[devantler]

🤖 Generated by the Daily AI Assistant

Part of #1807 (k8s 1.36 readiness → user-namespaces adoption).

What

Extends hostUsers: false (user namespaces, KEP-127, GA in Kubernetes 1.36) from the whoami stateless canary (#1808, merged) to homepage — the explicit next step in #1807's user-namespaces sequence.

- [x] Pilot on whoami (stateless canary) — #1808
- [ ] Extend to homepage (apex, always-on; configMap mounts)   ← this PR

Why

User namespaces map the container's UID/GID to an unprivileged subordinate range on the host, so a container-runtime escape lands as a non-root, capability-less host user — defence in depth on top of homepage's restricted securityContext, the restricted PSS, Kubescape/Tetragon, and SPIRE mTLS.

How

Mirrors the whoami pilot exactly:

• New k8s/providers/hetzner/apps/homepage/patches/helm-release-patch.yaml — an RFC 6902 add that appends (/-) to the base HelmRelease's existing postRenderers[0].kustomize.patches list, so the base's probe/strategy/lifecycle and Service post-render patches are preserved (a strategic-merge patch would replace the list).
• Wires it into k8s/providers/hetzner/apps/kustomization.yaml next to the whoami entry, with an explicit target (JSON6902 has no embedded identity).

Prod-only (hetzner overlay): real Hetzner/Talos kernels support user namespaces and idmap mounts; the nested-Docker local provider does not. homepage is volume-safe: its only volume is the read-only homepage-config configMap (subPath mounts) — configMap volumes are tmpfs-backed and need no idmap support, so there are no idmap-volume constraints. Stateful workloads (Longhorn/CNPG/OpenBao), which do need idmap-volume support, are deliberately left for last per #1807.

Flagger note: the chart's Canary copies this source Deployment's pod template wholesale to homepage-primary, so hostUsers: false propagates to the primary it manages.

Validation

ksail --config ksail.prod.yaml workload validate --skip-helm-render → 474 files validated, exit 0 (--skip-helm-render avoids the unrelated docker-overlay render flake, kubeconform#363).

Promotion / prod check

Draft pending the same prod confirmation the whoami pilot got: after deploy, verify the homepage pod starts, id inside the container shows the remapped UID, the configMap subPath mounts resolve, and the Flagger rollout stays clean. Held as a draft so the maintainer promotes once that's confirmed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: caf5e0d9-324d-48f3-8e28-6dd83b679e85

📥 Commits

Reviewing files that changed from the base of the PR and between c2c468a and 69ffb9a.

📒 Files selected for processing (2)

• k8s/providers/hetzner/apps/homepage/patches/helm-release-patch.yaml
• k8s/providers/hetzner/apps/kustomization.yaml

---

📝 Walkthrough

Walkthrough

A new RFC 6902 patch file is added for the homepage HelmRelease in the Hetzner overlay. It appends a Kustomize patch that sets spec.template.spec.hostUsers: false on the homepage Deployment. The Hetzner apps kustomization.yaml is updated to include this patch target alongside the existing whoami patch.

Changes

homepage hostUsers patch

Layer / File(s)	Summary
Patch definition and kustomization wiring k8s/providers/hetzner/apps/homepage/patches/helm-release-patch.yaml, k8s/providers/hetzner/apps/kustomization.yaml	New RFC 6902 patch sets hostUsers: false on the homepage Deployment via the HelmRelease post-renderer; kustomization.yaml registers this patch target alongside the existing whoami patch with updated comments.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐇 A patch so small, a flag set to false,
The homepage pod gets its own private halls.
hostUsers denied, namespaces contained,
With YAML so tidy, no mess is retained.
Hop hop, it's done — Hetzner's secured!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: enabling hostUsers:false for homepage.
Description check	✅ Passed	The description is directly related to the homepage hostUsers:false change and explains its purpose and scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/userns-homepage

---

_{Comment @coderabbitai help to get the list of available commands.}

[botantler-1]

🎉 This PR is included in version 1.90.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀