Refactor ansible-apply.yaml and inventory/hosts, add ansible.cfg

terraform/k8sapps/gitea.tf

@@ -265,6 +265,9 @@ resource "kubernetes_deployment" "gitea" {
               value = env.value
             }
           }
+          security_context {
+            allow_privilege_escalation = false
+          }
 
           dynamic "env" {
             for_each = local.gitea_secrets

terraform/k8sapps/modules/k8s_mariadb/main.tf

@@ -215,6 +215,9 @@ resource "kubernetes_cron_job_v1" "backup_data_cron" {
                 name  = "MARIADB_DATABASE"
                 value = var.app_name
               }
+              security_context {
+                allow_privilege_escalation = false
+              }
               command = ["/bin/sh", "-c"]
               args = [join(";", [
                 "/usr/bin/mariadb-dump --single-transaction -h mariadb -u $MARIADB_USER -p$MARIADB_PASSWORD $MARIADB_DATABASE | gzip > /backups/${var.app_name}-sql-`date +\"%Y%m%d\"`.sql.gz",

terraform/k8sapps/modules/scw_backup_job/main.tf

@@ -120,6 +120,9 @@ resource "kubernetes_cron_job_v1" "backup_job" {
                 "find /backup -type f -name '${var.app_name}-files-*.tar.gz' -mtime +${var.retention_days} | xargs --no-run-if-empty rm",
                 "/usr/local/bin/rclone --config=/etc/rclone.conf sync --progress /backup scaleway:$BUCKET_NAME/${var.app_name}-backup"
               ])]
+              security_context {
+                allow_privilege_escalation = false
+              }
               volume_mount {
                 name       = "backup-storage"
                 mount_path = "/backup"

terraform/k8sapps/nextcloud.tf

@@ -299,6 +299,9 @@ resource "kubernetes_deployment" "nextcloud_redis" {
               memory = "50Mi"
             }
           }
+          security_context {
+            allow_privilege_escalation = false
+          }
 
           readiness_probe {
             tcp_socket {
@@ -399,6 +402,9 @@ resource "kubernetes_deployment" "nextcloud_apache" {
               value = env.value
             }
           }
+          security_context {
+            allow_privilege_escalation = false
+          }
 
           dynamic "env" {
             for_each = local.nextcloud_secrets
@@ -476,6 +482,9 @@ resource "kubernetes_cron_job_v1" "nextcloud_cron_apache" {
 
               command = ["curl"]
               args    = ["--fail", "-L", "http://http/cron.php"]
+              security_context {
+                allow_privilege_escalation = false
+              }
             }
             restart_policy                   = "Never"
             termination_grace_period_seconds = 30

terraform/k8sapps/operator.tf

@@ -5,16 +5,109 @@ resource "kubernetes_service_account" "operator_service_account" {
   }
 }
 
-resource "kubernetes_cluster_role_binding" "operator_admin_access" {
-
+resource "kubernetes_cluster_role" "operator_maintenance_role" {
   metadata {
-    name = "operator-admin-access"
+    name = "operator-maintenance-role"
+  }
+
+  # Allow managing Pods (create, delete, exec, restart)
+  rule {
+    api_groups = [""]
+    resources  = ["pods"]
+    verbs      = ["get", "list", "watch", "create", "delete", "patch", "update", "exec"]
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["replicationcontrollers"]
+    verbs      = ["get", "list"]
+  }
+
+  rule {
+    api_groups = ["autoscaling"]
+    resources  = ["horizontalpodautoscalers"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["apps"]
+    resources  = ["deployments", "replicasets", "statefulsets", "daemonsets"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["batch"]
+    resources  = ["cronjobs"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["batch"]
+    resources  = ["jobs"]
+    verbs      = ["get", "list", "watch", "create", "delete", "patch", "update"]
+  }
+
+
+
+  # Allow reading Pod logs
+  rule {
+    api_groups = [""]
+    resources  = ["pods/log"]
+    verbs      = ["get", "list"]
+  }
+
+  # Allow managing Pod eviction for draining nodes, etc.
+  rule {
+    api_groups = ["policy"]
+    resources  = ["pods/eviction"]
+    verbs      = ["create"]
+  }
+
+  # Allow reading Namespaces (usually required for multi-namespace tools)
+  rule {
+    api_groups = [""]
+    resources  = ["namespaces"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  # Allow reading and managing PodDisruptionBudgets (useful for draining nodes)
+  rule {
+    api_groups = ["policy"]
+    resources  = ["poddisruptionbudgets"]
+    verbs      = ["get", "list", "watch", "patch", "update"]
+  }
+
+  # Allow managing Nodes (e.g., for cordoning, draining)
+  rule {
+    api_groups = [""]
+    resources  = ["nodes"]
+    verbs      = ["get", "list", "patch", "update"]
+  }
+
+  # Allow reading PersistentVolumeClaims (PVCs) but not PersistentVolumes
+  rule {
+    api_groups = [""]
+    resources  = ["persistentvolumeclaims"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  # Allow listing and getting services and endpoints (but not updating)
+  rule {
+    api_groups = [""]
+    resources  = ["services", "endpoints"]
+    verbs      = ["get", "list", "watch"]
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "operator_maintenance_binding" {
+  metadata {
+    name = "operator-maintenance-binding"
   }
 
   role_ref {
-    api_group = "rbac.authorization.k8s.io"
     kind      = "ClusterRole"
-    name      = "cluster-admin"
+    name      = kubernetes_cluster_role.operator_maintenance_role.metadata[0].name
+    api_group = "rbac.authorization.k8s.io"
   }
 
   subject {

terraform/k8sapps/wordpress.tf

@@ -182,6 +182,9 @@ resource "kubernetes_deployment" "wordpress" {
             success_threshold     = 1
             failure_threshold     = 3
           }
+          security_context {
+            allow_privilege_escalation = false
+          }
 
           env {
             name  = "WORDPRESS_DB_NAME"