Skip to content

Commit 07dabc4

Browse files
sabre1041sabre1041
authored
Methods for managing securityContext and OpenShift support (external-secrets#3420)
Signed-off-by: Andrew Block <andy.block@gmail.com>
1 parent e32bc39 commit 07dabc4

File tree

6 files changed

+76
-13
lines changed

6 files changed

+76
-13
lines changed

‎deploy/charts/external-secrets/README.md‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ The command removes all the Kubernetes components associated with the chart and
5858
| certController.podAnnotations | object | `{}` | Annotations to add to Pod |
5959
| certController.podDisruptionBudget | object | `{"enabled":false,"minAvailable":1}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
6060
| certController.podLabels | object | `{}` | |
61-
| certController.podSecurityContext | object | `{}` | |
61+
| certController.podSecurityContext.enabled | bool | `true` | |
6262
| certController.priorityClassName | string | `""` | Pod priority class name. |
6363
| certController.rbac.create | bool | `true` | Specifies whether role and rolebinding resources should be created. |
6464
| certController.readinessProbe.address | string | `""` | Address for readiness probe |
@@ -69,6 +69,7 @@ The command removes all the Kubernetes components associated with the chart and
6969
| certController.revisionHistoryLimit | int | `10` | Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) |
7070
| certController.securityContext.allowPrivilegeEscalation | bool | `false` | |
7171
| certController.securityContext.capabilities.drop[0] | string | `"ALL"` | |
72+
| certController.securityContext.enabled | bool | `true` | |
7273
| certController.securityContext.readOnlyRootFilesystem | bool | `true` | |
7374
| certController.securityContext.runAsNonRoot | bool | `true` | |
7475
| certController.securityContext.runAsUser | int | `1000` | |
@@ -95,11 +96,12 @@ The command removes all the Kubernetes components associated with the chart and
9596
| extraArgs | object | `{}` | |
9697
| extraContainers | list | `[]` | |
9798
| extraEnv | list | `[]` | |
98-
| extraObjects | list | `[]` | Extra Kubernetes manifests to deploy with the chart |
99+
| extraObjects | list | `[]` | |
99100
| extraVolumeMounts | list | `[]` | |
100101
| extraVolumes | list | `[]` | |
101102
| fullnameOverride | string | `""` | |
102103
| global.affinity | object | `{}` | |
104+
| global.compatibility.openshift.adaptSecurityContext | string | `"auto"` | Manages the securityContext properties to make them compatible with OpenShift. Possible values: auto - Apply configurations if it is detected that OpenShift is the target platform. force - Always apply configurations. disabled - No modification applied. |
103105
| global.nodeSelector | object | `{}` | |
104106
| global.tolerations | list | `[]` | |
105107
| global.topologySpreadConstraints | list | `[]` | |
@@ -121,7 +123,7 @@ The command removes all the Kubernetes components associated with the chart and
121123
| podAnnotations | object | `{}` | Annotations to add to Pod |
122124
| podDisruptionBudget | object | `{"enabled":false,"minAvailable":1}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
123125
| podLabels | object | `{}` | |
124-
| podSecurityContext | object | `{}` | |
126+
| podSecurityContext.enabled | bool | `true` | |
125127
| podSpecExtra | object | `{}` | Any extra pod spec on the deployment |
126128
| priorityClassName | string | `""` | Pod priority class name. |
127129
| processClusterExternalSecret | bool | `true` | if true, the operator will process cluster external secret. Else, it will ignore them. |
@@ -136,6 +138,7 @@ The command removes all the Kubernetes components associated with the chart and
136138
| scopedRBAC | bool | `false` | Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace and implicitly disable cluster stores and cluster external secrets |
137139
| securityContext.allowPrivilegeEscalation | bool | `false` | |
138140
| securityContext.capabilities.drop[0] | string | `"ALL"` | |
141+
| securityContext.enabled | bool | `true` | |
139142
| securityContext.readOnlyRootFilesystem | bool | `true` | |
140143
| securityContext.runAsNonRoot | bool | `true` | |
141144
| securityContext.runAsUser | int | `1000` | |
@@ -191,7 +194,7 @@ The command removes all the Kubernetes components associated with the chart and
191194
| webhook.podAnnotations | object | `{}` | Annotations to add to Pod |
192195
| webhook.podDisruptionBudget | object | `{"enabled":false,"minAvailable":1}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
193196
| webhook.podLabels | object | `{}` | |
194-
| webhook.podSecurityContext | object | `{}` | |
197+
| webhook.podSecurityContext.enabled | bool | `true` | |
195198
| webhook.port | int | `10250` | The port the webhook will listen to |
196199
| webhook.priorityClassName | string | `""` | Pod priority class name. |
197200
| webhook.rbac.create | bool | `true` | Specifies whether role and rolebinding resources should be created. |
@@ -203,6 +206,7 @@ The command removes all the Kubernetes components associated with the chart and
203206
| webhook.secretAnnotations | object | `{}` | Annotations to add to Secret |
204207
| webhook.securityContext.allowPrivilegeEscalation | bool | `false` | |
205208
| webhook.securityContext.capabilities.drop[0] | string | `"ALL"` | |
209+
| webhook.securityContext.enabled | bool | `true` | |
206210
| webhook.securityContext.readOnlyRootFilesystem | bool | `true` | |
207211
| webhook.securityContext.runAsNonRoot | bool | `true` | |
208212
| webhook.securityContext.runAsUser | int | `1000` | |

‎deploy/charts/external-secrets/templates/_helpers.tpl‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Determine the image to use, including if using a flavour.
155155
{{- end }}
156156
{{- end }}
157157

158+
<<<<<<< HEAD
158159

159160
{{/*
160161
Renders a complete tree, even values that contains template.
@@ -166,3 +167,35 @@ Renders a complete tree, even values that contains template.
166167
{{- tpl (.value | toYaml) .context }}
167168
{{- end }}
168169
{{- end -}}
170+
=======
171+
{{/*
172+
Return true if the OpenShift is the detected platform
173+
Usage:
174+
{{- include "external-secrets.isOpenShift" . -}}
175+
*/}}
176+
{{- define "external-secrets.isOpenShift" -}}
177+
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
178+
{{- true -}}
179+
{{- end -}}
180+
{{- end -}}
181+
182+
{{/*
183+
Render the securityContext based on the provided securityContext
184+
{{- include "external-secrets.renderSecurityContext" (dict "securityContext" .Values.securityContext "context" $) -}}
185+
*/}}
186+
{{- define "external-secrets.renderSecurityContext" -}}
187+
{{- $adaptedContext := .securityContext -}}
188+
{{- if .context.Values.global.compatibility -}}
189+
{{- if .context.Values.global.compatibility.openshift -}}
190+
{{- if or (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "external-secrets.isOpenShift" .context)) -}}
191+
{{/* Remove OpenShift managed fields */}}
192+
{{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}}
193+
{{- if not .securityContext.seLinuxOptions -}}
194+
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
195+
{{- end -}}
196+
{{- end -}}
197+
{{- end -}}
198+
{{- end -}}
199+
{{- omit $adaptedContext "enabled" | toYaml -}}
200+
{{- end -}}
201+
>>>>>>> 2218c78b (Methods for managing securityContext and OpenShift support)

‎deploy/charts/external-secrets/templates/cert-controller-deployment.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,19 @@ spec:
3535
serviceAccountName: {{ include "external-secrets-cert-controller.serviceAccountName" . }}
3636
automountServiceAccountToken: {{ .Values.certController.serviceAccount.automount }}
3737
{{- with .Values.certController.podSecurityContext }}
38+
{{- if and (.enabled) (gt (keys . | len) 1) }}
3839
securityContext:
39-
{{- toYaml . | nindent 8 }}
40+
{{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 8 }}
41+
{{- end }}
4042
{{- end }}
4143
hostNetwork: {{ .Values.certController.hostNetwork }}
4244
containers:
4345
- name: cert-controller
4446
{{- with .Values.certController.securityContext }}
47+
{{- if and (.enabled) (gt (keys . | len) 1) }}
4548
securityContext:
46-
{{- toYaml . | nindent 12 }}
49+
{{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 12 }}
50+
{{- end }}
4751
{{- end }}
4852
image: {{ include "external-secrets.image" (dict "chartAppVersion" .Chart.AppVersion "image" .Values.certController.image) | trim }}
4953
imagePullPolicy: {{ .Values.certController.image.pullPolicy }}

‎deploy/charts/external-secrets/templates/deployment.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,19 @@ spec:
3535
serviceAccountName: {{ include "external-secrets.serviceAccountName" . }}
3636
automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
3737
{{- with .Values.podSecurityContext }}
38+
{{- if and (.enabled) (gt (keys . | len) 1) }}
3839
securityContext:
39-
{{- toYaml . | nindent 8 }}
40+
{{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 8 }}
41+
{{- end }}
4042
{{- end }}
4143
hostNetwork: {{ .Values.hostNetwork }}
4244
containers:
4345
- name: {{ .Chart.Name }}
4446
{{- with .Values.securityContext }}
47+
{{- if and (.enabled) (gt (keys . | len) 1) }}
4548
securityContext:
46-
{{- toYaml . | nindent 12 }}
49+
{{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 12 }}
50+
{{- end }}
4751
{{- end }}
4852
image: {{ include "external-secrets.image" (dict "chartAppVersion" .Chart.AppVersion "image" .Values.image) | trim }}
4953
imagePullPolicy: {{ .Values.image.pullPolicy }}

‎deploy/charts/external-secrets/templates/webhook-deployment.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,18 @@ spec:
3636
serviceAccountName: {{ include "external-secrets-webhook.serviceAccountName" . }}
3737
automountServiceAccountToken: {{ .Values.webhook.serviceAccount.automount }}
3838
{{- with .Values.webhook.podSecurityContext }}
39+
{{- if and (.enabled) (gt (keys . | len) 1) }}
3940
securityContext:
40-
{{- toYaml . | nindent 8 }}
41+
{{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 8 }}
42+
{{- end }}
4143
{{- end }}
4244
containers:
4345
- name: webhook
4446
{{- with .Values.webhook.securityContext }}
47+
{{- if and (.enabled) (gt (keys . | len) 1) }}
4548
securityContext:
46-
{{- toYaml . | nindent 12 }}
49+
{{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 12 }}
50+
{{- end }}
4751
{{- end }}
4852
image: {{ include "external-secrets.image" (dict "chartAppVersion" .Chart.AppVersion "image" .Values.webhook.image) | trim }}
4953
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}

‎deploy/charts/external-secrets/values.yaml‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ global:
33
tolerations: []
44
topologySpreadConstraints: []
55
affinity: {}
6+
compatibility:
7+
openshift:
8+
# -- Manages the securityContext properties to make them compatible with OpenShift.
9+
# Possible values:
10+
# auto - Apply configurations if it is detected that OpenShift is the target platform.
11+
# force - Always apply configurations.
12+
# disabled - No modification applied.
13+
adaptSecurityContext: auto
614

715
replicaCount: 1
816

@@ -131,14 +139,16 @@ podAnnotations: {}
131139

132140
podLabels: {}
133141

134-
podSecurityContext: {}
142+
podSecurityContext:
143+
enabled: true
135144
# fsGroup: 2000
136145

137146
securityContext:
138147
allowPrivilegeEscalation: false
139148
capabilities:
140149
drop:
141150
- ALL
151+
enabled: true
142152
readOnlyRootFilesystem: true
143153
runAsNonRoot: true
144154
runAsUser: 1000
@@ -364,14 +374,16 @@ webhook:
364374

365375
podLabels: {}
366376

367-
podSecurityContext: {}
377+
podSecurityContext:
378+
enabled: true
368379
# fsGroup: 2000
369380

370381
securityContext:
371382
allowPrivilegeEscalation: false
372383
capabilities:
373384
drop:
374385
- ALL
386+
enabled: true
375387
readOnlyRootFilesystem: true
376388
runAsNonRoot: true
377389
runAsUser: 1000
@@ -477,14 +489,16 @@ certController:
477489

478490
podLabels: {}
479491

480-
podSecurityContext: {}
492+
podSecurityContext:
493+
enabled: true
481494
# fsGroup: 2000
482495

483496
securityContext:
484497
allowPrivilegeEscalation: false
485498
capabilities:
486499
drop:
487500
- ALL
501+
enabled: true
488502
readOnlyRootFilesystem: true
489503
runAsNonRoot: true
490504
runAsUser: 1000

0 commit comments

Comments
 (0)