Tenant RGD parity gap: skeleton Kustomization's C-0017 hardening patches are not expressible in a Tenant CR

[devantler]

🤖 Generated by the Daily AI Assistant

Part of #1932 — found while implementing Phase A (#2486/#2488); blocks Phase B (the swap), feeds the pilot's parity check (#2487).

Problem

The live ascoachingogvaner skeleton's Flux Kustomization (k8s/bases/apps/ascoachingogvaner/flux-kustomization.yaml) carries a spec.patches block hardening the app Deployment to readOnlyRootFilesystem: true with writable emptyDirs (Kubescape C-0017, landed via #2455). The Tenant RGD's Kustomization templates have no patches field and the Tenant schema has no way to express it — so the skeleton→CR swap would silently drop the hardening and regress the C-0017 posture.

Proposed direction (decide one before Phase B)

1. Move the hardening into the tenant's own artifact (ascoachingogvaner repo deploy/ manifests set the securityContext + volumes directly) — keeps the RGD lean; platform-side patch was chosen originally because the OCI artifact is env-agnostic, but a universal security control arguably belongs in the app spec itself.
2. Add an optional kustomizationPatches passthrough to the Tenant schema — preserves platform-side control; grows the RGD API surface (KRO schema supports string/structural passthrough awkwardly — needs a spike).

Rough size: S–M once decided (either a tenant-repo PR + skeleton cleanup, or an RGD schema increment + pilot re-validation).

[coderabbitai]

🔗 Related PRs

#2316 - fix(kubescape): make ClusterSecurityException posture exceptions take effect [closed]
#2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [closed]
#2343 - fix(openbao): grant external-secrets role write/read on apps/actual-budget path [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Assistant

Decision: option 1 — the hardening moves into the app's own spec. Shipped as draft devantler-tech/ascoachingogvaner#95 (Fixes this issue).

Rationale:

• The writable-path set (/tmp, /var/cache/nginx, /var/run) is a property of the app's image (nginx-unprivileged), i.e. app knowledge — the platform-side patch placement in fix(security): harden containers with read-only root filesystems (Kubescape C-0017) #2455 was posture-fix expedience, and the patch's own comment already calls it a universal (env-agnostic) control, which is exactly what belongs in the env-agnostic artifact.
• Keeps the Tenant CR lean: no kustomizationPatches escape hatch in the RGD schema (an arbitrary-patch passthrough would undermine the abstraction and needs a KRO simpleschema spike).
• Direct precedent: the CNPG storage-class case (fix(wedding-db): remove the overlay storageClass override (hardcoded in the app) #2427) resolved the same tension the same way — tenant repo owns its config, platform-side override removed.

Sequencing: while #95 awaits promotion/release, the platform patch keeps applying and re-asserts identical values (verified: rendered app Deployment from #95 matches the patch output field-for-field), so there is no regression window in either order. Phase B's skeleton deletion removes the patch — no separate platform cleanup PR needed. Once #95's artifact ships, the Tenant RGD needs no patches field and Phase B is unblocked on this axis (remaining gates: Phase A #2488 merged+reconciled, pilot #2487).