From cba3deb94e84af956c2d09521d64bd94fb82ece5 Mon Sep 17 00:00:00 2001
From: "DODDA, PRATEEK REDDY" <prateek.reddy.dodda@att.com>
Date: Thu, 9 Jul 2020 18:20:23 -0500
Subject: [PATCH] Add missing security context to Keystone pods/containers
This updates the Keystone chart to include the pod
security context on the pod template.
This also adds the container security context to set
readOnlyRootFilesystem flag to true.
Change-Id: I2ac3a4efa6798e263de19f0db444f37c5236d121
---
keystone/templates/job-credential-setup.yaml | 2 ++
keystone/templates/job-domain-manage.yaml | 2 ++
keystone/templates/job-fernet-setup.yaml | 2 ++
keystone/values.yaml | 21 ++++++++++++++++++++
4 files changed, 27 insertions(+)
diff --git a/keystone/templates/job-credential-setup.yaml b/keystone/templates/job-credential-setup.yaml
index c1c475b55b..53cdce43d1 100644
--- a/keystone/templates/job-credential-setup.yaml
+++ b/keystone/templates/job-credential-setup.yaml
@@ -67,6 +67,7 @@ spec:
{{ dict "envAll" $envAll "podName" "keystone-credential-setup" "containerNames" (list "keystone-credential-setup") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
+{{ dict "envAll" $envAll "application" "credential_setup" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
initContainers:
{{ tuple $envAll "credential_setup" $mounts_keystone_credential_setup_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
restartPolicy: OnFailure
@@ -76,6 +77,7 @@ spec:
- name: keystone-credential-setup
{{ tuple $envAll "keystone_credential_setup" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.credential_setup | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "credential_setup" "container" "keystone_credential_setup" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: KEYSTONE_USER
value: {{ .Values.jobs.credential_setup.user | quote }}
diff --git a/keystone/templates/job-domain-manage.yaml b/keystone/templates/job-domain-manage.yaml
index 169eb1cda6..ec43dbc45b 100644
--- a/keystone/templates/job-domain-manage.yaml
+++ b/keystone/templates/job-domain-manage.yaml
@@ -37,6 +37,7 @@ spec:
{{ dict "envAll" $envAll "podName" "keystone-domain-manage" "containerNames" (list "keystone-domain-manage" "keystone-domain-manage-init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
+{{ dict "envAll" $envAll "application" "domain_manage" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
restartPolicy: OnFailure
nodeSelector:
{{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }}
@@ -62,6 +63,7 @@ spec:
- name: keystone-domain-manage
{{ tuple $envAll "keystone_domain_manage" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.domain_manage | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "domain_manage" "container" "keystone_domain_manage" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
{{- with $env := dict "ksUserSecret" .Values.secrets.identity.admin }}
{{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }}
diff --git a/keystone/templates/job-fernet-setup.yaml b/keystone/templates/job-fernet-setup.yaml
index d8ca4fd0d3..ac06632f10 100644
--- a/keystone/templates/job-fernet-setup.yaml
+++ b/keystone/templates/job-fernet-setup.yaml
@@ -66,6 +66,7 @@ spec:
{{ dict "envAll" $envAll "podName" "keystone-fernet-setup" "containerNames" (list "keystone-fernet-setup") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
+{{ dict "envAll" $envAll "application" "fernet_setup" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
initContainers:
{{ tuple $envAll "fernet_setup" $mounts_keystone_fernet_setup_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
restartPolicy: OnFailure
@@ -75,6 +76,7 @@ spec:
- name: keystone-fernet-setup
{{ tuple $envAll "keystone_fernet_setup" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.fernet_setup | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "fernet_setup" "container" "keystone_fernet_setup" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: KEYSTONE_USER
value: {{ .Values.jobs.fernet_setup.user | quote }}
diff --git a/keystone/values.yaml b/keystone/values.yaml
index 4ed00ffc30..76810cf0ab 100644
--- a/keystone/values.yaml
+++ b/keystone/values.yaml
@@ -172,6 +172,27 @@ pod:
keystone_api:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
+ credential_setup:
+ pod:
+ runAsUser: 42424
+ container:
+ keystone_credential_setup:
+ readOnlyRootFilesystem: true
+ allowPrivilegeEscalation: false
+ fernet_setup:
+ pod:
+ runAsUser: 42424
+ container:
+ keystone_fernet_setup:
+ readOnlyRootFilesystem: true
+ allowPrivilegeEscalation: false
+ domain_manage:
+ pod:
+ runAsUser: 42424
+ container:
+ keystone_domain_manage:
+ readOnlyRootFilesystem: true
+ allowPrivilegeEscalation: false
affinity:
anti:
type: