aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

[HOM-59] security(media): enforce baseline PSS for media namespace #262

Open
aaron wants to merge 1 commit from security/HOM-59-pss-baseline into live
pull from: security/HOM-59-pss-baseline
merge into: aaron:live
Conversation 0 Commits 1 Files changed 1 +8 -3
aaron commented 2026-06-18 07:54:01 +00:00
Owner
Copy link

Security review remediation for HOM-59.

Downgrades the media namespace Pod Security Standard from privileged to baseline because none of the media pods require privileged features.

  • Adds a justification annotation to the namespace manifest.
  • Syncs the same labels through the ArgoCD managedNamespaceMetadata in the prod repo PR.

Relates to HOM-56.

Security review remediation for [HOM-59](/HOM/issues/HOM-59). Downgrades the `media` namespace Pod Security Standard from `privileged` to `baseline` because none of the media pods require privileged features. - Adds a justification annotation to the namespace manifest. - Syncs the same labels through the ArgoCD `managedNamespaceMetadata` in the `prod` repo PR. Relates to [HOM-56](/HOM/issues/HOM-56).
security(media): enforce baseline Pod Security Standard for media namespace
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
94c0a49609 
Add a justification annotation and downgrade the PSS labels from
privileged to baseline. Media pods do not require privileged mode:
hostNetwork=false, no privileged containers, and only SETUID/SETGID/CHOWN
capabilities are added to handle NFS ownership.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Required
Details
CI Review / helm-validate (pull_request) Has been cancelled
Required
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Required
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Required
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Required
Details
Some required checks were not successful.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin security/HOM-59-pss-baseline:security/HOM-59-pss-baseline
git switch security/HOM-59-pss-baseline
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!262
No description provided.