Harden bridge-marker SCC: restrict privileges, enforce non-root, allow projected volumes (#2336)

* bridge-marker, scc: Drop unnecessary host volume privileges in SCC

- Disallow hostDir volume plugins.
- Restrict volume types to configMap and emptyDir.
- Restrict volumes access to basic folders. Projected volume is required
for ServiceAccount token mounts.

Signed-off-by: Ram Lavi <[email protected]>

* bridge-marker: mount writable /tmp to support runtime dependencies

As a preliminary step to the next commit where runtime dependencies are
hardened, mounting /tmp. This is required for compatibility with Go
libraries and client-go when using readOnlyRootFilesystem.
This commit mounts an emptyDir at /tmp to provide writable scratch space
for the container.

This change should also occur on the repo itself, but until it does, and
in order to allow for smooth bump when it occurs - it should stay.

Signed-off-by: Ram Lavi <[email protected]>

* bridge-marker, scc: Enforce stricter runtime restrictions

- Enable readOnlyRootFilesystem for better container isolation.
- Require containers to run as non-root users.
- Set SELinux context type to MustRunAs for confinement.

Signed-off-by: Ram Lavi <[email protected]>

* ds/bridge-marker: Add securityContext to enforce non-root UID and read-only rootfs

- Configure container to run as non-root user explicitly (UID 1001).
- Enable read-only root filesystem at container level.
- Ensure consistent non-root enforcement across architectures.

This change should also occur on the repo itself, but until it does, and
in order to allow for smooth bump when it occurs - it should stay.

Signed-off-by: Ram Lavi <[email protected]>

---------

Signed-off-by: Ram Lavi <[email protected]>

Author: RamLavi

data/linux-bridge/003-bridge-marker.yaml

@@ -47,7 +47,17 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
           terminationMessagePolicy: FallbackToLogsOnError
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
       affinity: {{ toYaml .Placement.Affinity | nindent 8 }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        readOnlyRootFilesystem: true
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
@@ -89,19 +99,21 @@ kind: SecurityContextConstraints
 metadata:
   name: bridge-marker
 allowHostNetwork: true
-allowHostDirVolumePlugin: true
+allowHostDirVolumePlugin: false
 allowPrivilegedContainer: false
-readOnlyRootFilesystem: false
+readOnlyRootFilesystem: true
 allowHostIPC: false
 allowHostPID: false
 allowHostPorts: false
 runAsUser:
-  type: RunAsAny
+  type: MustRunAsNonRoot
 seLinuxContext:
-  type: RunAsAny
+  type: MustRunAs
 users:
 - system:serviceaccount:{{ .Namespace }}:bridge-marker
 volumes:
-- "*"
+- configMap
+- emptyDir
+- projected
 {{ end }}
 ---

hack/components/bump-bridge-marker.sh

@@ -26,6 +26,13 @@ function __parametize_by_object() {
 				yaml-utils::set_param ${f} spec.template.spec.affinity '{{ toYaml .Placement.Affinity | nindent 8 }}'
 				yaml-utils::set_param ${f} 'spec.template.metadata.annotations."openshift.io/required-scc"' '"bridge-marker"'
 				yaml-utils::update_param ${f} spec.template.spec.tolerations '{{ toYaml .Placement.Tolerations | nindent 8 }}'
+				yaml-utils::set_param ${f} spec.template.spec.volumes[0].name 'tmp'
+				yaml-utils::set_param ${f} spec.template.spec.volumes[0].emptyDir '{}'
+				yaml-utils::set_param ${f} spec.template.spec.containers[0].volumeMounts[0].name 'tmp'
+				yaml-utils::set_param ${f} spec.template.spec.containers[0].volumeMounts[0].mountPath '/tmp'
+				yaml-utils::set_param ${f} spec.template.spec.securityContext.runAsNonRoot 'true'
+				yaml-utils::set_param ${f} spec.template.spec.securityContext.runAsUser '1001'
+				yaml-utils::set_param ${f} spec.template.spec.securityContext.readOnlyRootFilesystem 'true'
 				yaml-utils::remove_single_quotes_from_yaml ${f}
 				;;
 		esac
@@ -68,20 +75,22 @@ kind: SecurityContextConstraints
 metadata:
   name: bridge-marker
 allowHostNetwork: true
-allowHostDirVolumePlugin: true
+allowHostDirVolumePlugin: false
 allowPrivilegedContainer: false
-readOnlyRootFilesystem: false
+readOnlyRootFilesystem: true
 allowHostIPC: false
 allowHostPID: false
 allowHostPorts: false
 runAsUser:
-  type: RunAsAny
+  type: MustRunAsNonRoot
 seLinuxContext:
-  type: RunAsAny
+  type: MustRunAs
 users:
 - system:serviceaccount:{{ .Namespace }}:bridge-marker
 volumes:
-- "*"
+- configMap
+- emptyDir
+- projected
 {{ end }}
 ---
 EOF