[secana]

Adds chart support for the security hardening in kellnr/kellnr#1445. Chart version 6.3.0.

Changes

• New optional values, only rendered when set:
  • kellnr.registry.authMaxFailedAttempts, kellnr.registry.authFailedAttemptsWindowSeconds (login throttling)
  • kellnr.docs.buildTimeoutSeconds, kellnr.docs.buildWrapper (rustdoc build limits and sandbox wrapper)
  • kellnr.origin.cookieSecure (force the Secure cookie flag behind a TLS-terminating ingress)
  • kellnr.webhooks.blockPrivateTargets
• The default securityContext keeps drop: [ALL] but adds CHOWN, SETUID and SETGID. Newer Kellnr images start as root to install imported certificates and take over volumes written by older images, then switch to the kellnr user (uid 1000). Without these capabilities Kellnr keeps running as root and logs a warning.
• The doc builder cargo config is mounted for both the old (/usr/local/cargo) and the new (/home/kellnr/.cargo) CARGO_HOME, so the chart works with Kellnr 6.10.0 and newer images.
• README: upgrade notes for 6.3.0, a security settings table and a fully non-root example (runAsUser/fsGroup 1000).
• Schema: kellnr.origin.cookieSecure. New CI values file ci/security-settings-values.yaml.

Notes

• The doc builder token is visible to build scripts of documented crates. The values comments and README recommend a dedicated read-only user.
• fsGroup does not apply to hostPath PVs (pv.enabled), which is why root plus minimal capabilities stays the default.

Testing

• helm lint with default values and all CI values files.
• helm template: no new env vars with defaults, all new env vars with the security values file, both cargo config mounts with docBuilder.enabled, and the schema rejects a non-boolean cookieSecure.
• The container behaviour of these settings was tested with Docker on the new images: capabilities limited to CHOWN/SETUID/SETGID with a root-owned volume, an empty /etc/ssl/certs and an imported CA, plus all capabilities dropped and --user 1000:1000.