Harden pod security: non-root, read-only rootfs, limits, NetworkPolicy

cluster/deployment.yaml

@@ -12,10 +12,39 @@ spec:
       labels:
         app: reactibot
     spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: tmp
+          emptyDir: {}
       containers:
         - name: reactibot
           image: $(IMAGE)
+          ports:
+            - containerPort: 3000
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
           env:
+            - name: HOME # npm (CMD) writes ~/.npm logs; /home/node is read-only
+              value: /tmp
             - name: ENVIRONMENT
               value: production
             - name: DISCORD_HASH

cluster/networkpolicy.yaml

@@ -0,0 +1,37 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: reactibot
+spec:
+  podSelector:
+    matchLabels:
+      app: reactibot
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 3000
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except: [10.0.0.0/8, 169.254.0.0/16]
+      ports:
+        - protocol: TCP
+          port: 443

kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - cluster/service.yaml
   - cluster/deployment.yaml
   - cluster/ingress.yaml
+  - cluster/networkpolicy.yaml
 
 configMapGenerator:
   - name: k8s-context # this is an internal name