[arturre]

Description

• Private-key file modes (HARD-1): Secret-backed private-key volumes (keys projected volume, grpc-tls-key) now mount with mode 0440 instead of 0644. ConfigMap volumes and grpc-tls-cert stay at 0644. To keep the keys readable by the non-root node user (uid/gid 2000), the pod now gets fsGroup: 2000 whenever Secret-backed keys are mounted. Previously fsGroup was set only when a Cheetah uploader was enabled. fsGroupChangePolicy: OnRootMismatch avoids re-chowning large PVCs on every start. A user-set fsGroup is preserved.
• Node Role least privilege (HARD-2): Removed the namespace-wide get/list/watch on secrets and configmaps from the ConsensusCapsule Role. Nothing in the node pod reads them through the API. Keys and config arrive through volumes, and the UC's RBAC probe only checks the operator's config resources. Existing Roles are updated in place on the next reconcile.
• Image reference validation (HARD-3):
  • EnvoyProxy.spec.image and HAProxyCapsule.spec.image now require a tag or @sha256: digest and reject latest, enforced by CEL rules plus maxLength: 512.
  • The ImageRegistrySpec.image pattern on the NetworkUpgrade* CRDs now requires a tag or digest; a bare repository is rejected.
  • The Orbit's existing opt-in requireDigestOnDeploy now also applies to EnvoyProxy and HAProxyCapsule. An image without a digest fails the reconcile with a terminal ImageDigestRequired error and is not requeued.
• Beacon upgrade-file integrity (HARD-4): beacon file upload without --expect-hash or --expect-hash-file now logs an UnverifiedPackage warning with the package's SHA-384, asking the operator to confirm it against the release before freeze prepare.
• hostPath volumes (HARD-5): The spec.secrets.hostPath and spec.configFolder mounts are now read-only. Both fields are documented as legacy (prefer secretResources and the config CR refs), and each reconcile logs a HostPathVolume warning when either is used.
• Base image pinning (HARD-6): All FROM lines in Dockerfile, Dockerfile.beacon and Dockerfile.uc are pinned by multi-arch @sha256: digest (debian:bookworm-slim, distroless/static-debian13:nonroot). The weekly grouped Dependabot docker update keeps the digests current.

Related Issues

• Closes HARDENING LowMedium misc issues based on Security Report #1283