Repository navigation
Watchdog v1.7.8
Kubernetes-ready deployment
- Added an official Helm chart for running Watchdog as a finite Kubernetes
CronJob, matching its one-shot execution model. - Added persistent state support through a PVC, with support for an existing claim or ephemeral state when persistence is intentionally disabled.
- Added safe Secret integration through
envFromSecret; secrets are never placed in Helm values or ConfigMaps. - Added an opt-in manual Kubernetes Job for commands such as configuration validation.
- Added image digest support for immutable container deployments.
Security hardening
- Kubernetes workloads now run as a non-root user with a read-only root filesystem.
- Enabled RuntimeDefault seccomp, dropped Linux capabilities, disabled privilege escalation, service-account token mounting, host networking, privileged mode, and Docker socket access.
- Documented remote HTTP remediation as the Kubernetes-compatible remediation mechanism.
CI, tests, and documentation
- Added a dedicated Kubernetes GitHub Actions workflow with Helm linting, rendered-chart validation, and real kind-cluster integration tests.
- Added tests for CronJob execution, persistent state, Docker-socket absence, and invalid configuration exit handling.
- Added a Kubernetes workflow badge to the README.
- Added Helm usage examples, a Kubernetes deployment Wiki page, an architecture decision record, release instructions, and updated AI contributor guidance.
Upgrade notes
Kubernetes deployment requires Kubernetes 1.31 or later. The default Helm release is suspended until you provide a real Watchdog configuration and explicitly enable its schedule.