🔒 v1.0.1 - Security Hardening Release

🔒 Security Hardening Release v1.0.1

This release addresses security findings identified by Semgrep scanning and adds GitHub Actions for automated security scanning.

🔐 Security Improvements

Fixed Semgrep Security Findings

• ✅ Pod Security Contexts: All example pods now run as non-root (user 65534)
• ✅ Container Security Contexts: Added allowPrivilegeEscalation: false and readOnlyRootFilesystem: true
• ✅ Capability Dropping: All containers drop ALL capabilities for minimal attack surface
• ✅ Proper User Configuration: Containers run as unprivileged user 65534 (nobody)

Automated Security Scanning

• ✅ GitHub Actions: Added Semgrep workflow for continuous security scanning
• ✅ Pull Request Scanning: Automatic security checks on all PRs
• ✅ Zero Security Findings: Clean security scan results

📁 Files Updated

• examples/app-deployment.yaml: Added comprehensive security contexts
• examples/nginx-config.yaml: Added security contexts for both init and main containers
• .github/workflows/semgrep.yml: Added automated security scanning

🛡️ Security Verification

# Run Semgrep security scan locally
semgrep scan

# Expected output: "✅ Scan completed successfully. • Findings: 0 (0 blocking)"

🚀 Upgrade Notes

This release is fully backward compatible with v1.0.0. The security improvements only affect the example files, not the core functionality.

No Breaking Changes

• ✅ Core bunny-ip-updater.yaml unchanged
• ✅ Mastodon integration unchanged
• ✅ API and configuration format unchanged
• ✅ Only example security contexts updated

What Changed

• Example deployments now include proper security contexts
• All examples follow Kubernetes security best practices
• Added automated security scanning via GitHub Actions

📋 Quick Start (Updated)

Basic Integration

kubectl apply -f bunny-ip-updater.yaml

Secure Example Deployment

kubectl apply -f examples/app-deployment.yaml

The example now includes:

securityContext:
  runAsNonRoot: true
  runAsUser: 65534
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
    - ALL

🔍 Security Scanning

This release includes GitHub Actions workflow for automated security scanning:

• Semgrep: Static analysis security testing
• Triggered on: Pull requests and pushes to main
• Zero findings: Current codebase has no security issues

---

Security is a priority: This release demonstrates our commitment to security best practices and automated vulnerability detection.