Skip to content

docs: add no privilege escalation to the restricted hardening posture - #861

Draft
ExtraToast wants to merge 1 commit into
mainfrom
docs/hardening-no-privilege-escalation
Draft

docs: add no privilege escalation to the restricted hardening posture#861
ExtraToast wants to merge 1 commit into
mainfrom
docs/hardening-no-privilege-escalation

Conversation

@ExtraToast

@ExtraToast ExtraToast commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Adds "no privilege escalation" to the restricted hardening posture.
  • Updates ADR 0020 and the spec lines in 10-project-intent, 20-resolved-deployment and 30-deliverables.

Validation

  • Not checked against main's current hardening text.

Risk

  • Draft. The branch is about 296 commits behind main and conflicts with it. It needs a rebase before review.

Links

Checklist

  • Labels match the change type and area
  • Project Dependency Dashboard #2 should pick this up automatically
  • Release Please and Renovate labels were not renamed or removed

@ExtraToast
docs: add no privilege escalation to the restricted hardening posture
2d3212f 
The posture named restricted listed four controls and left out
allowPrivilegeEscalation, one Kubernetes' own restricted Pod Security
Standard requires. Rendering it, in both implementations and every
oracle tree, is #294; the test 0020 owes is #295.
@ExtraToast

ExtraToast commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Provenance, moved here from the description. This branch was preserved in the machine-migration sweep of 2026-11-09:

  • Local branch docs/hardening-no-privilege-escalation, never pushed before this sweep. Pushed during the machine-migration preservation sweep.

@ExtraToast ExtraToast added type: docs Documentation-only change. area: deploy homelab-deploy, deploy-v2, manifests, and rollout flow. component: security Security, permissions, secrets, or vulnerability handling. labels Nov 9, 2026
@ExtraToast ExtraToast closed this Nov 10, 2026
@ExtraToast ExtraToast reopened this Nov 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area: deploy homelab-deploy, deploy-v2, manifests, and rollout flow. component: security Security, permissions, secrets, or vulnerability handling. type: docs Documentation-only change.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add no privilege escalation to the restricted hardening posture

1 participant

@ExtraToast