Hardening (Security improvements) - #302

Merged

mwallschlaeger merged 47 commits into

GeoNodeUserGroup-DE:mainfrom

jwkaltz:hardening

Jul 16, 2026

Commits on Jul 7, 2026

Split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath)
jwkaltz
committed
f3d2a24
Hardening: add security context; split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath); Celery: do not write to log fil…
jwkaltz
committed
4e5152e
Hardening nginx: use non-root port; do not mount favicon here as that creates directory creation permission issues and is already copied anyway in another process.
jwkaltz
committed
16d5254
Remove cron command, cron should not be used within a K8S container
jwkaltz
committed
40e224d
Hardening: add security context; split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath)
jwkaltz
committed
78028e4
Hardening: add security context; split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath). Note: requires a Geoserver Dock…
jwkaltz
committed
08396f0
no more need to mount pvc-data into build statics job (review comment by mwallschlaeger)
jwkaltz
committed
e3011b2
Conditional StorageClassName (as per gemini-code-assist suggestion)
jwkaltz
committed
d4ffcd2
allow configuring individual storage sizes for each PVC (as per gemini-code-assist suggestion)
jwkaltz
committed
07efce2
make nginx fsGroup configurable (as per gemini-code-assist suggestion)
jwkaltz
committed
367cf0a
Reenable custom favicon loading, but without extra mount. Change favicon to match GeoNode UserGroup icon color, to differentiate from out-of-the-box geonode favicon.
jwkaltz
committed
7c579b9
Security improvements as suggested by gemini-code-review
jwkaltz
committed
d9c3e11
Add securitycontext to cleanup-job
jwkaltz
committed
8b5d6c5
more robust values handling, as per gemini-code-assist suggestion
jwkaltz
committed
eeeb54b
Make geonode pod (geonode, celery) runnable as non-root
jwkaltz
committed
8cf1094
Make chart more robust, as per gemini-code-assist review
jwkaltz
committed
fa901aa
Make chart more robust, as per gemini-code-assist review
jwkaltz
committed
27c119a
make code clearer
jwkaltz
committed
97a6930
Make chart more robust, as per gemini-code-assist suggestions
jwkaltz
committed
4bb5a80
Document how to run geonode/geoserver as non-root
jwkaltz
committed
10b1583
Add migration notice
jwkaltz
committed
0cf6453
Apply upstream change to PR, and remove superfluous parameter, we should use the default
jwkaltz
committed
af92aea
By default, allow root usage for geoserver pod (to be able to use current standard image)
jwkaltz
committed
24a945d
Make value handling resistent to boolean and integer values
jwkaltz
committed
ca32829
Integrate upstream PR https://github.com/GeoNode/geonode/pull/14307
jwkaltz
committed
5f59315
Mount the statics PVC as readOnly: true in the geoserver deployment (Review feedback)
jwkaltz
committed
7d76aaf
Strip setuid bits (from Review comment)
jwkaltz
committed
b17b311
start implementing readOnlyRootFilesystem (Review comment)
jwkaltz
committed
380db64
continue implementing readOnlyRootFilesystem (Review comment)
jwkaltz
committed
707d8a0
implement readOnlyRootFilesystem (Review comment) for geoserver, memcached
jwkaltz
committed
c2a30e2
implement readOnlyRootFilesystem (Review comment) for cleanup job
jwkaltz
committed
1277752
implement readOnlyRootFilesystem (Review comment) for remaining job containers
jwkaltz
committed
b809473
Fix bug about hard-coded uid/gid (from review comment)
jwkaltz
committed
3d298fd
reduce access rights (from review comment)
jwkaltz
committed
fdb9044
consistently use fsGroupChangePolicy (from review comment)
jwkaltz
committed
299c167
More robust Dockerfile
jwkaltz
committed
9988ff5
Improve security compliance of postgres pod by using all available operator settings
jwkaltz
committed
baa230a
Allow postgres to start with full securitycontext despite postgres-operator gaps
jwkaltz
committed
861993d
Add documentation for postgres securitycontext issue
jwkaltz
committed
dd46de7

Commits on Jul 8, 2026

Merge branch 'main' into hardening
mwallschlaeger
authored
9b3067c

Commits on Jul 13, 2026

Merge branch 'main' of github.com:zalf-rdm/geonode-k8s into pr-302
mwallschlaeger
committed
5e5f36e

Commits on Jul 14, 2026

requested changes
mwallschlaeger
committed
b191433
[Fixes ]:
mwallschlaeger
committed
0edacdd
upgrade path
mwallschlaeger
committed
6275bfa

Commits on Jul 16, 2026