Skip to content

Commit fe4b2b4

Browse files
soniquasoniqua
authored
fix: security context, openshift adaptation (#28)
1 parent 7f3346c commit fe4b2b4

File tree

5 files changed

+279
-73
lines changed

5 files changed

+279
-73
lines changed

‎README.md‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -288,28 +288,28 @@ helm install ... --set credentialReferences.MY_GITHUB_TOKEN=<gh-pat>
288288

289289
### Service Account
290290

291-
| Name | Description | Value |
292-
| --------------------------------------------------- | -------------------------------------------------------------------------------------------- | ---------------- |
293-
| `serviceAccount.create` | Enable creation of a serviceAccount | `true` |
294-
| `serviceAccount.existingName` | Optionally provide an existing serviceAccount name | `""` |
295-
| `serviceAccount.annotations` | Additional custom annotations for the serviceAccount | `{}` |
296-
| `serviceAccount.name` | The name of the serviceAccount to create. If not set and create is true, a name is generated | `""` |
297-
| `podSecurityContext.enabled` | Enable security context for Broker Pods | `true` |
298-
| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
299-
| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
300-
| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
301-
| `podSecurityContext.fsGroup` | Group ID for the volumes of the pod | `1000` |
302-
| `containerSecurityContext.enabled` | Enabled Broker containers' Security Context | `true` |
303-
| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
304-
| `containerSecurityContext.runAsUser` | Set Broker containers' Security Context runAsUser | `1000` |
305-
| `containerSecurityContext.runAsGroup` | Set Broker containers' Security Context runAsGroup | `1000` |
306-
| `containerSecurityContext.allowPrivilegeEscalation` | Set Broker containers' Security Context allowPrivilegeEscalation | `false` |
307-
| `containerSecurityContext.capabilities.drop` | Set containers' repo server Security Context capabilities to be dropped | `["ALL"]` |
308-
| `containerSecurityContext.readOnlyRootFilesystem` | Set containers' repo server Security Context readOnlyRootFilesystem | `true` |
309-
| `containerSecurityContext.runAsNonRoot` | Set Broker containers' Security Context runAsNonRoot | `true` |
310-
| `containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
311-
| `containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
312-
| `extraVolumes` | Optionally specify extra list of additional volumes for Broker container | `[]` |
313-
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Broker container | `[]` |
314-
| `extraEnvVars` | Optionally specify extra list of additional environment variables for Broker container | `[]` |
291+
| Name | Description | Value |
292+
| --------------------------------------------------- | -------------------------------------------------------------------------------------------- | ------------------ |
293+
| `serviceAccount.create` | Enable creation of a serviceAccount | `true` |
294+
| `serviceAccount.existingName` | Optionally provide an existing serviceAccount name | `""` |
295+
| `serviceAccount.annotations` | Additional custom annotations for the serviceAccount | `{}` |
296+
| `serviceAccount.name` | The name of the serviceAccount to create. If not set and create is true, a name is generated | `""` |
297+
| `podSecurityContext.enabled` | Enable security context for Broker Pods | `true` |
298+
| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
299+
| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
300+
| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
301+
| `podSecurityContext.fsGroup` | Group ID for the volumes of the pod | `1000` |
302+
| `containerSecurityContext.enabled` | Enable Broker container security context | `true` |
303+
| `containerSecurityContext.seLinuxOptions` | Set SELinux options for Broker container | `{}` |
304+
| `containerSecurityContext.runAsUser` | | `1000` |
305+
| `containerSecurityContext.runAsGroup` | | `1000` |
306+
| `containerSecurityContext.allowPrivilegeEscalation` | Allow the Broker container to escalate privileges | `false` |
307+
| `containerSecurityContext.capabilities.drop` | ] Linux capabilities to drop | `""` |
308+
| `containerSecurityContext.readOnlyRootFilesystem` | Must be set to false; Broker will write configuration to filesystem upon startup | `false` |
309+
| `containerSecurityContext.runAsNonRoot` | Run Broker as non-root | `true` |
310+
| `containerSecurityContext.privileged` | Run Broker as a privileged container | `false` |
311+
| `containerSecurityContext.seccompProfile.type` | Set the `seccomProfile` for Broker | `"RunTimeDefault"` |
312+
| `extraVolumes` | Optionally specify extra list of additional volumes for Broker container | `[]` |
313+
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Broker container | `[]` |
314+
| `extraEnvVars` | Optionally specify extra list of additional environment variables for Broker container | `[]` |
315315

‎snyk-universal-broker/tests/compatibility_test.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
2+
3+
suite: OpenShift Compatibility
4+
templates:
5+
- statefulset.yaml
6+
values:
7+
- ../values.yaml
8+
- fixtures/default_values.yaml
9+
10+
tests:
11+
- it: Adjusts the security context for OpenShift
12+
capabilities:
13+
apiVersions:
14+
- "security.openshift.io/v1"
15+
asserts:
16+
- notExists:
17+
path: spec.template.spec.securityContext.fsGroup
18+
- notExists:
19+
path: spec.template.spec.containers[0].securityContext.runAsUser
20+
- notExists:
21+
path: spec.template.spec.containers[0].securityContext.runAsGroup
22+
- notExists:
23+
path: spec.template.spec.containers[0].securityContext.seLinuxOptions
24+
25+
- it: Keeps the security context if not OpenShift
26+
asserts:
27+
- exists:
28+
path: spec.template.spec.securityContext.fsGroup
29+
- exists:
30+
path: spec.template.spec.containers[0].securityContext.runAsUser
31+
- exists:
32+
path: spec.template.spec.containers[0].securityContext.runAsGroup
33+
- exists:
34+
path: spec.template.spec.containers[0].securityContext.seLinuxOptions
35+
36+
- it: Allows for mounting of OpenShift CA via ConfigMap
37+
## ref: https://docs.openshift.com/container-platform/4.9/networking/configuring-a-custom-pki.html#certificate-injection-using-operators_configuring-a-custom-pki
38+
set:
39+
extraVolumes:
40+
- name: trusted-ca
41+
configMap:
42+
name: trusted-ca
43+
items:
44+
- key: ca-bundle.crt
45+
path: tls-ca-bundle.pem
46+
extraVolumeMounts:
47+
- name: trusted-ca
48+
mountPath: /home/node/cacert
49+
readOnly: true
50+
caCertMount:
51+
path: /home/node/cacert
52+
name: tls-ca-bundle.pem
53+
extraEnvVars:
54+
- name: CA_CERT
55+
value: /home/node/cacert/tls-ca-bundle.pem
56+
asserts:
57+
- contains:
58+
path: spec.template.spec.containers[0].volumeMounts
59+
content:
60+
name: trusted-ca
61+
mountPath: /home/node/cacert
62+
readOnly: true
63+
- contains:
64+
path: spec.template.spec.volumes
65+
content:
66+
name: trusted-ca
67+
configMap:
68+
name: trusted-ca
69+
items:
70+
- key: ca-bundle.crt
71+
path: tls-ca-bundle.pem
72+
- contains:
73+
path: spec.template.spec.containers[0].env
74+
content:
75+
name: CA_CERT
76+
value: /home/node/cacert/tls-ca-bundle.pem

‎snyk-universal-broker/tests/pod_runtimes_test.yaml‎

Lines changed: 65 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -7,50 +7,27 @@ templates:
77
- statefulset.yaml
88

99
tests:
10-
- it: should set pod security context when enabled
11-
set:
12-
podSecurityContext.enabled: true
13-
podSecurityContext.fsGroup: 1001
14-
podSecurityContext.fsGroupChangePolicy: "Always"
15-
podSecurityContext.supplementalGroups: [2000]
16-
podSecurityContext.sysctls:
17-
- name: "net.core.somaxconn"
18-
value: "1024"
10+
- it: should set pod security context by default
1911
asserts:
2012
- equal:
2113
path: spec.template.spec.securityContext.fsGroup
22-
value: 1001
23-
- equal:
24-
path: spec.template.spec.securityContext.fsGroupChangePolicy
25-
value: "Always"
26-
- equal:
27-
path: spec.template.spec.securityContext.supplementalGroups[0]
28-
value: 2000
29-
- equal:
30-
path: spec.template.spec.securityContext.sysctls[0].name
31-
value: "net.core.somaxconn"
32-
- equal:
33-
path: spec.template.spec.securityContext.sysctls[0].value
34-
value: "1024"
14+
value: 1000
3515

36-
- it: should set container security context when enabled
16+
- it: disables pod security context
3717
set:
38-
containerSecurityContext.enabled: true
39-
containerSecurityContext.runAsUser: 1001
40-
containerSecurityContext.runAsGroup: 1001
41-
containerSecurityContext.runAsNonRoot: true
42-
containerSecurityContext.allowPrivilegeEscalation: false
43-
containerSecurityContext.capabilities.drop: ["ALL"]
44-
containerSecurityContext.seccompProfile.type: "RuntimeDefault"
45-
containerSecurityContext.privileged: false
46-
containerSecurityContext.readOnlyRootFilesystem: true
18+
podSecurityContext.enabled: false
19+
asserts:
20+
- notExists:
21+
path: spec.template.spec.securityContext
22+
23+
- it: should set container security context by default
4724
asserts:
4825
- equal:
4926
path: spec.template.spec.containers[0].securityContext.runAsUser
50-
value: 1001
27+
value: 1000
5128
- equal:
5229
path: spec.template.spec.containers[0].securityContext.runAsGroup
53-
value: 1001
30+
value: 1000
5431
- equal:
5532
path: spec.template.spec.containers[0].securityContext.runAsNonRoot
5633
value: true
@@ -68,7 +45,60 @@ tests:
6845
value: false
6946
- equal:
7047
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
71-
value: true
48+
value: false
49+
50+
- it: disables container security context
51+
set:
52+
containerSecurityContext.enabled: false
53+
asserts:
54+
- notExists:
55+
path: spec.template.spec.containers[0].securityContext
56+
57+
- it: sets extra pod security context options
58+
set:
59+
podSecurityContext.fsGroup: 1001
60+
podSecurityContext.fsGroupChangePolicy: "OnRootMismatch"
61+
podSecurityContext.supplementalGroups: [2000]
62+
podSecurityContext.sysctls:
63+
- name: "net.core.somaxconn"
64+
value: "1024"
65+
asserts:
66+
- equal:
67+
path: spec.template.spec.securityContext.fsGroup
68+
value: 1001
69+
- equal:
70+
path: spec.template.spec.securityContext.fsGroupChangePolicy
71+
value: "OnRootMismatch"
72+
- contains:
73+
path: spec.template.spec.securityContext.supplementalGroups
74+
content:
75+
2000
76+
- contains:
77+
path: spec.template.spec.securityContext.sysctls
78+
content:
79+
name: "net.core.somaxconn"
80+
value: "1024"
81+
82+
- it: sets extra container security context options
83+
set:
84+
containerSecurityContext.seLinuxOptions:
85+
level: "s0:c123,c456"
86+
containerSecurityContext.capabilities.add:
87+
- "NET_ADMIN"
88+
asserts:
89+
- equal:
90+
path: spec.template.spec.containers[0].securityContext.seLinuxOptions.level
91+
value: "s0:c123,c456"
92+
- contains:
93+
path: spec.template.spec.containers[0].securityContext.capabilities.add
94+
content:
95+
"NET_ADMIN"
96+
97+
- it: fails if readOnlyRootFilesystem is `true`
98+
set:
99+
containerSecurityContext.readOnlyRootFilesystem: true
100+
asserts:
101+
- failedTemplate: {}
72102

73103
- it: can add tolerations
74104
set:

‎snyk-universal-broker/values.schema.json‎

Lines changed: 96 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,101 @@
203203
}
204204
}
205205
},
206+
"podSecurityContext": {
207+
"type": "object",
208+
"properties": {
209+
"enabled": {
210+
"type": "boolean"
211+
},
212+
"fsGroupChangePolicy": {
213+
"type": "string",
214+
"enum": [
215+
"Always",
216+
"OnRootMismatch"
217+
]
218+
},
219+
"sysctls": {
220+
"type": "array",
221+
"items": {
222+
"type": "object",
223+
"properties": {
224+
"name": {
225+
"type": "string"
226+
},
227+
"value": {
228+
"type": "string"
229+
}
230+
}
231+
}
232+
},
233+
"supplementalGroups": {
234+
"type": "array",
235+
"items": {
236+
"type": "integer"
237+
}
238+
},
239+
"fsGroup": {
240+
"type": "integer",
241+
"default": 1000
242+
}
243+
}
244+
},
245+
"containerSecurityContext": {
246+
"type": "object",
247+
"properties": {
248+
"enabled": {
249+
"type": "boolean"
250+
},
251+
"seLinuxOptions": {
252+
"type": "object"
253+
},
254+
"runAsUser": {
255+
"type": "integer",
256+
"default": 1000
257+
},
258+
"runAsGroup": {
259+
"type": "integer",
260+
"default": 1000
261+
},
262+
"runAsNonRoot": {
263+
"type": "boolean",
264+
"default": true
265+
},
266+
"privileged": {
267+
"type": "boolean",
268+
"default": false
269+
},
270+
"allowPrivilegeEscalation": {
271+
"type": "boolean",
272+
"default": false
273+
},
274+
"capabilities": {
275+
"type": "object",
276+
"properties": {
277+
"drop": {
278+
"type": "array",
279+
"items": {
280+
"type": "string"
281+
}
282+
}
283+
}
284+
},
285+
"seccompProfile": {
286+
"type": "object"
287+
},
288+
"readOnlyRootFilesystem": {
289+
"type": "boolean",
290+
"enum": [
291+
false
292+
],
293+
"default": false
294+
}
295+
}
296+
},
297+
"global": {
298+
"type": "object",
299+
"additionalProperties": true
300+
},
206301
"additionalProperties": false
207-
},
208-
"additionalProperties": true
302+
}
209303
}

0 commit comments

Comments
 (0)