Add sample kube linter workflow to play with

.github/workflows/kube-linter.yml

@@ -0,0 +1,31 @@
+name: Check Kubernetes YAMLs with kube-linter
+
+on:
+  push:
+    branches: [ test-branch-kube-lint ]
+    # Keep this list in sync with the matrix below
+    paths:
+      - 'components/ra/**'
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: fase-self-hosted-dind
+    strategy:
+      fail-fast: true
+      matrix:
+        directory:
+          - components/ra/user-claims-backend/overlays
+          - components/ra/user-claims-frontend/overlays
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Scan ${{ matrix.directory }} with KubeLinter
+        uses: stackrox/kube-linter-action@v1
+        with:
+          directory: ${{ matrix.directory }}
+          config: .kube-linter.yaml
+          format: plain

.kube-linter.yaml

@@ -0,0 +1,7 @@
+# kube-linter configuration
+# Uses kube-linter's default checks, minus the CPU/memory requests and limits checks.
+checks:
+  addAllBuiltIn: false # Keep the default set rather than enabling every built-in check
+  exclude:
+    - unset-cpu-requirements
+    - unset-memory-requirements

components/ra/user-claims-backend/base/deployment.yaml

@@ -22,14 +22,19 @@ spec:
       containers:
         - name: user-claims-backend
           imagePullPolicy: Always
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
           ports:
             - containerPort: 3001
           envFrom:
             - secretRef:
                 name: user-claims-backend
           volumeMounts:
             - name: uploads
-              mountPath: "/app/uploads"
+              mountPath: "/app/backend/uploads"
               readOnly: false
           readinessProbe:
             httpGet:

components/ra/user-claims-frontend/base/deployment.yaml

@@ -21,6 +21,11 @@ spec:
     spec:
       containers:
         - name: user-claims-frontend
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
           imagePullPolicy: Always
           ports:
             - containerPort: 6011
@@ -30,3 +35,4 @@ spec:
         - name: env-config
           secret:
             secretName: user-claims-frontend
+