fix(security): Haertung der minimalen k8s-Manifeste wiederhergestellt

Befunde des Commit-Security-Reviews: automountServiceAccountToken: false fuer Postgres, App und Worker; Speicherlimits fuer Migrations-initContainer und Worker; Laufzeitgrenze (activeDeadlineSeconds) fuer den Worker; Groessenlimits fuer die emptyDir-Volumes. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-28 01:15:55 +02:00
1 parent 91791b791f
commit 32a5b8eb9d
@@ -11,12 +11,14 @@ spec:
  jobTemplate:
    spec:
      backoffLimit: 1
+      activeDeadlineSeconds: 900
      template:
        metadata:
          labels:
            db-client: "true"
        spec:
          restartPolicy: Never
+          automountServiceAccountToken: false
          securityContext:
            runAsNonRoot: true
            runAsUser: 1001
@@ -29,6 +31,8 @@ spec:
              envFrom:
                - configMapRef: { name: artista-modelcamp-config }
                - secretRef: { name: artista-modelcamp-secrets }
+              resources:
+                limits: { memory: 512Mi }
              securityContext:
                allowPrivilegeEscalation: false
                capabilities: { drop: ["ALL"] }