Skip to content

Commit 61a1c98

Browse files
mmacaimmacai
authored
Merge pull request #317 from Accenture/316-run-container-as-non-root-user
316 run rig container non-root user
2 parents 6d03d59 + 39d8818 commit 61a1c98

File tree

7 files changed

+160
-132
lines changed

7 files changed

+160
-132
lines changed

‎Dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,11 @@ RUN apk add --no-cache bash
4040
ENV LANG C.UTF-8
4141
ENV LC_ALL C.UTF-8
4242

43+
RUN addgroup -S rig -g 1000 && adduser -S rig -G rig --uid 1000
4344
WORKDIR /opt/sites/rig
4445
COPY --from=build /opt/sites/rig/_build/prod/rel/rig /opt/sites/rig/
46+
RUN chown -R rig:rig /opt/sites/rig
47+
USER rig
4548

4649
# Proxy
4750
EXPOSE 4000

‎aws.dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,12 @@ ENV KINESIS_OTP_JAR=/opt/sites/rig/kinesis-client/local-maven-repo/org/erlang/ot
4949
# Install Java
5050
RUN apk add --no-cache openjdk8-jre
5151

52+
RUN addgroup -S rig -g 1000 && adduser -S rig -G rig --uid 1000
5253
WORKDIR /opt/sites/rig
5354
COPY --from=elixir-build /opt/sites/rig/_build/prod/rel/rig /opt/sites/rig/
5455
COPY --from=java-build opt/sites/rig/kinesis-client /opt/sites/rig/kinesis-client
56+
RUN chown -R rig:rig /opt/sites/rig
57+
USER rig
5558

5659
# Proxy
5760
EXPOSE 4000

‎deployment/helm/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ If you want to use local image (either original RIG or your own based on origina
4646
1. Switch to Minikube context `eval $(minikube docker-env)`
4747
1. Build your image `docker build -t rig .`
4848
1. Check `docker images` => new image should be listed there
49-
1. Supply the image name to the [values file](reactive-interaction-gateway/values.yaml) e.g. `repository: rig` (line 8)
50-
1. Add `imagePullPolicy: Never` under line 10 [values](reactive-interaction-gateway/values.yaml)
49+
1. Change the image name to `rig` in the [values file](reactive-interaction-gateway/values.yaml) (line 10)
50+
1. Change `imagePullPolicy` to `Never` in the [values file](reactive-interaction-gateway/values.yaml) (line 12)
5151

5252

5353
## Start RIG on Kubernetes

‎deployment/helm/reactive-interaction-gateway/templates/_helpers.tpl‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,14 @@ Create chart name and version as used by the chart label.
3030
{{- define "reactive-interaction-gateway.chart" -}}
3131
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
3232
{{- end -}}
33+
34+
{{/*
35+
Return the appropriate apiVersion for deployment.
36+
*/}}
37+
{{- define "deployment.apiVersion" -}}
38+
{{- if semverCompare ">=1.9-0" .Capabilities.KubeVersion.GitVersion -}}
39+
{{- print "apps/v1" -}}
40+
{{- else -}}
41+
{{- print "apps/v1beta2" -}}
42+
{{- end -}}
43+
{{- end -}}

‎deployment/helm/reactive-interaction-gateway/templates/deployment.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
apiVersion: apps/v1beta2
1+
apiVersion: {{ template "deployment.apiVersion" . }}
22
kind: Deployment
33
metadata:
44
name: {{ template "reactive-interaction-gateway.name" . }}
@@ -19,6 +19,10 @@ spec:
1919
app: {{ template "reactive-interaction-gateway.name" . }}
2020
release: {{ .Release.Name }}
2121
spec:
22+
securityContext:
23+
runAsUser: 1000
24+
runAsGroup: 1000
25+
runAsNonRoot: true
2226
containers:
2327
- name: {{ .Chart.Name }}
2428
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

‎deployment/k8s/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ If you want to use local image (either original RIG or your own based on origina
4646
1. Switch to Minikube context `eval $(minikube docker-env)`
4747
1. Build your image `docker build -t rig .`
4848
1. Check `docker images` => new image should be listed there
49-
1. Supply image name to `rig_dns.yml` e.g. `image: rig` (line 44)
50-
1. Add `imagePullPolicy: Never` under line 44, so K8s won't try to pull local image
49+
1. Change the image name to `rig` in the `rig_dns.yml` (line 74)
50+
1. Add `imagePullPolicy: Never` just below the `image` line, so K8s won't try to pull the official image
5151

5252
Start RIG in Minikube:
5353

‎deployment/k8s/rig_dns.yml‎

Lines changed: 134 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -38,146 +38,153 @@ metadata:
3838
app: reactive-interaction-gateway-service-headless
3939
spec:
4040
ports:
41-
- port: 4000
42-
name: proxy-http
43-
- port: 4001
44-
name: proxy-https
45-
- port: 4010
46-
name: internal-http
47-
- port: 4011
48-
name: internal-https
41+
- port: 4000
42+
name: proxy-http
43+
- port: 4001
44+
name: proxy-https
45+
- port: 4010
46+
name: internal-http
47+
- port: 4011
48+
name: internal-https
4949
selector:
5050
app: reactive-interaction-gateway-deployment
5151
clusterIP: None
5252
---
5353

54-
apiVersion: apps/v1beta1
54+
apiVersion: apps/v1
5555
kind: Deployment
5656
metadata:
5757
name: reactive-interaction-gateway-deployment
5858
spec:
5959
replicas: 1
60+
selector:
61+
matchLabels:
62+
app: reactive-interaction-gateway-deployment
6063
template:
6164
metadata:
6265
labels:
6366
app: reactive-interaction-gateway-deployment
6467
spec:
68+
securityContext:
69+
runAsUser: 1000
70+
runAsGroup: 1000
71+
runAsNonRoot: true
6572
containers:
66-
- name: reactive-interaction-gateway
67-
image: accenture/reactive-interaction-gateway
68-
ports:
69-
- containerPort: 4000
70-
- containerPort: 4001
71-
- containerPort: 4010
72-
- containerPort: 4011
73-
env:
74-
## Ports
75-
- name: API_HTTP_PORT
76-
value: "4010"
77-
- name: API_HTTPS_PORT
78-
value: "4011"
79-
- name: INBOUND_PORT
80-
value: "4000"
81-
- name: INBOUND_HTTPS_PORT
82-
value: "4001"
83-
## Hostname for HTTP endpoints
84-
# - name: HOST
85-
# value: "localhost"
86-
## HTTPS
87-
# - name: HTTPS_CERTFILE
88-
# value: "cert/signed.pem"
89-
# - name: HTTPS_KEYFILE
90-
# value: "cert/signed_key.pem"
91-
# - name: HTTPS_KEYFILE_PASS
92-
# value: "asdf"
93-
## CORS (Access-Control-Allow-Origin) for "inbound" port
94-
# - name: CORS: "*"
95-
## Discovery & node
96-
- name: DISCOVERY_TYPE
97-
value: "dns"
98-
## Change "default" if you are using different namespace
99-
- name: DNS_NAME
100-
value: "reactive-interaction-gateway-headless.default.svc.cluster.local"
101-
- name: NODE_COOKIE
102-
value: "magiccookie"
103-
- name: NODE_HOST
104-
valueFrom:
105-
fieldRef:
106-
fieldPath: status.podIP
107-
## Kafka
108-
## Setting "KAFKA_BROKERS" automatically enables usage of Kafka in RIG
109-
# - name: KAFKA_BROKERS
110-
# value: "localhost:9092"
111-
# - name: KAFKA_SOURCE_TOPICS
112-
# value: "rig"
113-
# - name: KAFKA_GROUP_ID
114-
# value: "rig"
115-
# - name: KAFKA_RESTART_DELAY_MS
116-
# value: "10000"
117-
# - name: KAFKA_LOG_TOPIC
118-
# value: "rig-request-log"
119-
## Kafka SASL
120-
# - name: KAFKA_SASL
121-
# value: "plain:myusername:mypassword"
122-
## Kafka SSL
123-
# - name: KAFKA_SSL_ENABLED
124-
# value: "1"
125-
# - name: KAFKA_SSL_CA_CERTFILE
126-
# value: "ca.crt.pem"
127-
# - name: KAFKA_SSL_CERTFILE
128-
# value: "client.crt.pem"
129-
# - name: KAFKA_SSL_KEYFILE
130-
# value: "client.key.pem"
131-
# - name: KAFKA_SSL_KEYFILE_PASS
132-
# value: "asdf"
133-
## Kinesis
134-
# - name: KINESIS_ENABLED
135-
# value: "1"
136-
# - name: KINESIS_STREAM
137-
# value: "RIG-outbound"
138-
# - name: KINESIS_APP_NAME
139-
# value: "Reactive-Interaction-Gateway"
140-
# - name: KINESIS_AWS_REGION
141-
# value: "eu-west-1"
142-
# - name: KINESIS_LOG_LEVEL
143-
# value: "INFO"
144-
## Proxy
145-
# - name: PROXY_CONFIG_FILE
146-
# value: "/proxy.json"
147-
# - name: PROXY_RECV_TIMEOUT
148-
# value: "5000"
149-
## Proxy Kafka
150-
# - name: PROXY_KAFKA_RESPONSE_TOPICS
151-
# value: "rig-proxy-response"
152-
# - name: PROXY_KAFKA_REQUEST_TOPIC
153-
# value: "rig-proxy-request"
154-
# - name: PROXY_KAFKA_RESPONSE_TIMEOUT
155-
# value: "5000"
156-
## Proxy Kinesis
157-
# - name: PROXY_KINESIS_REQUEST_STREAM
158-
# value: "rig-proxy-request"
159-
# - name: PROXY_KINESIS_REQUEST_REGION
160-
# value: "eu-west-1"
161-
# - name: PROXY_KINESIS_RESPONSE_TIMEOUT
162-
# value: "5000"
163-
## Extractors
164-
# - name: EXTRACTORS
165-
# value: '{"greeting":{"name":{"stable_field_index":1,"event":{"json_pointer":"/name"}}}}'
166-
## JWT
167-
# - name: JWT_SECRET_KEY
168-
# value: "asdf"
169-
# - name: JWT_ALG
170-
# value: "HS256"
171-
# - name: JWT_SESSION_FIELD
172-
# value: "/userId"
173-
## Logging
174-
# - name: REQUEST_LOG
175-
# value: "console,kafka"
176-
- name: LOG_LEVEL
177-
value: "debug"
178-
## SSE, WS
179-
# - name: SUBSCRIPTION_CHECK
180-
# value: "jwt_validation"
181-
## HTTP events endpoint
182-
# - name: SUBMISSION_CHECK
183-
# value: "jwt_validation"
73+
- name: reactive-interaction-gateway
74+
image: accenture/reactive-interaction-gateway
75+
ports:
76+
- containerPort: 4000
77+
- containerPort: 4001
78+
- containerPort: 4010
79+
- containerPort: 4011
80+
env:
81+
## Ports
82+
- name: API_HTTP_PORT
83+
value: "4010"
84+
- name: API_HTTPS_PORT
85+
value: "4011"
86+
- name: INBOUND_PORT
87+
value: "4000"
88+
- name: INBOUND_HTTPS_PORT
89+
value: "4001"
90+
## Hostname for HTTP endpoints
91+
# - name: HOST
92+
# value: "localhost"
93+
## HTTPS
94+
# - name: HTTPS_CERTFILE
95+
# value: "cert/signed.pem"
96+
# - name: HTTPS_KEYFILE
97+
# value: "cert/signed_key.pem"
98+
# - name: HTTPS_KEYFILE_PASS
99+
# value: "asdf"
100+
## CORS (Access-Control-Allow-Origin) for "inbound" port
101+
# - name: CORS: "*"
102+
## Discovery & node
103+
- name: DISCOVERY_TYPE
104+
value: "dns"
105+
## Change "default" if you are using different namespace
106+
- name: DNS_NAME
107+
value: "reactive-interaction-gateway-headless.default.svc.cluster.local"
108+
- name: NODE_COOKIE
109+
value: "magiccookie"
110+
- name: NODE_HOST
111+
valueFrom:
112+
fieldRef:
113+
fieldPath: status.podIP
114+
## Kafka
115+
## Setting "KAFKA_BROKERS" automatically enables usage of Kafka in RIG
116+
# - name: KAFKA_BROKERS
117+
# value: "localhost:9092"
118+
# - name: KAFKA_SOURCE_TOPICS
119+
# value: "rig"
120+
# - name: KAFKA_GROUP_ID
121+
# value: "rig"
122+
# - name: KAFKA_RESTART_DELAY_MS
123+
# value: "10000"
124+
# - name: KAFKA_LOG_TOPIC
125+
# value: "rig-request-log"
126+
## Kafka SASL
127+
# - name: KAFKA_SASL
128+
# value: "plain:myusername:mypassword"
129+
## Kafka SSL
130+
# - name: KAFKA_SSL_ENABLED
131+
# value: "1"
132+
# - name: KAFKA_SSL_CA_CERTFILE
133+
# value: "ca.crt.pem"
134+
# - name: KAFKA_SSL_CERTFILE
135+
# value: "client.crt.pem"
136+
# - name: KAFKA_SSL_KEYFILE
137+
# value: "client.key.pem"
138+
# - name: KAFKA_SSL_KEYFILE_PASS
139+
# value: "asdf"
140+
## Kinesis
141+
# - name: KINESIS_ENABLED
142+
# value: "1"
143+
# - name: KINESIS_STREAM
144+
# value: "RIG-outbound"
145+
# - name: KINESIS_APP_NAME
146+
# value: "Reactive-Interaction-Gateway"
147+
# - name: KINESIS_AWS_REGION
148+
# value: "eu-west-1"
149+
# - name: KINESIS_LOG_LEVEL
150+
# value: "INFO"
151+
## Proxy
152+
# - name: PROXY_CONFIG_FILE
153+
# value: "/proxy.json"
154+
# - name: PROXY_RECV_TIMEOUT
155+
# value: "5000"
156+
## Proxy Kafka
157+
# - name: PROXY_KAFKA_RESPONSE_TOPICS
158+
# value: "rig-proxy-response"
159+
# - name: PROXY_KAFKA_REQUEST_TOPIC
160+
# value: "rig-proxy-request"
161+
# - name: PROXY_KAFKA_RESPONSE_TIMEOUT
162+
# value: "5000"
163+
## Proxy Kinesis
164+
# - name: PROXY_KINESIS_REQUEST_STREAM
165+
# value: "rig-proxy-request"
166+
# - name: PROXY_KINESIS_REQUEST_REGION
167+
# value: "eu-west-1"
168+
# - name: PROXY_KINESIS_RESPONSE_TIMEOUT
169+
# value: "5000"
170+
## Extractors
171+
# - name: EXTRACTORS
172+
# value: '{"greeting":{"name":{"stable_field_index":1,"event":{"json_pointer":"/name"}}}}'
173+
## JWT
174+
# - name: JWT_SECRET_KEY
175+
# value: "asdf"
176+
# - name: JWT_ALG
177+
# value: "HS256"
178+
# - name: JWT_SESSION_FIELD
179+
# value: "/userId"
180+
## Logging
181+
# - name: REQUEST_LOG
182+
# value: "console,kafka"
183+
- name: LOG_LEVEL
184+
value: "debug"
185+
## SSE, WS
186+
# - name: SUBSCRIPTION_CHECK
187+
# value: "jwt_validation"
188+
## HTTP events endpoint
189+
# - name: SUBMISSION_CHECK
190+
# value: "jwt_validation"

0 commit comments

Comments
 (0)