From 0efa1e5125a6f5b57d717ea75fb64e8818a84d9a Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Fri, 12 Jun 2026 15:58:15 -0500
Subject: [PATCH] fix(connections): Use baseline pod security to allow
 container initialization

- Set namespace pod-security.kubernetes.io/enforce to baseline
- Remove restrictive container securityContext
- Allows signal-cli-rest-api container to run its entrypoint script
  which requires user/group modification capabilities
---
 cluster/platform/connections/deployment.yaml | 11 -----------
 cluster/platform/connections/namespace.yaml  |  3 +++
 2 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/cluster/platform/connections/deployment.yaml b/cluster/platform/connections/deployment.yaml
index 9b5370e..8a684ec 100644
--- a/cluster/platform/connections/deployment.yaml
+++ b/cluster/platform/connections/deployment.yaml
@@ -24,13 +24,6 @@ spec:
       - name: signal-cli-rest-api
         image: bbernhard/signal-cli-rest-api:0.85  # Pin version, test upgrades
         imagePullPolicy: IfNotPresent
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          seccompProfile:
-            type: RuntimeDefault
         ports:
         - containerPort: 8080
           name: http
@@ -38,10 +31,6 @@ spec:
         env:
         - name: MODE
           value: "json-rpc"  # json-rpc mode for API compatibility
-        - name: SIGNAL_CLI_UID
-          value: "0"  # Disable UID change
-        - name: SIGNAL_CLI_GID
-          value: "0"  # Disable GID change
         volumeMounts:
         - name: signal-data
           mountPath: /home/.local/share/signal-cli
diff --git a/cluster/platform/connections/namespace.yaml b/cluster/platform/connections/namespace.yaml
index c5e55eb..9f5e416 100644
--- a/cluster/platform/connections/namespace.yaml
+++ b/cluster/platform/connections/namespace.yaml
@@ -6,3 +6,6 @@ metadata:
     app.kubernetes.io/name: connections
     app.kubernetes.io/component: messaging-gateway
     theme: epcot
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: baseline
+    pod-security.kubernetes.io/warn: baseline