From 32a5b8eb9de7ee8016c848ce33ed0b8e743045db Mon Sep 17 00:00:00 2001
From: Nick Szaunig <nick.szaunig@encry.de>
Date: Mon, 28 Sep 2026 01:15:55 +0200
Subject: [PATCH] fix(security): Haertung der minimalen k8s-Manifeste
 wiederhergestellt

Befunde des Commit-Security-Reviews: automountServiceAccountToken: false
fuer Postgres, App und Worker; Speicherlimits fuer Migrations-initContainer
und Worker; Laufzeitgrenze (activeDeadlineSeconds) fuer den Worker;
Groessenlimits fuer die emptyDir-Volumes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 k8s/03-postgres.yaml | 1 +
 k8s/04-app.yaml      | 7 +++++--
 k8s/06-worker.yaml   | 4 ++++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/k8s/03-postgres.yaml b/k8s/03-postgres.yaml
index 305d7d4..d580d71 100644
--- a/k8s/03-postgres.yaml
+++ b/k8s/03-postgres.yaml
@@ -14,6 +14,7 @@ spec:
       labels:
         app: artista-modelcamp-postgres
     spec:
+      automountServiceAccountToken: false
       terminationGracePeriodSeconds: 120   # sauber herunterfahren vor dem Aushaengen
       securityContext:
         runAsNonRoot: true
diff --git a/k8s/04-app.yaml b/k8s/04-app.yaml
index fa74870..56f4888 100644
--- a/k8s/04-app.yaml
+++ b/k8s/04-app.yaml
@@ -16,6 +16,7 @@ spec:
         app: artista-modelcamp-app
         db-client: "true"
     spec:
+      automountServiceAccountToken: false
       securityContext:
         runAsNonRoot: true
         runAsUser: 1001
@@ -28,6 +29,8 @@ spec:
           command: ["prisma", "migrate", "deploy"]
           envFrom:
             - secretRef: { name: artista-modelcamp-secrets }
+          resources:
+            limits: { memory: 512Mi }
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: { drop: ["ALL"] }
@@ -67,9 +70,9 @@ spec:
         - name: media
           persistentVolumeClaim: { claimName: artista-modelcamp-media }
         - name: cache
-          emptyDir: {}
+          emptyDir: { sizeLimit: 512Mi }
         - name: tmp
-          emptyDir: {}
+          emptyDir: { sizeLimit: 64Mi }
 ---
 apiVersion: v1
 kind: Service
diff --git a/k8s/06-worker.yaml b/k8s/06-worker.yaml
index 7e74f54..19cb709 100644
--- a/k8s/06-worker.yaml
+++ b/k8s/06-worker.yaml
@@ -11,12 +11,14 @@ spec:
   jobTemplate:
     spec:
       backoffLimit: 1
+      activeDeadlineSeconds: 900
       template:
         metadata:
           labels:
             db-client: "true"
         spec:
           restartPolicy: Never
+          automountServiceAccountToken: false
           securityContext:
             runAsNonRoot: true
             runAsUser: 1001
@@ -29,6 +31,8 @@ spec:
               envFrom:
                 - configMapRef: { name: artista-modelcamp-config }
                 - secretRef: { name: artista-modelcamp-secrets }
+              resources:
+                limits: { memory: 512Mi }
               securityContext:
                 allowPrivilegeEscalation: false
                 capabilities: { drop: ["ALL"] }