2.9 KiB
Old IPMI browser chart
Independent adapter chart for solarkennedy/ipmi-kvm-docker.
The public package is available from https://brunner.ninja/charts.
This intentionally runs obsolete Chromium and Java for legacy BMC compatibility. Authentication and container/network isolation reduce exposure; they cannot make an obsolete browser safe against every exploit. Use a dedicated VM instead if sharing the Kubernetes host kernel is outside your risk tolerance.
The browser runs as UID/GID 1000 with a read-only root filesystem, zero Linux
capabilities, no privilege escalation, RuntimeDefault seccomp, no service-account
token, and bounded ephemeral writable mounts. A short init container runs as
UID 0 with the same restrictions solely to copy bundled noVNC assets out of the
upstream image's private /root directory. It downloads nothing. X11 TCP is
disabled and VNC listens on localhost; only noVNC HTTP/WebSocket is served.
Chromium retains upstream's --no-sandbox compatibility flag.
One shared desktop is used by every authorized visitor. Closing your tab does not log out of the BMC. Sign out in the legacy browser after use. Pod replacement clears the browser profile, downloads, and BMC sessions; there is no authoritative data or PVC to back up. Do not save BMC passwords in the browser.
NetworkPolicy denies all traffic by default. Supply networkPolicy.ingressFrom
for the authenticated ingress controller and networkPolicy.egress or an
additional platform policy for intended destinations. Public DNS is used without
Kubernetes search suffixes. Never expose the Service directly or enable an
Ingress without authentication. The chart does not install an identity provider.
Validate with ./test.py; use ./test.py --runtime for a Podman smoke test of
the rendered container configuration, actual Chromium/X11 processes, HTTP and
WebSocket/RFB handshake. It requires Helm, Python with PyYAML, and Podman.
./install.sh -f your-values.yaml is a manual homelab recovery entry point;
normal deployments are owned by Argo CD.
Upstream publishes only the mutable latest tag. Chart.yaml.appVersion is
its canonical image tag, consumed by both containers. The exact upstream tag
latest is also the base Git tag. Since this is not SemVer, git describe --tags --long maps reversibly to 0.0.0-latest-<count>-g<commit>, including
count zero. Chart.yaml.version is a packaging placeholder, never a release
counter. CI tests, derives that immutable chart version, packages and publishes
it, then promotes only bootstrap/oldipmi.yaml in homelab-gitops. Images pull
anonymously. CI uses PACKAGE_USERNAME/PACKAGE_TOKEN and GITOPS_TOKEN, with no
Kubernetes credentials, on the established Podman-capable linux_amd64 runner.
Homelab configuration selects the chart, domain, authentication middleware, and Cilium network policy.