[G-01] Remaining PSS restricted gaps

[aaronmgn]

Summary

After PR #100, every chart-rendered container defaults to allowPrivilegeEscalation: false, capabilities: drop: ["ALL"], and seccompProfile: RuntimeDefault, and the default Graylog pod passes the "restricted" Pod Security Standard. Two gaps remain: the Datanode still fails "restricted", and readOnlyRootFilesystem is unset on both main containers.

Details

Datanode. The 7.0 image entrypoint chowns the data directory as root, then drops to uid 999 via setpriv. The chart default (values.yaml:451-457) mirrors that: it adds back CHOWN, DAC_OVERRIDE, FOWNER, SETUID, and SETGID, and leaves runAsNonRoot unset. Both violate "restricted". This is no longer blocked upstream: Datanode 7.1+ accepts GDN_RUN_AS_NONROOT=true (Graylog2/graylog-docker#306), and the chart-side work is staged on the datanode-sec-ctx branch (uid/gid 999, runAsNonRoot: true, all capabilities dropped). It is gated on the default image bump to 7.1 (#94) and should land together with it or be version-gated, since older images need the root startup path. Until then the README "Hardened Environments" section documents running the namespace at baseline.

readOnlyRootFilesystem. Unset on both main containers (values.yaml:315-322 and 451-457). Both workloads write to the container filesystem, so enabling it needs a write-path audit plus emptyDir mounts over each path. The chart has no extraVolumes/extraVolumeMounts values, so users cannot add the mounts themselves. The copy-plugin-* init containers already default it to true.

Out of scope: MongoDB operator pods (default-on, README suggests BYO MongoDB for hardened setups), the opt-in root GeoIP sidecar, and the opt-in privileged sysctlInit container.

Reference: G-01 (Production Readiness Review)

Impact

Namespaces enforcing "restricted" reject the Datanode pods, forcing baseline or an exemption. Policies requiring read-only root filesystems cannot be satisfied with this chart today.

Notes for maintainers

• Datanode fix: bump the default image to 7.1 (Bump default Graylog/Datanode version to 7.1 #94) plus the staged datanode-sec-ctx branch.
• readOnlyRootFilesystem: run both workloads with it enabled in a test environment, catalog the write failures, add emptyDir mounts, then flip the defaults. Generic extraVolumes/extraVolumeMounts values would give users an escape hatch.
• Overrides: setting a context value to null clears the field. {} does not, since Helm coalesces empty maps back to chart defaults.

[aaronmgn]

This issue will require pretty extensive testing, so make sure we test it end-to-end.