eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/changelog.d/+review-cc-init-container-isolation.misc.md
Erich Blume 24e5490259 C0: review CC init-container-isolation — defer retirement to post-ringtail 
Runtime grafana pod matches the manifest and the CC's claim; bumped
last-reviewed. Noted that retiring init-chown-data in favor of fsGroup
alone should wait until grafana migrates to ringtail's k3s, since the
storage backend will change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-04 18:31:13 -07:00

450 B
Raw Blame History

Reviewed compensating control init-container-isolation (35 days stale). Grafana's running pod matches the manifest and the CC's claim — only init-chown-data runs as root with CHOWN; runtime containers all run as UID 472 with all caps dropped. Retirement (replacing init-chown-data with fsGroup alone) is plausible given the in-tree minikube-hostpath provisioner, but deferred until grafana lands on ringtail's k3s — note added to the CC.