chore(kubernetes): house keeping

buroa · Jan 16, 2025 · 74e288c · 74e288c
1 parent 4917f32
commit 74e288c
Show file tree

Hide file tree

Showing 29 changed files with 29 additions and 59 deletions.
diff --git a/kubernetes/apps/external-secrets/onepassword-connect/app/helmrelease.yaml b/kubernetes/apps/external-secrets/onepassword-connect/app/helmrelease.yaml
@@ -69,8 +69,7 @@ spec:
             securityContext: &securityContext
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
           sync:
             image:
               repository: docker.io/1password/connect-sync

diff --git a/kubernetes/apps/home/atuin/app/helmrelease.yaml b/kubernetes/apps/home/atuin/app/helmrelease.yaml
@@ -74,8 +74,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/home/go2rtc/app/helmrelease.yaml b/kubernetes/apps/home/go2rtc/app/helmrelease.yaml
@@ -56,8 +56,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       annotations:
         k8s.v1.cni.cncf.io/networks: |

diff --git a/kubernetes/apps/home/home-assistant/app/helmrelease.yaml b/kubernetes/apps/home/home-assistant/app/helmrelease.yaml
@@ -48,8 +48,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       annotations:
         k8s.v1.cni.cncf.io/networks: |

diff --git a/kubernetes/apps/home/zigbee2mqtt/app/helmrelease.yaml b/kubernetes/apps/home/zigbee2mqtt/app/helmrelease.yaml
@@ -76,9 +76,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                add: ["NET_BIND_SERVICE"]
-                drop: ["ALL"]
+              capabilities: { add: ["NET_BIND_SERVICE"], drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/kube-system/generic-device-plugin/app/helmrelease.yaml b/kubernetes/apps/kube-system/generic-device-plugin/app/helmrelease.yaml
@@ -43,8 +43,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       priorityClassName: system-node-critical
     persistence:

diff --git a/kubernetes/apps/media/autobrr/app/helmrelease.yaml b/kubernetes/apps/media/autobrr/app/helmrelease.yaml
@@ -67,8 +67,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/bazarr/app/helmrelease.yaml b/kubernetes/apps/media/bazarr/app/helmrelease.yaml
@@ -58,8 +58,7 @@ spec:
             securityContext: &securityContext
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
           subcleaner:
             image:
               repository: registry.k8s.io/git-sync/git-sync

diff --git a/kubernetes/apps/media/cross-seed/app/helmrelease.yaml b/kubernetes/apps/media/cross-seed/app/helmrelease.yaml
@@ -60,8 +60,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/overseerr/app/helmrelease.yaml b/kubernetes/apps/media/overseerr/app/helmrelease.yaml
@@ -54,8 +54,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/plex/app/helmrelease.yaml b/kubernetes/apps/media/plex/app/helmrelease.yaml
@@ -60,8 +60,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       nodeSelector:
         intel.feature.node.kubernetes.io/gpu: "true"

diff --git a/kubernetes/apps/media/prowlarr/app/helmrelease.yaml b/kubernetes/apps/media/prowlarr/app/helmrelease.yaml
@@ -70,8 +70,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml b/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml
@@ -59,8 +59,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/qbittorrent/tools/qbtools/helmrelease.yaml b/kubernetes/apps/media/qbittorrent/tools/qbtools/helmrelease.yaml
@@ -60,8 +60,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
         containers:
           prune-unregistered:
             <<: *container

diff --git a/kubernetes/apps/media/radarr/app/helmrelease.yaml b/kubernetes/apps/media/radarr/app/helmrelease.yaml
@@ -70,8 +70,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/recyclarr/app/helmrelease.yaml b/kubernetes/apps/media/recyclarr/app/helmrelease.yaml
@@ -51,8 +51,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/sabnzbd/app/helmrelease.yaml b/kubernetes/apps/media/sabnzbd/app/helmrelease.yaml
@@ -71,8 +71,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/sonarr/app/helmrelease.yaml b/kubernetes/apps/media/sonarr/app/helmrelease.yaml
@@ -70,8 +70,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/media/tautulli/app/helmrelease.yaml b/kubernetes/apps/media/tautulli/app/helmrelease.yaml
@@ -53,8 +53,7 @@ spec:
             securityContext: &securityContext
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
           jbops:
             image:
               repository: registry.k8s.io/git-sync/git-sync

diff --git a/kubernetes/apps/media/unpackerr/app/helmrelease.yaml b/kubernetes/apps/media/unpackerr/app/helmrelease.yaml
@@ -51,8 +51,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/monitoring/gatus/app/helmrelease.yaml b/kubernetes/apps/monitoring/gatus/app/helmrelease.yaml
@@ -80,8 +80,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/monitoring/karma/app/helmrelease.yaml b/kubernetes/apps/monitoring/karma/app/helmrelease.yaml
@@ -54,8 +54,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/monitoring/kromgo/app/helmrelease.yaml b/kubernetes/apps/monitoring/kromgo/app/helmrelease.yaml
@@ -58,8 +58,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/...rnetes/apps/monitoring/kube-prometheus-stack/tools/alertmanager-silencer/helmrelease.yaml b/...rnetes/apps/monitoring/kube-prometheus-stack/tools/alertmanager-silencer/helmrelease.yaml
@@ -52,8 +52,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/monitoring/unpoller/app/helmrelease.yaml b/kubernetes/apps/monitoring/unpoller/app/helmrelease.yaml
@@ -53,8 +53,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/networking/cloudflared/app/helmrelease.yaml b/kubernetes/apps/networking/cloudflared/app/helmrelease.yaml
@@ -71,8 +71,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/networking/echo-server/app/helmrelease.yaml b/kubernetes/apps/networking/echo-server/app/helmrelease.yaml
@@ -57,8 +57,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/networking/smtp-relay/app/helmrelease.yaml b/kubernetes/apps/networking/smtp-relay/app/helmrelease.yaml
@@ -53,8 +53,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml b/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml
@@ -49,8 +49,7 @@ spec:
             securityContext:
               allowPrivilegeEscalation: false
               readOnlyRootFilesystem: true
-              capabilities:
-                drop: ["ALL"]
+              capabilities: { drop: ["ALL"] }
     defaultPodOptions:
       affinity:
         nodeAffinity: