harden n9n deployment

apps/base/customer1/deployment.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: customer1 
   labels:
     app: customer1-n8n  
+
 spec:
   selector:
     matchLabels:
@@ -18,28 +19,52 @@ spec:
       labels:
         app: customer1-n8n   
     spec:
-      # initContainers:
-        # Init containers are exactly like regular containers, except:
-          # - Init containers always run to completion.
-          # - Each init container must complete successfully before the next one starts.
       securityContext:
+        runAsNonroot: True
+
         runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000
-
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: customer1-n8n  
         image: docker.n8n.io/n8nio/n8n:2.1.4 
         imagePullPolicy: IfNotPresent
+        
         resources:
+          
           requests:
             memory: "500Mi"
             cpu: "250m"
           limits:
             memory: "1Gi"
             cpu: "500"
+          
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 3008
+            initialDelaySeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 3008
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+        
         securityContext: 
-          allowPrivilegeEscalation: false 
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: True
+          capabilites:
+            drop:
+              - ALL 
+          
         
         
         
@@ -52,17 +77,26 @@ spec:
         ports:
         - containerPort: 5678 
           name: n8n-port 
+        
         volumeMounts:
         
-        - name: n8n-data 
+          - name: cache  
-          mountPath: /home/node/.n8n 
+            mountPath: /home/node/.cache 
+          
+          - name: tmp
+            mountPath: /tmp 
         
         
         
       volumes:
-        - name: n8n-data 
+        - name: cache  
-          persistentVolumeClaim:
+          emptyDir: {}
-            claimName: n8n-data 
+             
+        
+        - name: tmp
+          emptyDir: {}
+      
       restartPolicy: Always
+         
 
 

apps/base/customer1/namespace.yaml

@@ -1,4 +1,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: customer1 
+  name: customer1
+  labels:
+    pod-security.kubernetes.io/enforce: restricted