47 lines
2.9 KiB
Markdown
47 lines
2.9 KiB
Markdown
|
# Old IPMI browser chart
|
||
|
|
|
||
|
|
Independent adapter chart for [solarkennedy/ipmi-kvm-docker](https://github.com/solarkennedy/ipmi-kvm-docker).
|
||
|
|
The public package is available from `https://brunner.ninja/charts`.
|
||
|
|
|
||
|
|
This intentionally runs obsolete Chromium and Java for legacy BMC compatibility.
|
||
|
|
Authentication and container/network isolation reduce exposure; they cannot make
|
||
|
|
an obsolete browser safe against every exploit. Use a dedicated VM instead if
|
||
|
|
sharing the Kubernetes host kernel is outside your risk tolerance.
|
||
|
|
|
||
|
|
The browser runs as UID/GID 1000 with a read-only root filesystem, zero Linux
|
||
|
|
capabilities, no privilege escalation, RuntimeDefault seccomp, no service-account
|
||
|
|
token, and bounded ephemeral writable mounts. A short init container runs as
|
||
|
|
UID 0 with the same restrictions solely to copy bundled noVNC assets out of the
|
||
|
|
upstream image's private `/root` directory. It downloads nothing. X11 TCP is
|
||
|
|
disabled and VNC listens on localhost; only noVNC HTTP/WebSocket is served.
|
||
|
|
Chromium retains upstream's `--no-sandbox` compatibility flag.
|
||
|
|
|
||
|
|
One shared desktop is used by every authorized visitor. Closing your tab does
|
||
|
|
not log out of the BMC. Sign out in the legacy browser after use. Pod replacement
|
||
|
|
clears the browser profile, downloads, and BMC sessions; there is no authoritative
|
||
|
|
data or PVC to back up. Do not save BMC passwords in the browser.
|
||
|
|
|
||
|
|
NetworkPolicy denies all traffic by default. Supply `networkPolicy.ingressFrom`
|
||
|
|
for the authenticated ingress controller and `networkPolicy.egress` or an
|
||
|
|
additional platform policy for intended destinations. Public DNS is used without
|
||
|
|
Kubernetes search suffixes. Never expose the Service directly or enable an
|
||
|
|
Ingress without authentication. The chart does not install an identity provider.
|
||
|
|
|
||
|
|
Validate with `./test.py`; use `./test.py --runtime` for a Podman smoke test of
|
||
|
|
the rendered container configuration, actual Chromium/X11 processes, HTTP and
|
||
|
|
WebSocket/RFB handshake. It requires Helm, Python with PyYAML, and Podman.
|
||
|
|
`./install.sh -f your-values.yaml` is a manual homelab recovery entry point;
|
||
|
|
normal deployments are owned by Argo CD.
|
||
|
|
|
||
|
|
Upstream publishes only the mutable `latest` tag. `Chart.yaml.appVersion` is
|
||
|
|
its canonical image tag, consumed by both containers. The exact upstream tag
|
||
|
|
`latest` is also the base Git tag. Since this is not SemVer, `git describe
|
||
|
|
--tags --long` maps reversibly to `0.0.0-latest-<count>-g<commit>`, including
|
||
|
|
count zero. Chart.yaml.version is a packaging placeholder, never a release
|
||
|
|
counter. CI tests, derives that immutable chart version, packages and publishes
|
||
|
|
it, then promotes only `bootstrap/oldipmi.yaml` in homelab-gitops. Images pull
|
||
|
|
anonymously. CI uses PACKAGE_USERNAME/PACKAGE_TOKEN and GITOPS_TOKEN, with no
|
||
|
|
Kubernetes credentials, on the established Podman-capable linux_amd64 runner.
|
||
|
|
|
||
|
|
[Homelab configuration](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/oldipmi)
|
||
|
|
selects the chart, domain, authentication middleware, and Cilium network policy.
|