening defaults merge with your overrides; set a key to null to drop it.
+  # allowPrivilegeEscalation is dropped automatically if you set privileged.
+  podSecurityContext:
+    seccompProfile:
+      type: RuntimeDefault
   securityContext:
     # `privileged` is not needed by this workload and is intentionally omitted.
     # root is kept only so the optional customCACerts feature can run
     # update-ca-certificates; to run non-root, override this and
     # podSecurityContext (see codeInterpreter below for the pattern).
     runAsUser: 0
+    allowPrivilegeEscalation: false
 
 celery_beat:
   extraEnv: []
@@ -1091,10 +1104,12 @@ discordbot:
     scope: onyx-backend
   deploymentLabels:
     app: discord-bot
+  # Hardening defaults merge with your overrides; set a key to null to drop it.
   podSecurityContext:
-    {}
+    seccompProfile:
+      type: RuntimeDefault
   securityContext:
-    {}
+    allowPrivilegeEscalation: false
   resources:
     requests:
       cpu: "500m"
@@ -1120,10 +1135,12 @@ slackbot:
     scope: onyx-backend
   deploymentLabels:
     app: slack-bot
+  # Hardening defaults merge with your overrides; set a key to null to drop it.
   podSecurityContext:
-    {}
+    seccompProfile:
+      type: RuntimeDefault
   securityContext:
-    {}
+    allowPrivilegeEscalation: false
   resources:
     requests:
       cpu: "500m"
@@ -1159,8 +1176,12 @@ mcpServer:
     servicePort: 8090
     targetPort: mcp-server-port
     portName: mcp-server-port
-  podSecurityContext: {}
-  securityContext: {}
+  # Hardening defaults merge with your overrides; set a key to null to drop it.
+  podSecurityContext:
+    seccompProfile:
+      type: RuntimeDefault
+  securityContext:
+    allowPrivilegeEscalation: false
   resources:
     requests:
       cpu: "250m"