Restrict permissions on mounted secrets and generated key files

[darkobas2]

Two related file-permission fixes in the bee chart's statefulset.yaml.

1. Secret volumes mounted 0644

The bee-secret, bee-libp2p and bee-swarm secret volumes specify no defaultMode, so Kubernetes mounts them 0644 — a world-readable mode on the wallet password and key material. This sets defaultMode: 0440.

This is safe because podSecurityContext.fsGroup: 999 (charts/bee/values.yaml, lines 29-30) makes the files root:999 r--r-----, and bee runs as gid 999, so it can still read them.

Caveat worth flagging: anyone overriding podSecurityContext to drop fsGroup while running bee as non-root would need to adjust this, otherwise the process loses read access to its own password file.

Checked against a fleet of ~45 live deployments of this chart: all of them run with podSecurityContext.fsGroup: 999 and currently mount bee-secret at defaultMode: 420 (decimal — i.e. 0644, the Kubernetes default). Tightening to 0440 therefore leaves the file readable by bee via gid 999 in every one of them.

Scope note: the proxy sidecars do not currently mount these volumes, so this is defense in depth rather than a closed hole — it removes the world-readable mode so that any container that does mount the volume cannot read the material regardless of the UID it runs as.

2. Generated key files persist as root:root 0644

The libp2p and swarm init containers run

chown -R 999:999 /home/bee/.bee/keys;

before the key file is written. The result is that swarm.key and libp2p_v2.key land on the PVC as root:root 0644 — world-readable, and not even owned by the bee user the chown was meant to give them to.

Reordered to write → chmod 600 → chown -R, with the chown preserved on the early-exit path when no key is mapped.

This affects clusters that enable swarmSettings / libp2pSettings. On those, existing key files already on disk keep their current mode until the init container rewrites them.

Testing caveat, stated plainly: these init containers are not rendered in any of our own deployments (we run with swarmSettings / libp2pSettings disabled), so this second change has not been exercised against a running deployment on our side. It is verified by template rendering and sh -n only.

Testing

• Rendered init scripts syntax-checked with sh -n (both init containers).
• helm lint charts/bee passes.
• helm template renders cleanly, both with defaults and with libp2pSettings.enabled=true / swarmSettings.enabled=true.
• Chart version bumped 0.17.3 → 0.17.4, as ct lint requires a version increment for changed charts.
• Change 1 is corroborated against ~45 live deployments (see above). Change 2 has no live-deployment coverage from us — rendering and sh -n only.

🤖 Generated with Claude Code