From cbafbe21e757388c0d2a6aab68cfa5524fafbc8a Mon Sep 17 00:00:00 2001 From: "DODDA, PRATEEK REDDY" Date: Wed, 8 Jul 2020 14:44:46 -0500 Subject: [PATCH] Add missing security context to Ranger pods/containers This updates the Ranger chart to include the pod security context on the pod template. This also adds the container security context to set readOnlyRootFilesystem flag to true. Depends-On: https://review.opendev.org/740119/ Change-Id: Ic06caec81015ac04fb162d8c2482da6b2329e204 --- .../templates/deployment-audit-service.yaml | 8 ++- ranger/templates/deployment-cms-service.yaml | 8 ++- ranger/templates/deployment-fms-service.yaml | 8 ++- ranger/templates/deployment-ims-service.yaml | 8 ++- ranger/templates/deployment-rds-service.yaml | 8 ++- ranger/templates/deployment-rms-service.yaml | 8 ++- ranger/templates/deployment-uuid-service.yaml | 8 ++- ranger/templates/pod-test.yaml | 2 + ranger/values.yaml | 55 ++++++++++++++++++- 9 files changed, 96 insertions(+), 17 deletions(-) diff --git a/ranger/templates/deployment-audit-service.yaml b/ranger/templates/deployment-audit-service.yaml index 845d9d6c..25f4f1b1 100755 --- a/ranger/templates/deployment-audit-service.yaml +++ b/ranger/templates/deployment-audit-service.yaml @@ -66,7 +66,7 @@ spec: configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "ranger-audit-service" "containerNames" (list "init" "ranger-audit-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: -{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} +{{ dict "envAll" $envAll "application" "audit" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} affinity: {{ tuple $envAll "ranger" "audit" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} @@ -80,7 +80,7 @@ spec: image: {{ .Values.images.tags.ranger }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} -{{ dict "envAll" $envAll "application" "ranger" "container" "audit" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} +{{ dict "envAll" $envAll "application" "audit" "container" "ranger_audit_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: SERVICE_TYPE value: "audit" @@ -99,6 +99,8 @@ spec: {{ dict "envAll" $envAll "component" "audit" "container" "ranger-audit-service" "type" "readiness" "probeTemplate" (include "RangerAuditServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "audit" "container" "ranger-audit-service" "type" "liveness" "probeTemplate" (include "RangerAuditServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} volumeMounts: + - name: pod-tmp + mountPath: /tmp - name: pod-etc-ranger mountPath: /etc/ranger - name: ranger-bin @@ -115,6 +117,8 @@ spec: readOnly: true {{ if $mounts_audit.volumeMounts }}{{ toYaml $mounts_audit.volumeMounts | indent 12 }}{{ end }} volumes: + - name: pod-tmp + emptyDir: {} - name: pod-etc-ranger emptyDir: {} - name: ranger-bin diff --git a/ranger/templates/deployment-cms-service.yaml b/ranger/templates/deployment-cms-service.yaml index 860a3b35..499ec5a1 100755 --- a/ranger/templates/deployment-cms-service.yaml +++ b/ranger/templates/deployment-cms-service.yaml @@ -66,7 +66,7 @@ spec: configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "ranger-cms-service" "containerNames" (list "init" "ranger-cms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: -{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} +{{ dict "envAll" $envAll "application" "cms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} affinity: {{ tuple $envAll "ranger" "cms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} @@ -80,7 +80,7 @@ spec: image: {{ .Values.images.tags.ranger }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} -{{ dict "envAll" $envAll "application" "ranger" "container" "cms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} +{{ dict "envAll" $envAll "application" "cms" "container" "ranger_cms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: SERVICE_TYPE value: "cms" @@ -99,6 +99,8 @@ spec: {{ dict "envAll" $envAll "component" "cms" "container" "ranger-cms-service" "type" "readiness" "probeTemplate" (include "RangerCmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "cms" "container" "ranger-cms-service" "type" "liveness" "probeTemplate" (include "RangerCmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} volumeMounts: + - name: pod-tmp + mountPath: /tmp - name: pod-etc-ranger mountPath: /etc/ranger - name: ranger-bin @@ -115,6 +117,8 @@ spec: readOnly: true {{ if $mounts_cms.volumeMounts }}{{ toYaml $mounts_cms.volumeMounts | indent 12 }}{{ end }} volumes: + - name: pod-tmp + emptyDir: {} - name: pod-etc-ranger emptyDir: {} - name: ranger-bin diff --git a/ranger/templates/deployment-fms-service.yaml b/ranger/templates/deployment-fms-service.yaml index 87dc6e6a..aee0103f 100755 --- a/ranger/templates/deployment-fms-service.yaml +++ b/ranger/templates/deployment-fms-service.yaml @@ -66,7 +66,7 @@ spec: configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "ranger-fms-service" "containerNames" (list "init" "ranger-fms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: -{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} +{{ dict "envAll" $envAll "application" "fms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} affinity: {{ tuple $envAll "ranger" "fms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} @@ -80,7 +80,7 @@ spec: image: {{ .Values.images.tags.ranger }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} -{{ dict "envAll" $envAll "application" "ranger" "container" "fms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} +{{ dict "envAll" $envAll "application" "fms" "container" "ranger_fms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: SERVICE_TYPE value: "fms" @@ -99,6 +99,8 @@ spec: {{ dict "envAll" $envAll "component" "fms" "container" "ranger-fms-service" "type" "readiness" "probeTemplate" (include "RangerFmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "fms" "container" "ranger-fms-service" "type" "liveness" "probeTemplate" (include "RangerFmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} volumeMounts: + - name: pod-tmp + mountPath: /tmp - name: pod-etc-ranger mountPath: /etc/ranger - name: ranger-bin @@ -115,6 +117,8 @@ spec: readOnly: true {{ if $mounts_fms.volumeMounts }}{{ toYaml $mounts_fms.volumeMounts | indent 12 }}{{ end }} volumes: + - name: pod-tmp + emptyDir: {} - name: pod-etc-ranger emptyDir: {} - name: ranger-bin diff --git a/ranger/templates/deployment-ims-service.yaml b/ranger/templates/deployment-ims-service.yaml index 2effc5e6..dc33fe71 100755 --- a/ranger/templates/deployment-ims-service.yaml +++ b/ranger/templates/deployment-ims-service.yaml @@ -66,7 +66,7 @@ spec: configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "ranger-ims-service" "containerNames" (list "init" "ranger-ims-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: -{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} +{{ dict "envAll" $envAll "application" "ims" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} affinity: {{ tuple $envAll "ranger" "ims" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} @@ -80,7 +80,7 @@ spec: image: {{ .Values.images.tags.ranger }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} -{{ dict "envAll" $envAll "application" "ranger" "container" "ims" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} +{{ dict "envAll" $envAll "application" "ims" "container" "ranger_ims_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: SERVICE_TYPE value: "ims" @@ -99,6 +99,8 @@ spec: {{ dict "envAll" $envAll "component" "ims" "container" "ranger-ims-service" "type" "readiness" "probeTemplate" (include "RangerImsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "ims" "container" "ranger-ims-service" "type" "liveness" "probeTemplate" (include "RangerImsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} volumeMounts: + - name: pod-tmp + mountPath: /tmp - name: pod-etc-ranger mountPath: /etc/ranger - name: ranger-bin @@ -115,6 +117,8 @@ spec: readOnly: true {{ if $mounts_ims.volumeMounts }}{{ toYaml $mounts_ims.volumeMounts | indent 12 }}{{ end }} volumes: + - name: pod-tmp + emptyDir: {} - name: pod-etc-ranger emptyDir: {} - name: ranger-bin diff --git a/ranger/templates/deployment-rds-service.yaml b/ranger/templates/deployment-rds-service.yaml index 5eb77537..cc2934f9 100755 --- a/ranger/templates/deployment-rds-service.yaml +++ b/ranger/templates/deployment-rds-service.yaml @@ -65,7 +65,7 @@ spec: configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "ranger-rds-service" "containerNames" (list "init" "ranger-rds-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: -{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} +{{ dict "envAll" $envAll "application" "rds" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} affinity: {{ tuple $envAll "ranger" "rds" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} @@ -79,7 +79,7 @@ spec: image: {{ .Values.images.tags.ranger }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} -{{ dict "envAll" $envAll "application" "ranger" "container" "rds" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} +{{ dict "envAll" $envAll "application" "rds" "container" "ranger_rds_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: {{- if .Values.manifests.secret_ssh_key }} - name: USER @@ -146,6 +146,8 @@ spec: {{ dict "envAll" $envAll "component" "rds" "container" "ranger-rds-service" "type" "readiness" "probeTemplate" (include "RangerRdsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "rds" "container" "ranger-rds-service" "type" "liveness" "probeTemplate" (include "RangerRdsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} volumeMounts: + - name: pod-tmp + mountPath: /tmp - name: pod-etc-ranger mountPath: /etc/ranger - name: ranger-bin @@ -162,6 +164,8 @@ spec: readOnly: true {{ if $mounts_rds.volumeMounts }}{{ toYaml $mounts_rds.volumeMounts | indent 12 }}{{ end }} volumes: + - name: pod-tmp + emptyDir: {} - name: pod-etc-ranger emptyDir: {} - name: ranger-bin diff --git a/ranger/templates/deployment-rms-service.yaml b/ranger/templates/deployment-rms-service.yaml index 38af9e1e..342d381c 100755 --- a/ranger/templates/deployment-rms-service.yaml +++ b/ranger/templates/deployment-rms-service.yaml @@ -66,7 +66,7 @@ spec: configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "ranger-rms-service" "containerNames" (list "init" "ranger-rms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: -{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} +{{ dict "envAll" $envAll "application" "rms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} affinity: {{ tuple $envAll "ranger" "rms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} @@ -80,7 +80,7 @@ spec: image: {{ .Values.images.tags.ranger }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} -{{ dict "envAll" $envAll "application" "ranger" "container" "rms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} +{{ dict "envAll" $envAll "application" "rms" "container" "ranger_rms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: SERVICE_TYPE value: "rms" @@ -99,6 +99,8 @@ spec: {{ dict "envAll" $envAll "component" "rms" "container" "ranger-rms-service" "type" "readiness" "probeTemplate" (include "RangerRmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "rms" "container" "ranger-rms-service" "type" "liveness" "probeTemplate" (include "RangerRmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} volumeMounts: + - name: pod-tmp + mountPath: /tmp - name: pod-etc-ranger mountPath: /etc/ranger - name: ranger-bin @@ -115,6 +117,8 @@ spec: readOnly: true {{ if $mounts_rms.volumeMounts }}{{ toYaml $mounts_rms.volumeMounts | indent 12 }}{{ end }} volumes: + - name: pod-tmp + emptyDir: {} - name: pod-etc-ranger emptyDir: {} - name: ranger-bin diff --git a/ranger/templates/deployment-uuid-service.yaml b/ranger/templates/deployment-uuid-service.yaml index 9abc20d2..44431aad 100755 --- a/ranger/templates/deployment-uuid-service.yaml +++ b/ranger/templates/deployment-uuid-service.yaml @@ -66,7 +66,7 @@ spec: configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "ranger-uuid-service" "containerNames" (list "init" "ranger-uuid-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: -{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} +{{ dict "envAll" $envAll "application" "uuid" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} affinity: {{ tuple $envAll "ranger" "uuid" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} @@ -80,7 +80,7 @@ spec: image: {{ .Values.images.tags.ranger }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} -{{ dict "envAll" $envAll "application" "ranger" "container" "uuid" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} +{{ dict "envAll" $envAll "application" "uuid" "container" "ranger_uuid_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: SERVICE_TYPE value: "uuid" @@ -99,6 +99,8 @@ spec: {{ dict "envAll" $envAll "component" "uuid" "container" "ranger-uuid-service" "type" "readiness" "probeTemplate" (include "RangerUuidServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "uuid" "container" "ranger-uuid-service" "type" "liveness" "probeTemplate" (include "RangerUuidServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} volumeMounts: + - name: pod-tmp + mountPath: /tmp - name: pod-etc-ranger mountPath: /etc/ranger - name: ranger-bin @@ -115,6 +117,8 @@ spec: readOnly: true {{ if $mounts_uuid.volumeMounts }}{{ toYaml $mounts_uuid.volumeMounts | indent 12 }}{{ end }} volumes: + - name: pod-tmp + emptyDir: {} - name: pod-etc-ranger emptyDir: {} - name: ranger-bin diff --git a/ranger/templates/pod-test.yaml b/ranger/templates/pod-test.yaml index 534908eb..6a1773e1 100755 --- a/ranger/templates/pod-test.yaml +++ b/ranger/templates/pod-test.yaml @@ -32,6 +32,7 @@ metadata: {{ tuple $envAll "ranger" "test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }} spec: serviceAccountName: {{ $serviceAccountName }} +{{ dict "envAll" $envAll "application" "test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }} nodeSelector: {{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }} restartPolicy: Never @@ -40,6 +41,7 @@ spec: containers: - name: {{.Release.Name}}-test image: {{ .Values.images.tags.scripted_test }} +{{ dict "envAll" $envAll "application" "test" "container" "ranger_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }} env: - name: cms value: {{ tuple "cms" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" | trimSuffix .Values.endpoints.cms.path.default }} diff --git a/ranger/values.yaml b/ranger/values.yaml index 07f12acf..49facbce 100644 --- a/ranger/values.yaml +++ b/ranger/values.yaml @@ -145,12 +145,61 @@ dependencies: pod: security_context: - ranger: + audit: pod: runAsUser: 1000 container: - ranger_services: - readOnlyRootFilesystem: false + ranger_audit_service: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + cms: + pod: + runAsUser: 1000 + container: + ranger_cms_service: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + fms: + pod: + runAsUser: 1000 + container: + ranger_fms_service: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + ims: + pod: + runAsUser: 1000 + container: + ranger_ims_service: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + rds: + pod: + runAsUser: 1000 + container: + ranger_rds_service: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + rms: + pod: + runAsUser: 1000 + container: + ranger_rms_service: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + uuid: + pod: + runAsUser: 1000 + container: + ranger_uuid_service: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + test: + pod: + runAsUser: 1000 + container: + ranger_test: + readOnlyRootFilesystem: true allowPrivilegeEscalation: false affinity: anti: