Add missing security context to Ranger-Agent pods/containers

This updates the ranger-agent chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to true

Depends-On: https://review.opendev.org/740119/

Change-Id: I9fe5d96958805ae9634521604845411d904d8458
This commit is contained in:
DODDA, PRATEEK REDDY 2020-07-07 19:36:59 -05:00 committed by Prateek Dodda
parent 6dc8ecaa2d
commit 1e7cf7b447
3 changed files with 18 additions and 0 deletions

View File

@ -39,6 +39,7 @@ spec:
{{ dict "envAll" $envAll "podName" "ranger-agent-add-region" "containerNames" (list "init" "ranger-agent-add-region" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "ranger-agent-add-region" "containerNames" (list "init" "ranger-agent-add-region" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
serviceAccountName: {{ $serviceAccountName | quote }} serviceAccountName: {{ $serviceAccountName | quote }}
{{ dict "envAll" $envAll "application" "add_region" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
restartPolicy: Never restartPolicy: Never
nodeSelector: nodeSelector:
{{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }} {{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }}
@ -49,6 +50,7 @@ spec:
image: {{ .Values.images.tags.scripted_test | quote }} image: {{ .Values.images.tags.scripted_test | quote }}
imagePullPolicy: {{ $envAll.Values.images.pull_policy | quote }} imagePullPolicy: {{ $envAll.Values.images.pull_policy | quote }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.add_region | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.add_region | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "add_region" "container" "ranger_agent_add_region" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: PARAMETERS - name: PARAMETERS
value: {{ .Values.conf.region.parameters | quote }} value: {{ .Values.conf.region.parameters | quote }}

View File

@ -35,12 +35,14 @@ spec:
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
nodeSelector: nodeSelector:
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }} {{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
{{ dict "envAll" $envAll "application" "test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }}
restartPolicy: Never restartPolicy: Never
initContainers: initContainers:
{{ tuple $envAll "tests" $mounts_tests_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 4 }} {{ tuple $envAll "tests" $mounts_tests_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 4 }}
containers: containers:
- name: ranger-agent-test - name: ranger-agent-test
image: {{ .Values.images.tags.scripted_test }} image: {{ .Values.images.tags.scripted_test }}
{{ dict "envAll" $envAll "application" "test" "container" "ranger_agent_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }}
env: env:
- name: RANGER_SERVICE_URL - name: RANGER_SERVICE_URL
value: {{ tuple "ranger_agent" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" }} value: {{ tuple "ranger_agent" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" }}

View File

@ -158,6 +158,20 @@ pod:
ranger_agent_engine: ranger_agent_engine:
readOnlyRootFilesystem: false readOnlyRootFilesystem: false
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
add_region:
pod:
runAsUser: 1000
container:
ranger_agent_add_region:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
test:
pod:
runAsUser: 1000
container:
ranger_agent_test:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
affinity: affinity:
anti: anti:
type: type: