fix(security): bump alpine version to fix vulnerabilities

components/hydra-oidc/kustomization.yaml

@@ -15,6 +15,7 @@ configMapGenerator:
   literals:
   - APP_ENV=prod
   - APP_DEBUG=false
+  - PHP_FPM_MEMORY_LIMIT=256m
   - NGINX_APP_SERVER_LISTEN=80
   - HYDRA_ADMIN_BASE_URL=http://hydra-dispatcher
   - OIC_AUTHORIZE_ENDPOINT=https://oidc-idp/api/v1/authorize

components/hydra-oidc/resources/hydra-oidc-deployment.yaml

@@ -17,9 +17,55 @@ spec:
         app.kubernetes.io/name: hydra-oidc
     spec:
       containers:
-      - name: hydra-oidc
-        image: reg.cadoles.com/gdupont/hydra-oidc-base:frankenphp20
+      - name: hydra-oidc-php-fpm
+        image: reg.cadoles.com/cadoles/hydra-oidc-base:2025.5.2-symfonycontainerupdate.1649.313cb84
         imagePullPolicy: IfNotPresent
+        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        readinessProbe:
+          exec:
+            command:
+              - sh
+              - -c
+              - test -f /etc/php81/php-fpm.d/www.conf
+        livenessProbe:
+          exec:
+            command:
+              - php
+              - bin/console
+              - -V
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        env:
+          - name: PHP_FPM_LISTEN
+            value: 127.0.0.1:9000
+          - name: PHP_MEMORY_LIMIT
+            value: 128m
+          - name: PHP_FPM_MEMORY_LIMIT
+            value: 128m
+        envFrom:
+          - configMapRef:
+              name: hydra-oidc-env
+        volumeMounts:
+          - name: oidc-tmp
+            mountPath: /tmp
+        resources: {}
+        securityContext:
+          runAsNonRoot: true
+          runAsGroup: 1000
+          runAsUser: 1000
+
+      - name: hydra-oidc-caddy
+        image: reg.cadoles.com/cadoles/hydra-oidc-base:2025.5.2-symfonycontainerupdate.1649.313cb84
+        imagePullPolicy: IfNotPresent
+        args:
+          [
+            "/usr/sbin/caddy",
+            "run",
+            "--adapter",
+            "caddyfile",
+            "--config",
+            "/etc/caddy/Caddyfile",
+          ]
         readinessProbe:
           httpGet:
             path: /healthy
@@ -41,6 +87,8 @@ spec:
           - configMapRef:
               name: hydra-oidc-env
         env:
+          - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+            value: 127.0.0.1:9000
           - name: CADDY_HTTPS_PORT
             value: "8443"
           - name: CADDY_HTTP_PORT
@@ -49,10 +97,6 @@ spec:
             value: "/tmp/caddy"
           - name: CADDY_APP_ROOT_PUBLIC
             value: "/app/public/"
-          - name: CADDY_LOG_FILTER
-            value: healthy|metrics
-          - name: CADDY_LOG_SKIP
-            value: "true"
         resources: {}
         securityContext:
           runAsNonRoot: true

components/hydra-sql/resources/hydra-sql-deployment.yaml

@@ -20,9 +20,56 @@ spec:
         app.kubernetes.io/name: hydra-sql
     spec:
       containers:
-      - name: hydra-sql
-        image: reg.cadoles.com/gdupont/hydra-sql-base:frankenphp20
+      - name: hydra-sql-fpm
+        image: reg.cadoles.com/cadoles/hydra-sql-base:2025.5.2-symfonycontainerupdate.1627.222206a
         imagePullPolicy: IfNotPresent
+        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        readinessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - test -f /etc/php81/php-fpm.d/www.conf
+        livenessProbe:
+          exec:
+            command:
+            - php
+            - bin/console
+            - -V
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        resources: {}
+        securityContext:
+          runAsNonRoot: true
+          runAsGroup: 1000
+          runAsUser: 1000
+        envFrom:
+        - configMapRef:
+            name: hydra-sql-env
+        env:
+        - name: PHP_FPM_LISTEN
+          value: 127.0.0.1:9000
+        - name: PHP_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_LOG_LEVEL
+          value: warning
+        - name: OPCACHE_VALIDATE_TIMESTAMP
+          value: "0"
+        - name: OPCACHE_REVALIDATE_FREQ
+          value: "0"
+        volumeMounts:
+        - name: hydra-sql-php-ini
+          mountPath: /etc/php81/conf.d/03_base.ini
+          subPath: 03_base.ini
+        - name: sql-tmp
+          mountPath: /tmp
+
+      - name: hydra-sql-caddy
+        image: reg.cadoles.com/cadoles/hydra-sql-base:2025.5.2-symfonycontainerupdate.1627.222206a
+        imagePullPolicy: IfNotPresent
+        args: ["/usr/sbin/caddy", "run", "--adapter", "caddyfile", "--config", "/etc/caddy/Caddyfile"]
         readinessProbe:
           httpGet:
             path: /health
@@ -41,6 +88,8 @@ spec:
         - configMapRef:
             name: hydra-sql-env
         env:
+        - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+          value: 127.0.0.1:9000
         - name: CADDY_HTTPS_PORT
           value: "8443"
         - name: CADDY_HTTP_PORT
@@ -49,10 +98,6 @@ spec:
           value: "/tmp/caddy"
         - name: CADDY_APP_ROOT_PUBLIC
           value: "/app/public/"
-        - name: CADDY_LOG_FILTER
-          value: health|metrics
-        - name: CADDY_LOG_SKIP
-          value: "true"
         resources: {}
         securityContext:
           runAsNonRoot: true

resources/hydra-dispatcher/kustomization.yaml

@@ -14,6 +14,7 @@ configMapGenerator:
   literals:
   - APP_ENV=prod
   - APP_DEBUG=false
+  - PHP_FPM_MEMORY_LIMIT=256m
   - NGINX_APP_SERVER_LISTEN=80
   - HYDRA_BASE_URL=http://hydra:4444
   - HYDRA_ADMIN_BASE_URL=http://hydra:4445

resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml

@@ -18,9 +18,60 @@ spec:
         app.kubernetes.io/name: hydra-dispatcher
     spec:
       containers:
-        - name: hydra-dispatcher
-          image: reg.cadoles.com/gdupont/hydra-dispatcher-base:frankenphp20
+        - name: hydra-dispatcher-php-fpm
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.5.2-symfonycontainerupdate.1656.b9fc5d8
+          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - test -f /etc/php81/php-fpm.d/www.conf
+          livenessProbe:
+            exec:
+              command:
+                - php
+                - bin/console
+                - -V
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          env:
+            - name: PHP_FPM_LISTEN
+              value: 127.0.0.1:9000
+            - name: PHP_MEMORY_LIMIT
+              value: 128m
+            - name: PHP_FPM_MEMORY_LIMIT
+              value: 128m
+            - name: OPCACHE_VALIDATE_TIMESTAMP
+              value: "0"
+            - name: OPCACHE_REVALIDATE_FREQ
+              value: "0"
+          envFrom:
+            - configMapRef:
+                name: hydra-dispatcher-env
+          volumeMounts:
+            - name: hydra-dispatcher-php-ini
+              mountPath: /etc/php81/conf.d/03_base.ini
+              subPath: 03_base.ini
+            - name: dispatcher-tmp
+              mountPath: /tmp
+          resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
+        - name: hydra-dispatcher-caddy
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.5.2-symfonycontainerupdate.1656.b9fc5d8
           imagePullPolicy: IfNotPresent
+          args:
+            [
+              "/usr/sbin/caddy",
+              "run",
+              "--adapter",
+              "caddyfile",
+              "--config",
+              "/etc/caddy/Caddyfile",
+            ]
           readinessProbe:
             httpGet:
               path: /health
@@ -39,6 +90,8 @@ spec:
             - configMapRef:
                 name: hydra-dispatcher-env
           env:
+            - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+              value: 127.0.0.1:9000
             - name: CADDY_HTTPS_PORT
               value: "8443"
             - name: CADDY_HTTP_PORT
@@ -47,18 +100,14 @@ spec:
               value: "/tmp/caddy"
             - name: CADDY_APP_ROOT_PUBLIC
               value: "/app/public/"
-            - name: CADDY_LOG_FILTER
-              value: health|metrics
-            - name: CADDY_LOG_SKIP
-              value: "true"
-          securityContext:
-            runAsNonRoot: true
-            runAsGroup: 1000
-            runAsUser: 1000
           ports:
             - containerPort: 8080
               name: http
           resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
       restartPolicy: Always
       volumes:
         - name: hydra-dispatcher-php-ini