openstack/openstack-helm-addons
Code Issues Proposed changes

Add missing security context to Ranger pods/containers

Browse Source 
This updates the Ranger chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to true.

Depends-On: https://review.opendev.org/740119/

Change-Id: Ic06caec81015ac04fb162d8c2482da6b2329e204
This commit is contained in:
DODDA, PRATEEK REDDY 2020-07-08 14:44:46 -05:00 committed by diwakar thyagaraj
parent f2d430c985
commit cbafbe21e7
9 changed files with 96 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ranger/templates/deployment-audit-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-audit-service" "containerNames" (list "init" "ranger-audit-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
{{ dict "envAll" $envAll "application" "audit" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "ranger" "audit" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "audit" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
{{ dict "envAll" $envAll "application" "audit" "container" "ranger_audit_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: SERVICE_TYPE
value: "audit"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "audit" "container" "ranger-audit-service" "type" "readiness" "probeTemplate" (include "RangerAuditServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "audit" "container" "ranger-audit-service" "type" "liveness" "probeTemplate" (include "RangerAuditServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger
mountPath: /etc/ranger
- name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true
{{ if $mounts_audit.volumeMounts }}{{ toYaml $mounts_audit.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger
emptyDir: {}
- name: ranger-bin

8
ranger/templates/deployment-cms-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-cms-service" "containerNames" (list "init" "ranger-cms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
{{ dict "envAll" $envAll "application" "cms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "ranger" "cms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "cms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
{{ dict "envAll" $envAll "application" "cms" "container" "ranger_cms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: SERVICE_TYPE
value: "cms"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "cms" "container" "ranger-cms-service" "type" "readiness" "probeTemplate" (include "RangerCmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "cms" "container" "ranger-cms-service" "type" "liveness" "probeTemplate" (include "RangerCmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger
mountPath: /etc/ranger
- name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true
{{ if $mounts_cms.volumeMounts }}{{ toYaml $mounts_cms.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger
emptyDir: {}
- name: ranger-bin

8
ranger/templates/deployment-fms-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-fms-service" "containerNames" (list "init" "ranger-fms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
{{ dict "envAll" $envAll "application" "fms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "ranger" "fms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "fms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
{{ dict "envAll" $envAll "application" "fms" "container" "ranger_fms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: SERVICE_TYPE
value: "fms"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "fms" "container" "ranger-fms-service" "type" "readiness" "probeTemplate" (include "RangerFmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "fms" "container" "ranger-fms-service" "type" "liveness" "probeTemplate" (include "RangerFmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger
mountPath: /etc/ranger
- name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true
{{ if $mounts_fms.volumeMounts }}{{ toYaml $mounts_fms.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger
emptyDir: {}
- name: ranger-bin

8
ranger/templates/deployment-ims-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-ims-service" "containerNames" (list "init" "ranger-ims-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
{{ dict "envAll" $envAll "application" "ims" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "ranger" "ims" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "ims" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
{{ dict "envAll" $envAll "application" "ims" "container" "ranger_ims_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: SERVICE_TYPE
value: "ims"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "ims" "container" "ranger-ims-service" "type" "readiness" "probeTemplate" (include "RangerImsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "ims" "container" "ranger-ims-service" "type" "liveness" "probeTemplate" (include "RangerImsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger
mountPath: /etc/ranger
- name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true
{{ if $mounts_ims.volumeMounts }}{{ toYaml $mounts_ims.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger
emptyDir: {}
- name: ranger-bin

8
ranger/templates/deployment-rds-service.yaml
View File

@ -65,7 +65,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-rds-service" "containerNames" (list "init" "ranger-rds-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
{{ dict "envAll" $envAll "application" "rds" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "ranger" "rds" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -79,7 +79,7 @@ spec:
image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "rds" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
{{ dict "envAll" $envAll "application" "rds" "container" "ranger_rds_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
{{- if .Values.manifests.secret_ssh_key }}
- name: USER
@ -146,6 +146,8 @@ spec:
{{ dict "envAll" $envAll "component" "rds" "container" "ranger-rds-service" "type" "readiness" "probeTemplate" (include "RangerRdsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "rds" "container" "ranger-rds-service" "type" "liveness" "probeTemplate" (include "RangerRdsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger
mountPath: /etc/ranger
- name: ranger-bin
@ -162,6 +164,8 @@ spec:
readOnly: true
{{ if $mounts_rds.volumeMounts }}{{ toYaml $mounts_rds.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger
emptyDir: {}
- name: ranger-bin

8
ranger/templates/deployment-rms-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-rms-service" "containerNames" (list "init" "ranger-rms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
{{ dict "envAll" $envAll "application" "rms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "ranger" "rms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "rms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
{{ dict "envAll" $envAll "application" "rms" "container" "ranger_rms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: SERVICE_TYPE
value: "rms"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "rms" "container" "ranger-rms-service" "type" "readiness" "probeTemplate" (include "RangerRmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "rms" "container" "ranger-rms-service" "type" "liveness" "probeTemplate" (include "RangerRmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger
mountPath: /etc/ranger
- name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true
{{ if $mounts_rms.volumeMounts }}{{ toYaml $mounts_rms.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger
emptyDir: {}
- name: ranger-bin

8
ranger/templates/deployment-uuid-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-uuid-service" "containerNames" (list "init" "ranger-uuid-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
{{ dict "envAll" $envAll "application" "uuid" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "ranger" "uuid" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "uuid" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
{{ dict "envAll" $envAll "application" "uuid" "container" "ranger_uuid_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: SERVICE_TYPE
value: "uuid"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "uuid" "container" "ranger-uuid-service" "type" "readiness" "probeTemplate" (include "RangerUuidServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "uuid" "container" "ranger-uuid-service" "type" "liveness" "probeTemplate" (include "RangerUuidServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger
mountPath: /etc/ranger
- name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true
{{ if $mounts_uuid.volumeMounts }}{{ toYaml $mounts_uuid.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger
emptyDir: {}
- name: ranger-bin

2
ranger/templates/pod-test.yaml
View File

@ -32,6 +32,7 @@ metadata:
{{ tuple $envAll "ranger" "test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }}
nodeSelector:
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
restartPolicy: Never
@ -40,6 +41,7 @@ spec:
containers:
- name: {{.Release.Name}}-test
image: {{ .Values.images.tags.scripted_test }}
{{ dict "envAll" $envAll "application" "test" "container" "ranger_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }}
env:
- name: cms
value: {{ tuple "cms" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" | trimSuffix .Values.endpoints.cms.path.default }}

55
ranger/values.yaml
View File

@ -145,12 +145,61 @@ dependencies:
pod:
security_context:
ranger:
audit:
pod:
runAsUser: 1000
container:
ranger_services:
readOnlyRootFilesystem: false
ranger_audit_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
cms:
pod:
runAsUser: 1000
container:
ranger_cms_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
fms:
pod:
runAsUser: 1000
container:
ranger_fms_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
ims:
pod:
runAsUser: 1000
container:
ranger_ims_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
rds:
pod:
runAsUser: 1000
container:
ranger_rds_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
rms:
pod:
runAsUser: 1000
container:
ranger_rms_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
uuid:
pod:
runAsUser: 1000
container:
ranger_uuid_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
test:
pod:
runAsUser: 1000
container:
ranger_test:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
affinity:
anti: