Explicitly disallow allowPrivilegeEscalation on containers

Jonathan S. Katz · Jonathan S. Katz · commit 55c2d9b98cca · 2021-03-05T15:25:15.000-05:00
There is no need for the containers to escalate privileges, ergo
we can disallow them from attempting to do so.

Issue: [ch10570]
diff --git a/deploy/deployment.json b/deploy/deployment.json
@@ -32,6 +32,9 @@
                         "name": "apiserver",
                         "image": "$PGO_IMAGE_PREFIX/pgo-apiserver:$PGO_IMAGE_TAG",
                         "imagePullPolicy": "IfNotPresent",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "ports": [
                             { "containerPort": $PGO_APISERVER_PORT }
                         ],
@@ -112,6 +115,9 @@
                         "name": "operator",
                         "image": "$PGO_IMAGE_PREFIX/postgres-operator:$PGO_IMAGE_TAG",
                         "imagePullPolicy": "IfNotPresent",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "readinessProbe": {
                             "exec": {
                                 "command": [
@@ -164,6 +170,9 @@
                     }, {
                         "name": "scheduler",
                         "image": "$PGO_IMAGE_PREFIX/pgo-scheduler:$PGO_IMAGE_TAG",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "livenessProbe": {
                             "exec": {
                                 "command": [
@@ -212,6 +221,9 @@
                     {
                         "name": "event",
                         "image": "$PGO_IMAGE_PREFIX/pgo-event:$PGO_IMAGE_TAG",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "livenessProbe": {
                             "httpGet": {
                                 "path": "/ping",
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/backrest-job.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/backrest-job.json
@@ -35,6 +35,9 @@
                 "containers": [{
                     "name": "backrest",
                     "image": "{{.CCPImagePrefix}}/crunchy-pgbackrest:{{.CCPImageTag}}",
+                    "securityContext": {
+                      "allowPrivilegeEscalation": false
+                    },
                     "volumeMounts": [
                         {{.PgbackrestRestoreVolumeMounts}}
                     ],
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/cluster-bootstrap-job.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/cluster-bootstrap-job.json
@@ -29,6 +29,9 @@
                 "containers": [{
                     "name": "database",
                     "image": "{{.CCPImagePrefix}}/{{.CCPImage}}:{{.CCPImageTag}}",
+                    "securityContext": {
+                      "allowPrivilegeEscalation": false
+                    },
                     {{.ContainerResources}}
                     "env": [{
                         "name": "PGHA_PG_PORT",
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/cluster-deployment.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/cluster-deployment.json
@@ -42,6 +42,9 @@
             {
                     "name": "database",
                     "image": "{{.CCPImagePrefix}}/{{.CCPImage}}:{{.CCPImageTag}}",
+                    "securityContext": {
+                      "allowPrivilegeEscalation": false
+                    },
                     "readinessProbe": {
                         "exec": {
                             "command": [
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/exporter.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/exporter.json
@@ -1,6 +1,9 @@
 {
     "name": "exporter",
     "image": "{{.PGOImagePrefix}}/crunchy-postgres-exporter:{{.PGOImageTag}}",
+    "securityContext": {
+      "allowPrivilegeEscalation": false
+    },
     "ports": [{
         "containerPort": {{.ExporterPort}},
         "protocol": "TCP"
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/pgadmin-template.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/pgadmin-template.json
@@ -43,6 +43,9 @@
         "containers": [{
           "name": "pgadminweb",
           "image": "{{.CCPImagePrefix}}/crunchy-pgadmin4:{{.CCPImageTag}}",
+          "securityContext": {
+            "allowPrivilegeEscalation": false
+          },
           "ports": [{
             "containerPort": {{.Port}},
             "protocol": "TCP"
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/pgbadger.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/pgbadger.json
@@ -1,6 +1,9 @@
 {
     "name": "pgbadger",
     "image": "{{.CCPImagePrefix}}/crunchy-pgbadger:{{.CCPImageTag}}",
+    "securityContext": {
+        "allowPrivilegeEscalation": false
+    },
     "ports": [ {
             "containerPort": {{.PGBadgerPort}},
             "protocol": "TCP"
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/pgbouncer-template.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/pgbouncer-template.json
@@ -48,6 +48,9 @@
                 "containers": [{
                     "name": "pgbouncer",
                     "image": "{{.CCPImagePrefix}}/crunchy-pgbouncer:{{.CCPImageTag}}",
+                    "securityContext": {
+                      "allowPrivilegeEscalation": false
+                    },
                     "ports": [{
                         "containerPort": {{.Port}},
                         "protocol": "TCP"
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/pgdump-job.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/pgdump-job.json
@@ -37,6 +37,9 @@
                 "containers": [{
                         "name": "pgdump",
                         "image": "{{.CCPImagePrefix}}/crunchy-postgres-ha:{{.CCPImageTag}}",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "command": ["/opt/crunchy/bin/uid_postgres.sh"],
                         "args": ["/opt/crunchy/bin/start.sh"],
                         "volumeMounts": [
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/pgo-backrest-repo-template.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/pgo-backrest-repo-template.json
@@ -52,6 +52,9 @@
                 "containers": [{
                     "name": "database",
                     "image": "{{.CCPImagePrefix}}/crunchy-pgbackrest-repo:{{.CCPImageTag}}",
+                    "securityContext": {
+                      "allowPrivilegeEscalation": false
+                    },
                     "ports": [{
                         "containerPort": {{.SshdPort}},
                         "protocol": "TCP"
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/pgo.sqlrunner-template.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/pgo.sqlrunner-template.json
@@ -31,6 +31,9 @@
                     {
                         "name": "sqlrunner",
                         "image": "{{.CCPImagePrefix}}/crunchy-postgres-ha:{{.CCPImageTag}}",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "command": ["/opt/crunchy/bin/uid_postgres.sh"],
                         "args": ["/opt/crunchy/bin/start.sh"],
                         "env": [
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/pgrestore-job.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/pgrestore-job.json
@@ -38,6 +38,9 @@
                     {
                         "name": "pgrestore",
                         "image": "{{.CCPImagePrefix}}/crunchy-postgres-ha:{{.CCPImageTag}}",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "command": ["/opt/crunchy/bin/uid_postgres.sh"],
                         "args": ["/opt/crunchy/bin/start.sh"],
                         "volumeMounts": [
diff --git a/installers/ansible/roles/pgo-operator/files/pgo-configs/rmdata-job.json b/installers/ansible/roles/pgo-operator/files/pgo-configs/rmdata-job.json
@@ -30,6 +30,9 @@
                 "containers": [{
                     "name": "rmdata",
                     "image": "{{.PGOImagePrefix}}/pgo-rmdata:{{.PGOImageTag}}",
+                    "securityContext": {
+                      "allowPrivilegeEscalation": false
+                    },
                     "env": [{
                         "name": "PG_CLUSTER",
                         "value": "{{.ClusterName}}"
diff --git a/installers/ansible/roles/pgo-operator/templates/deployment.json.j2 b/installers/ansible/roles/pgo-operator/templates/deployment.json.j2
@@ -34,6 +34,9 @@
                                 {%- else %}{{ pgo_image_prefix }}/pgo-apiserver:{{ pgo_image_tag }}
                                 {%- endif %}",
                         "imagePullPolicy": "IfNotPresent",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "ports": [
                             { "containerPort": {{ pgo_apiserver_port }} }
                         ],
@@ -116,6 +119,9 @@
                                 {%- else %}{{ pgo_image_prefix }}/postgres-operator:{{ pgo_image_tag }}
                                 {%- endif %}",
                         "imagePullPolicy": "IfNotPresent",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "readinessProbe": {
                             "exec": {
                                 "command": [
@@ -170,6 +176,9 @@
                         "image": "{% if pgo_scheduler_image | default('') != '' %}{{ pgo_scheduler_image }}
                                 {%- else %}{{ pgo_image_prefix }}/pgo-scheduler:{{ pgo_image_tag }}
                                 {%- endif %}",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "livenessProbe": {
                             "exec": {
                                 "command": [
@@ -219,6 +228,9 @@
                         "image": "{% if pgo_event_image | default('') != '' %}{{ pgo_event_image }}
                                 {%- else %}{{ pgo_image_prefix }}/pgo-event:{{ pgo_image_tag }}
                                 {%- endif %}",
+                        "securityContext": {
+                          "allowPrivilegeEscalation": false
+                        },
                         "livenessProbe": {
                             "httpGet": {
                                 "path": "/ping",
diff --git a/installers/olm/postgresoperator.csv.yaml b/installers/olm/postgresoperator.csv.yaml
@@ -206,6 +206,8 @@ spec:
                   - name: apiserver
                     image: '${PGO_IMAGE_PREFIX}/pgo-apiserver:${PGO_IMAGE_TAG}'
                     imagePullPolicy: IfNotPresent
+                    securityContext:
+                      allowPrivilegeEscalation: false
                     ports:
                       - containerPort: 8443
                     readinessProbe:
@@ -234,6 +236,8 @@ spec:
                   - name: operator
                     image: '${PGO_IMAGE_PREFIX}/postgres-operator:${PGO_IMAGE_TAG}'
                     imagePullPolicy: IfNotPresent
+                    securityContext:
+                      allowPrivilegeEscalation: false
                     env:
                       - { name: NAMESPACE, valueFrom: { fieldRef: { fieldPath: "metadata.annotations['olm.targetNamespaces']" } } }
                       - { name: PGO_INSTALLATION_NAME, valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } }
@@ -245,6 +249,8 @@ spec:
                   - name: scheduler
                     image: '${PGO_IMAGE_PREFIX}/pgo-scheduler:${PGO_IMAGE_TAG}'
                     imagePullPolicy: IfNotPresent
+                    securityContext:
+                      allowPrivilegeEscalation: false
                     livenessProbe:
                       exec:
                         command: [
@@ -267,6 +273,8 @@ spec:
                   - name: event
                     image: '${PGO_IMAGE_PREFIX}/pgo-event:${PGO_IMAGE_TAG}'
                     imagePullPolicy: IfNotPresent
+                    securityContext:
+                      allowPrivilegeEscalation: false
                     livenessProbe:
                       httpGet:
                         path: /ping
