claude-botandClaude Opus 5.5
bbeaf622ed
CVE-2026-109618 and CVE-2026-109619 (BSI BITS-H 2026-297981-1132) allow unauthenticated RCE on every PHP before 8.5.12/8.4.27/8.3.36/8.2.35; mod_php is the highest-risk variant. The running pod reports PHP 8.3.35 and www.renner.uno serves / to the internet without the Authentik gate. Switch to the php8.5-apache variant of the same WordPress release, pinned to the index digest rebuilt on 2026-10-22 after the PHP fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
116 lines
4.3 KiB
YAML
116 lines
4.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: wordpress
|
|
namespace: wordpress
|
|
annotations:
|
|
secret.reloader.stakater.com/reload: wordpress-secrets
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
# RWO volume, single writer — the rolling default would deadlock on the
|
|
# new pod waiting for a volume the old pod still holds.
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: wordpress
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: wordpress
|
|
spec:
|
|
securityContext:
|
|
# wp-content must be writable by Apache (www-data, uid/gid 33) for
|
|
# media uploads and plugin installs.
|
|
fsGroup: 33
|
|
containers:
|
|
- name: wordpress
|
|
image: wordpress:7.1.3-php8.5-apache@sha256:ce31904fa1e51b73543fa2e35cc8f1747589b2abf48dc747b422749b88b77e9e
|
|
ports:
|
|
- name: http
|
|
containerPort: 80
|
|
env:
|
|
# The operator names the base Service after the MariaDB resource;
|
|
# the CRD's separate primaryService/secondaryService fields are the
|
|
# suffixed variants for replicated setups, which this is not
|
|
# (replicas: 1). Not verified against a running cluster — if it is
|
|
# wrong the pod fails loudly on connect at startup rather than
|
|
# degrading quietly. Confirm with `kubectl get svc -n wordpress`
|
|
# on first deploy.
|
|
- name: WORDPRESS_DB_HOST
|
|
value: wordpress-mariadb.wordpress.svc.cluster.local:3306
|
|
- name: WORDPRESS_DB_NAME
|
|
value: wordpress
|
|
- name: WORDPRESS_DB_USER
|
|
value: wordpress
|
|
- name: WORDPRESS_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
# Generated by the operator from the MariaDB CR — never
|
|
# stored in Git or OpenBao.
|
|
name: wordpress-mariadb-app
|
|
key: password
|
|
- name: WORDPRESS_CONFIG_EXTRA
|
|
value: |
|
|
define('WP_HOME', 'https://www.renner.uno');
|
|
define('WP_SITEURL', 'https://www.renner.uno');
|
|
define('FORCE_SSL_ADMIN', true);
|
|
/* Traefik terminates TLS; without this WordPress sees plain
|
|
HTTP and builds http:// URLs into every page and redirect. */
|
|
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
|
|
$_SERVER['HTTPS'] = 'on';
|
|
}
|
|
/* Core lives in the image, not on the volume — the updater
|
|
would only fail against a read-only docroot. Plugin and
|
|
theme installs are unaffected. */
|
|
define('WP_AUTO_UPDATE_CORE', false);
|
|
/* No add_filter() here. WORDPRESS_CONFIG_EXTRA is eval'd inside
|
|
wp-config.php, long before wp-settings.php loads the plugin
|
|
API, so any add_filter call is a fatal error on every request
|
|
— which is exactly what happened on first deploy. xmlrpc is
|
|
handled at the ingress instead, by routing /xmlrpc.php
|
|
through the Authentik gate. */
|
|
envFrom:
|
|
# The eight WordPress salts. Rotating them in OpenBao invalidates
|
|
# every session — which is the intended lever, not a side effect.
|
|
- secretRef:
|
|
name: wordpress-secrets
|
|
volumeMounts:
|
|
- name: content
|
|
mountPath: /var/www/html/wp-content
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 768Mi
|
|
volumes:
|
|
- name: content
|
|
persistentVolumeClaim:
|
|
claimName: wordpress-content
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: wordpress
|
|
namespace: wordpress
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: wordpress
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: http
|