Update SSH port from 22 to 2222 in Dockerfile, entrypoint, and Kubernetes configurations

k8s/README.md

@@ -62,7 +62,7 @@ If you prefer individual files, apply `namespace.yaml`, `serviceaccount.yaml`, `
 Port-forward the service instead of exposing it externally by default:
 
 ```bash
-kubectl -n k8s-mgmt-pod port-forward svc/k8s-mgmt-pod 2222:22 3000:3000
+kubectl -n k8s-mgmt-pod port-forward svc/k8s-mgmt-pod 2222:2222 3000:3000
 ```
 
 Then connect with:

k8s/deployment.yaml

@@ -25,7 +25,7 @@ spec:
           imagePullPolicy: Always
           ports:
             - name: ssh
-              containerPort: 22
+              containerPort: 2222
               protocol: TCP
             - name: webssh
               containerPort: 3000
@@ -64,20 +64,20 @@ spec:
               memory: 512Mi
           readinessProbe:
             tcpSocket:
-              port: 22
+              port: 2222
             initialDelaySeconds: 5
             periodSeconds: 10
           livenessProbe:
             tcpSocket:
-              port: 22
+              port: 2222
             initialDelaySeconds: 15
             periodSeconds: 20
           volumeMounts:
             - name: state
               mountPath: /var/lib/k8s-mgmt-pod
           securityContext:
-            # sshd still runs as root here because it needs to bind port 22 and switch to the authenticated user session.
-            # The tradeoff is deliberate: keep the container functional, then narrow capabilities instead of forcing a fragile rootless sshd setup.
+            # sshd still runs as root to switch to authenticated user sessions.
+            # Binding uses a non-privileged port, so NET_BIND_SERVICE is not required.
             runAsUser: 0
             runAsGroup: 0
             runAsNonRoot: false
@@ -85,7 +85,7 @@ spec:
             readOnlyRootFilesystem: false
             capabilities:
               drop: ["ALL"]
-              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "NET_BIND_SERVICE", "SETGID", "SETUID"]
+              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
       volumes:
         - name: state
           emptyDir: {}

k8s/networkpolicy.yaml

@@ -19,6 +19,6 @@ spec:
               k8s-mgmt-pod-access: "true"
       ports:
         - protocol: TCP
-          port: 22
+          port: 2222
         - protocol: TCP
           port: 3000

k8s/service.yaml

@@ -8,7 +8,7 @@ spec:
     app.kubernetes.io/name: k8s-mgmt-pod
   ports:
     - name: ssh
-      port: 22
+      port: 2222
       targetPort: ssh
       protocol: TCP
     - name: webssh
@@ -27,7 +27,7 @@ spec:
 #     app.kubernetes.io/name: k8s-mgmt-pod
 #   ports:
 #     - name: ssh
-#       port: 22
+#       port: 2222
 #       targetPort: ssh
 #     - name: webssh
 #       port: 3000