Hardening (Security improvements)

README.md

@@ -4,7 +4,7 @@
 
 - [GeoWhat?](#Geonode)
 - [Geonode-k8s](#geonode-k8s)
-- [Install Guilde](#install)
+- [Install Guide](#install)
 
 **Homepage:** <https://github.com/GeoNodeUserGroup-DE/geonode-k8s>
 
@@ -69,6 +69,31 @@ Define your own values.yaml to configure your geonode installation. Use the [doc
 vi my-values.yaml
 ```
 
+## Hardened K8S environments
+
+By default, this Helm Chart is intended to run in hardened K8S environments, notably with non-root permissions. To use it, ensure that your storage will be writeable by the geonode technical user; UID and GID can be configured in the values file.
+
+There are two exceptions to this rule:
+- the `geonode-postgres` Pod does not have full securityContext out-of-the-box, because the subchart `postgres-operator` does not support that yet. A workaround is available if you want the full securityContext, for that, set `postgres.kyvernoSecurityContext`to `enabled` in your values YAML.
+- the `geonode/geoserver` Pod, because the current `geonode/geoserver` Docker Image does not support running as non-root out-of-the-box, therefore, default chart settings for this image are set to run as root. If you wish to run this Pod as non-root, proceed as follows:
+
+Create a custom image with the provided script:
+```bash
+cd geoserver-nonroot
+./build.sh
+```
+And then override the settings in your values file, for example:
+```bash
+geoserver:
+  image:
+    name: geonode/geoserver-nonroot
+  securityContext:
+    runAsNonRoot: true
+    fsGroup: 1000
+    runAsUser: 1000
+    runAsGroup: 1000
+```
+
 ## Install chart
 
 ```bash
@@ -81,6 +106,11 @@ helm upgrade --cleanup-on-fail --install --namespace geonode --create-namespace
 helm delete --namespace geonode geonode geonode
 ```
 
+## Migrating from earlier versions of this Helm Chart
+
+The hardened version of this helm chart introduced a split from one common PVC for geonode to four distinct PVC.
+When upgrading from earlier versions of the helm chart, you may need to copy user manually to the new PVC.
+
 ## Contribution
 
 ### Create an Issue

charts/geonode/README.md

@@ -224,6 +224,7 @@ If `geonode.gatewayApi.hostnames` is left empty, the route defaults to
 | postgres.external.ssl | string | `"prefer"` |  |
 | postgres.geodata_databasename_and_username | string | `"geodata"` | geoserver database name and username |
 | postgres.geonode_databasename_and_username | string | `"geonode"` | geonode database name and username |
+| postgres.kyvernoSecurityContext.enabled | bool | `false`| Provide full securityContext to postgres Pod via Kyverno, as postgres-operator does not yet fully support securityContext |
 | postgres.operator.allowedSourceRanges | list | `[]` | when one or more load balancers are enabled for the cluster, this parameter defines the comma-separated range of IP networks (in CIDR-notation). The corresponding load balancer is accessible only to the networks defined by this parameter. Optional, when empty the load balancer service becomes inaccessible from outside of the Kubernetes cluster. |
 | postgres.operator.annotations | object | `{}` | additional annotation for postgresql object |
 | postgres.operator.clone | object | `{}` |  |

charts/geonode/files/celery-cmd-temporary-fix

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# A configurable celery command.
+# Luca Pasquali <luca.pasquali@geosolutionsgroup.com>
+CELERY_BIN=${CELERY_BIN:-"$(which celery||echo celery)"}
+CELERY_APP=${CELERY_APP:-"geonode.celery_app:app"}
+CELERY__STATE_DB=${CELERY__STATE_DB:-"/mnt/volumes/statics/worker@%h.state"}
+# expressed in KB
+CELERY__MAX_MEMORY_PER_CHILD=${CELERY__MAX_MEMORY_PER_CHILD:-"200000"}
+CELERY__AUTOSCALE_VALUES=${CELERY__AUTOSCALE_VALUES:-"10,5"}
+CELERY__MAX_TASKS_PER_CHILD=${CELERY__MAX_TASKS_PER_CHILD:-"10"}
+CELERY__OPTS=${CELERY__OPTS:-"--without-gossip --without-mingle -Ofair -E"}
+CELERY__LOG_LEVEL=${CELERY__LOG_LEVEL:-"ERROR"}
+CELERY__LOG_FILE=${CELERY__LOG_FILE:-"/var/log/celery.log"}
+CELERY__WORKER_NAME=${CELERY__WORKER_NAME:-"worker1@%h"}
+CELERY__WORKER_CONCURRENCY=${CELERY__WORKER_CONCURRENCY:-"4"}
+
+# Celery beat settings
+CELERY__BEAT_SCHEDULE=${CELERY__BEAT_SCHEDULE:-"celery.beat:PersistentScheduler"}
+CELERY__BEAT_DB=${CELERY__BEAT_DB:-"/mnt/volumes/statics/celerybeat-schedule"}
+CELERY__BEAT_LOG=${CELERY__BEAT_LOG:-"/var/log/celery_beat.log"}
+
+# Harvester settings
+CELERY__HARVESTER_WORKER_NAME=${CELERY__HARVESTER_WORKER_NAME:-"harvesting_worker@%h"}
+CELERY__HARVESTER_CONCURRENCY=${CELERY__HARVESTER_CONCURRENCY:-"10"}
+CELERY__HARVESTER_AUTOSCALE_VALUES=${CELERY__HARVESTER_AUTOSCALE_VALUES:-"15,10"}
+CELERY__HARVESTER_MAX_MEMORY_PER_CHILD=${CELERY__HARVESTER_MAX_MEMORY_PER_CHILD:-"500000"}
+
+# --- FIX: Remove stale Beat pidfile before starting beat ---
+BEAT_PIDFILE="/tmp/celerybeat.pid"
+
+if [ -f "$BEAT_PIDFILE" ]; then
+    PID=$(cat "$BEAT_PIDFILE" 2>/dev/null)
+
+    # If PID exists and is running → warn but continue (avoid killing)
+    if kill -0 "$PID" 2>/dev/null; then
+        echo "WARNING: Celery Beat seems to be running already (PID $PID). Removing stale pidfile anyway."
+    else
+        echo "Removing stale Celery Beat pidfile: $BEAT_PIDFILE"
+    fi
+
+    rm -f "$BEAT_PIDFILE"
+fi
+# --- END FIX ---
+
+echo "Starting Celery Beat..."
+$CELERY_BIN -A $CELERY_APP beat --scheduler=$CELERY__BEAT_SCHEDULE \
+    --schedule=$CELERY__BEAT_DB \
+    --loglevel=$CELERY__LOG_LEVEL -f $CELERY__BEAT_LOG --pidfile=/tmp/celerybeat.pid &
+
+echo "Starting Default Celery Worker..."
+$CELERY_BIN -A $CELERY_APP worker --autoscale=$CELERY__AUTOSCALE_VALUES \
+    --max-memory-per-child=$CELERY__MAX_MEMORY_PER_CHILD $CELERY__OPTS \
+    --statedb=$CELERY__STATE_DB \
+    --loglevel=$CELERY__LOG_LEVEL -n $CELERY__WORKER_NAME -f $CELERY__LOG_FILE \
+    --concurrency=$CELERY__WORKER_CONCURRENCY --max-tasks-per-child=$CELERY__MAX_TASKS_PER_CHILD \
+    -X harvesting &
+
+echo "Starting Harvester Celery Worker..."
+$CELERY_BIN -A $CELERY_APP worker -Q harvesting \
+    --autoscale=$CELERY__HARVESTER_AUTOSCALE_VALUES \
+    --max-memory-per-child=$CELERY__HARVESTER_MAX_MEMORY_PER_CHILD \
+    --loglevel=$CELERY__LOG_LEVEL \
+    -n $CELERY__HARVESTER_WORKER_NAME \
+    --concurrency=$CELERY__HARVESTER_CONCURRENCY \
+    -f $CELERY__LOG_FILE &
+
+# Wait for any process to exit
+wait -n
+
+# Exit with the status of the process that exited first
+# Docker will restart the container if this is non-zero (i.e., a failure)
+exit $?

charts/geonode/files/settings_wrapper.py

@@ -0,0 +1,9 @@
+# Overlay for existing GeoNode settings
+
+from pathlib import Path
+from geonode.settings import *
+
+settings_additions = Path("/opt/geonode-custom/settings_additions.py")
+
+if settings_additions.exists():
+    exec(settings_additions.read_text(encoding="utf-8"))

charts/geonode/templates/_helpers.tpl

@@ -117,8 +117,20 @@ postgres-password
 {{- end -}}
 
 # Volume names
-{{- define "persistant_volume_name" -}}
-persistence
+{{- define "pvc_statics_name" -}}
+pvc-{{ .Release.Name }}-geonode-statics
+{{- end -}}
+
+{{- define "pvc_geoserver_data_name" -}}
+pvc-{{ .Release.Name }}-geonode-geoserver-data
+{{- end -}}
+
+{{- define "pvc_backup_restore_name" -}}
+pvc-{{ .Release.Name }}-geonode-backup-restore
+{{- end -}}
+
+{{- define "pvc_data_name" -}}
+pvc-{{ .Release.Name }}-geonode-data
 {{- end -}}
 
 # ports and endpoints

charts/geonode/templates/geonode/celery-cmd-temporary-fix.yaml

@@ -0,0 +1,8 @@
+# Temporary fix pending https://github.com/GeoNode/geonode/pull/14292
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-celery-cmd-temporary-fix
+data:
+  celery-cmd: |
+{{ .Files.Get "files/celery-cmd-temporary-fix" | indent 4 }}