From cba3deb94e84af956c2d09521d64bd94fb82ece5 Mon Sep 17 00:00:00 2001 From: "DODDA, PRATEEK REDDY" Date: Thu, 9 Jul 2020 18:20:23 -0500 Subject: [PATCH] Add missing security context to Keystone pods/containers This updates the Keystone chart to include the pod security context on the pod template. This also adds the container security context to set readOnlyRootFilesystem flag to true. Change-Id: I2ac3a4efa6798e263de19f0db444f37c5236d121 --- keystone/templates/job-credential-setup.yaml | 2 ++ keystone/templates/job-domain-manage.yaml | 2 ++ keystone/templates/job-fernet-setup.yaml | 2 ++ keystone/values.yaml | 21 ++++++++++++++++++++ 4 files changed, 27 insertions(+) diff --git a/keystone/templates/job-credential-setup.yaml b/keystone/templates/job-credential-setup.yaml index c1c475b55b..53cdce43d1 100644 --- a/keystone/templates/job-credential-setup.yaml +++ b/keystone/templates/job-credential-setup.yaml @@ -67,6 +67,7 @@ spec: {{ dict "envAll" $envAll "podName" "keystone-credential-setup" "containerNames" (list "keystone-credential-setup") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: serviceAccountName: {{ $serviceAccountName }} +{{ dict "envAll" $envAll "application" "credential_setup" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} initContainers: {{ tuple $envAll "credential_setup" $mounts_keystone_credential_setup_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} restartPolicy: OnFailure @@ -76,6 +77,7 @@ spec: - name: keystone-credential-setup {{ tuple $envAll "keystone_credential_setup" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.credential_setup | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "credential_setup" "container" "keystone_credential_setup" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: KEYSTONE_USER value: {{ .Values.jobs.credential_setup.user | quote }} diff --git a/keystone/templates/job-domain-manage.yaml b/keystone/templates/job-domain-manage.yaml index 169eb1cda6..ec43dbc45b 100644 --- a/keystone/templates/job-domain-manage.yaml +++ b/keystone/templates/job-domain-manage.yaml @@ -37,6 +37,7 @@ spec: {{ dict "envAll" $envAll "podName" "keystone-domain-manage" "containerNames" (list "keystone-domain-manage" "keystone-domain-manage-init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: serviceAccountName: {{ $serviceAccountName }} +{{ dict "envAll" $envAll "application" "domain_manage" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} restartPolicy: OnFailure nodeSelector: {{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }} @@ -62,6 +63,7 @@ spec: - name: keystone-domain-manage {{ tuple $envAll "keystone_domain_manage" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.domain_manage | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "domain_manage" "container" "keystone_domain_manage" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: {{- with $env := dict "ksUserSecret" .Values.secrets.identity.admin }} {{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }} diff --git a/keystone/templates/job-fernet-setup.yaml b/keystone/templates/job-fernet-setup.yaml index d8ca4fd0d3..ac06632f10 100644 --- a/keystone/templates/job-fernet-setup.yaml +++ b/keystone/templates/job-fernet-setup.yaml @@ -66,6 +66,7 @@ spec: {{ dict "envAll" $envAll "podName" "keystone-fernet-setup" "containerNames" (list "keystone-fernet-setup") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: serviceAccountName: {{ $serviceAccountName }} +{{ dict "envAll" $envAll "application" "fernet_setup" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} initContainers: {{ tuple $envAll "fernet_setup" $mounts_keystone_fernet_setup_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} restartPolicy: OnFailure @@ -75,6 +76,7 @@ spec: - name: keystone-fernet-setup {{ tuple $envAll "keystone_fernet_setup" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.fernet_setup | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "fernet_setup" "container" "keystone_fernet_setup" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: KEYSTONE_USER value: {{ .Values.jobs.fernet_setup.user | quote }} diff --git a/keystone/values.yaml b/keystone/values.yaml index 4ed00ffc30..76810cf0ab 100644 --- a/keystone/values.yaml +++ b/keystone/values.yaml @@ -172,6 +172,27 @@ pod: keystone_api: readOnlyRootFilesystem: true allowPrivilegeEscalation: false + credential_setup: + pod: + runAsUser: 42424 + container: + keystone_credential_setup: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + fernet_setup: + pod: + runAsUser: 42424 + container: + keystone_fernet_setup: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + domain_manage: + pod: + runAsUser: 42424 + container: + keystone_domain_manage: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false affinity: anti: type: