From da5211804517f05a6c2cae93f02c662a5459f13f Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@proton.me>
Date: Mon, 9 Feb 2026 22:40:48 +0000
Subject: [PATCH] harden n9n deployment

---
 apps/base/customer1/deployment.yaml | 56 +++++++++++++++++++++++------
 apps/base/customer1/namespace.yaml  |  4 ++-
 2 files changed, 48 insertions(+), 12 deletions(-)

diff --git a/apps/base/customer1/deployment.yaml b/apps/base/customer1/deployment.yaml
index b3523f9..940fa6a 100644
--- a/apps/base/customer1/deployment.yaml
+++ b/apps/base/customer1/deployment.yaml
@@ -5,6 +5,7 @@ metadata:
   namespace: customer1 
   labels:
     app: customer1-n8n  
+
 spec:
   selector:
     matchLabels:
@@ -18,28 +19,52 @@ spec:
       labels:
         app: customer1-n8n   
     spec:
-      # initContainers:
-        # Init containers are exactly like regular containers, except:
-          # - Init containers always run to completion.
-          # - Each init container must complete successfully before the next one starts.
       securityContext:
+        runAsNonroot: True
+
         runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000
-
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: customer1-n8n  
         image: docker.n8n.io/n8nio/n8n:2.1.4 
         imagePullPolicy: IfNotPresent
+        
         resources:
+          
           requests:
             memory: "500Mi"
             cpu: "250m"
           limits:
             memory: "1Gi"
             cpu: "500"
+          
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 3008
+            initialDelaySeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 3008
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+        
         securityContext: 
-          allowPrivilegeEscalation: false 
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: True
+          capabilites:
+            drop:
+              - ALL 
+          
         
         
         
@@ -52,17 +77,26 @@ spec:
         ports:
         - containerPort: 5678 
           name: n8n-port 
+        
         volumeMounts:
         
-        - name: n8n-data 
-          mountPath: /home/node/.n8n 
+          - name: cache  
+            mountPath: /home/node/.cache 
+          
+          - name: tmp
+            mountPath: /tmp 
         
         
         
       volumes:
-        - name: n8n-data 
-          persistentVolumeClaim:
-            claimName: n8n-data 
+        - name: cache  
+          emptyDir: {}
+             
+        
+        - name: tmp
+          emptyDir: {}
+      
       restartPolicy: Always
+         
 
 
diff --git a/apps/base/customer1/namespace.yaml b/apps/base/customer1/namespace.yaml
index 217ff2f..803426c 100644
--- a/apps/base/customer1/namespace.yaml
+++ b/apps/base/customer1/namespace.yaml
@@ -1,4 +1,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: customer1 
+  name: customer1
+  labels:
+    pod-security.kubernetes.io/enforce: restricted