nordisk/holger

deploy/k8s/deployment.yaml

# The plain manifests: a server with no intake chain, so no scan sidecar. The
# maintained shape (the upstream with its scan worker as a sidecar, a real
# /readyz) is the Helm chart, deploy/helm/holger. Images come from holger.rs
# itself (owner decision 2026-10-26).
apiVersion: apps/v1
kind: Deployment
metadata:
  name: holger
  namespace: holger
  labels:
    app: holger
spec:
  # Single replica by design: writable file-backed repos live on one
  # ReadWriteOnce volume. Scale-out requires shared storage (RWX).
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: holger
  template:
    metadata:
      labels:
        app: holger
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
      containers:
        - name: holger
          image: holger.rs/nordisk/holger:3.0.0
          args: ["start", "--config", "/etc/holger/holger.ron"]
          ports:
            - name: grpc
              containerPort: 50051
            - name: https
              containerPort: 8443
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: "2"
              memory: 1Gi
          # Probes speak HTTPS; the self-signed/cluster cert is not verified by
          # the kubelet. Health endpoints need no client cert even under mTLS.
          livenessProbe:
            httpGet:
              path: /healthz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 10
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /readyz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 5
            periodSeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
            # The kernel-attack-surface half of the hardening. Without it the
            # container keeps the full syscall table, so the other three settings
            # bound what the process may ASK for while leaving what it may CALL
            # untouched. RuntimeDefault is the profile the runtime ships; holger
            # serves files over sockets and needs nothing exotic.
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/holger
              readOnly: true
            - name: tls
              mountPath: /etc/holger/tls
              readOnly: true
            - name: auth
              mountPath: /etc/holger/auth
              readOnly: true
            - name: data
              mountPath: /var/lib/holger
      volumes:
        - name: config
          configMap:
            name: holger-config
        - name: tls
          secret:
            secretName: holger-tls
            # HOL-NCSC: group-read only (root:fsGroup); Holger refuses a key others can read.
            defaultMode: 0440
        - name: auth
          secret:
            secretName: holger-auth
            # HOL-NCSC: group-read only (root:fsGroup); Holger refuses a key others can read.
            defaultMode: 0440
        - name: data
          persistentVolumeClaim:
            claimName: holger-data