From 1e7cf7b4475ffd9b850f29fe832b5072e3a29e60 Mon Sep 17 00:00:00 2001
From: "DODDA, PRATEEK REDDY" <prateek.reddy.dodda@att.com>
Date: Tue, 7 Jul 2020 19:36:59 -0500
Subject: [PATCH] Add missing security context to Ranger-Agent pods/containers

This updates the ranger-agent chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to true

Depends-On: https://review.opendev.org/740119/

Change-Id: I9fe5d96958805ae9634521604845411d904d8458
---
 ranger-agent/templates/job-add-region.yaml |  2 ++
 ranger-agent/templates/pod-test.yaml       |  2 ++
 ranger-agent/values.yaml                   | 14 ++++++++++++++
 3 files changed, 18 insertions(+)

diff --git a/ranger-agent/templates/job-add-region.yaml b/ranger-agent/templates/job-add-region.yaml
index 000af102..e5e91034 100755
--- a/ranger-agent/templates/job-add-region.yaml
+++ b/ranger-agent/templates/job-add-region.yaml
@@ -39,6 +39,7 @@ spec:
 {{ dict "envAll" $envAll "podName" "ranger-agent-add-region" "containerNames" (list "init" "ranger-agent-add-region" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName | quote }}
+{{ dict "envAll" $envAll "application" "add_region" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       restartPolicy: Never
       nodeSelector:
         {{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }}
@@ -49,6 +50,7 @@ spec:
           image: {{ .Values.images.tags.scripted_test | quote }}
           imagePullPolicy: {{ $envAll.Values.images.pull_policy | quote }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.add_region | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "add_region" "container" "ranger_agent_add_region" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           env:
             - name: PARAMETERS
               value: {{ .Values.conf.region.parameters | quote }}
diff --git a/ranger-agent/templates/pod-test.yaml b/ranger-agent/templates/pod-test.yaml
index 298a6d55..b5f63738 100644
--- a/ranger-agent/templates/pod-test.yaml
+++ b/ranger-agent/templates/pod-test.yaml
@@ -35,12 +35,14 @@ spec:
   serviceAccountName: {{ $serviceAccountName }}
   nodeSelector:
     {{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
+{{ dict "envAll" $envAll "application" "test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }}
   restartPolicy: Never
   initContainers:
 {{ tuple $envAll "tests" $mounts_tests_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 4 }}
   containers:
     - name: ranger-agent-test
       image: {{ .Values.images.tags.scripted_test }}
+{{ dict "envAll" $envAll "application" "test" "container" "ranger_agent_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }}
       env:
         - name: RANGER_SERVICE_URL
           value: {{ tuple "ranger_agent" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" }}
diff --git a/ranger-agent/values.yaml b/ranger-agent/values.yaml
index dbb6bb88..b0e6745f 100644
--- a/ranger-agent/values.yaml
+++ b/ranger-agent/values.yaml
@@ -158,6 +158,20 @@ pod:
         ranger_agent_engine:
           readOnlyRootFilesystem: false
           allowPrivilegeEscalation: false
+    add_region:
+      pod:
+        runAsUser: 1000
+      container:
+        ranger_agent_add_region:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+    test:
+      pod:
+        runAsUser: 1000
+      container:
+        ranger_agent_test:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
   affinity:
     anti:
       type: