Hardening (Security improvements)#302

Open

jwkaltz wants to merge 40 commits into

GeoNodeUserGroup-DE:mainfrom

jwkaltz:hardening

Commits on Jul 7, 2026

Split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath)
jwkaltz
committed
Hardening: add security context; split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath); Celery: do not write to log fil…
jwkaltz
committed
Hardening nginx: use non-root port; do not mount favicon here as that creates directory creation permission issues and is already copied anyway in another process.
jwkaltz
committed
Remove cron command, cron should not be used within a K8S container
jwkaltz
committed
Hardening: add security context; split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath)
jwkaltz
committed
Hardening: add security context; split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath). Note: requires a Geoserver Dock…
jwkaltz
committed
no more need to mount pvc-data into build statics job (review comment by mwallschlaeger)
jwkaltz
committed
Conditional StorageClassName (as per gemini-code-assist suggestion)
jwkaltz
committed
allow configuring individual storage sizes for each PVC (as per gemini-code-assist suggestion)
jwkaltz
committed
make nginx fsGroup configurable (as per gemini-code-assist suggestion)
jwkaltz
committed
Reenable custom favicon loading, but without extra mount. Change favicon to match GeoNode UserGroup icon color, to differentiate from out-of-the-box geonode favicon.
jwkaltz
committed
Security improvements as suggested by gemini-code-review
jwkaltz
committed
Add securitycontext to cleanup-job
jwkaltz
committed
more robust values handling, as per gemini-code-assist suggestion
jwkaltz
committed
Make geonode pod (geonode, celery) runnable as non-root
jwkaltz
committed
Make chart more robust, as per gemini-code-assist review
jwkaltz
committed
Make chart more robust, as per gemini-code-assist review
jwkaltz
committed
make code clearer
jwkaltz
committed
Make chart more robust, as per gemini-code-assist suggestions
jwkaltz
committed
Document how to run geonode/geoserver as non-root
jwkaltz
committed
Add migration notice
jwkaltz
committed
Apply upstream change to PR, and remove superfluous parameter, we should use the default
jwkaltz
committed
By default, allow root usage for geoserver pod (to be able to use current standard image)
jwkaltz
committed
Make value handling resistent to boolean and integer values
jwkaltz
committed
Integrate upstream PR https://github.com/GeoNode/geonode/pull/14307
jwkaltz
committed
Mount the statics PVC as readOnly: true in the geoserver deployment (Review feedback)
jwkaltz
committed
Strip setuid bits (from Review comment)
jwkaltz
committed
start implementing readOnlyRootFilesystem (Review comment)
jwkaltz
committed
continue implementing readOnlyRootFilesystem (Review comment)
jwkaltz
committed
implement readOnlyRootFilesystem (Review comment) for geoserver, memcached
jwkaltz
committed
implement readOnlyRootFilesystem (Review comment) for cleanup job
jwkaltz
committed
implement readOnlyRootFilesystem (Review comment) for remaining job containers
jwkaltz
committed
Fix bug about hard-coded uid/gid (from review comment)
jwkaltz
committed
reduce access rights (from review comment)
jwkaltz
committed
consistently use fsGroupChangePolicy (from review comment)
jwkaltz
committed
More robust Dockerfile
jwkaltz
committed
Improve security compliance of postgres pod by using all available operator settings
jwkaltz
committed
Allow postgres to start with full securitycontext despite postgres-operator gaps
jwkaltz
committed
Add documentation for postgres securitycontext issue
jwkaltz
committed

Commits on Jul 8, 2026

Merge branch 'main' into hardening
mwallschlaeger
authored