Skip to content

Commit 05130f0

Browse files
authored
feat: Specify the security context on the proxy container. (#698)
This adds a new field to the AuthProxyWorkload spec: authProxyContainer.securityContext. This field will override the default security in the auth proxy container. Fixes #694 See also #641
1 parent 20cfb7e commit 05130f0

File tree

4 files changed

+56
-1
lines changed

4 files changed

+56
-1
lines changed

docs/api.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ _Appears in:_
5050
| --- | --- | --- | --- |
5151
| `container` _[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core)_ | Container is debugging parameter that when specified will override the<br />proxy container with a completely custom Container spec. | | Optional: \{\} <br /> |
5252
| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#resourcerequirements-v1-core)_ | Resources specifies the resources required for the proxy pod. | | Optional: \{\} <br /> |
53+
| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#securitycontext-v1-core)_ | SecurityContext specifies the security context for the proxy container. | | Optional: \{\} <br /> |
5354
| `telemetry` _[TelemetrySpec](#telemetryspec)_ | Telemetry specifies how the proxy should expose telemetry.<br />Optional, by default | | Optional: \{\} <br /> |
5455
| `adminServer` _[AdminServerSpec](#adminserverspec)_ | AdminServer specifies the config for the proxy's admin service which is<br />available to other containers in the same pod. | | |
5556
| `authentication` _[AuthenticationSpec](#authenticationspec)_ | Authentication specifies the config for how the proxy authenticates itself<br />to the Google Cloud API. | | |

internal/api/v1/authproxyworkload_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,10 @@ type AuthProxyContainerSpec struct {
154154
//+kubebuilder:validation:Optional
155155
Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
156156

157+
// SecurityContext specifies the security context for the proxy container.
158+
//+kubebuilder:validation:Optional
159+
SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`
160+
157161
// Telemetry specifies how the proxy should expose telemetry.
158162
// Optional, by default
159163
//+kubebuilder:validation:Optional

internal/workload/podspec_updates.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -737,7 +737,9 @@ func (s *updateState) applyContainerSpec(p *cloudsqlapi.AuthProxyWorkload, c *co
737737
// Do not allow privilege escalation
738738
AllowPrivilegeEscalation: &f,
739739
}
740-
740+
if p.Spec.AuthProxyContainer != nil && p.Spec.AuthProxyContainer.SecurityContext != nil {
741+
c.SecurityContext = p.Spec.AuthProxyContainer.SecurityContext.DeepCopy()
742+
}
741743
if p.Spec.AuthProxyContainer == nil {
742744
return
743745
}

internal/workload/podspec_updates_test.go

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -513,6 +513,54 @@ func TestResourcesFromSpec(t *testing.T) {
513513

514514
}
515515

516+
func TestSecurityContextFromSpec(t *testing.T) {
517+
var (
518+
wantsInstanceName = "project:server:db"
519+
wantSecurityContext = &corev1.SecurityContext{
520+
Privileged: ptr(true),
521+
RunAsUser: ptr(int64(1000)),
522+
RunAsGroup: ptr(int64(1000)),
523+
Capabilities: &corev1.Capabilities{
524+
Add: []corev1.Capability{"NET_ADMIN"},
525+
},
526+
}
527+
528+
u = workload.NewUpdater("cloud-sql-proxy-operator/dev", workload.DefaultProxyImage, false)
529+
)
530+
531+
// Create a pod
532+
wl := podWorkload()
533+
wl.Pod.Spec.Containers[0].Ports =
534+
[]corev1.ContainerPort{{Name: "http", ContainerPort: 8080}}
535+
536+
// Create a AuthProxyWorkload that matches the deployment
537+
csqls := []*cloudsqlapi.AuthProxyWorkload{simpleAuthProxy("instance1", wantsInstanceName)}
538+
csqls[0].Spec.AuthProxyContainer = &cloudsqlapi.AuthProxyContainerSpec{SecurityContext: wantSecurityContext}
539+
540+
// update the containers
541+
err := configureProxies(u, wl, csqls)
542+
if err != nil {
543+
t.Fatal(err)
544+
}
545+
546+
// ensure that the new container exists
547+
if len(wl.Pod.Spec.Containers) != 2 {
548+
t.Fatalf("got %v, wants 1. deployment containers length", len(wl.Pod.Spec.Containers))
549+
}
550+
551+
// test that the instancename matches the new expected instance name.
552+
csqlContainer, err := findContainer(wl, fmt.Sprintf("csql-default-%s", csqls[0].GetName()))
553+
if err != nil {
554+
t.Fatal(err)
555+
}
556+
557+
// test that resources was set
558+
if !reflect.DeepEqual(csqlContainer.SecurityContext, wantSecurityContext) {
559+
t.Errorf("got %v, want %v for proxy container command", csqlContainer.SecurityContext, wantSecurityContext)
560+
}
561+
562+
}
563+
516564
func TestProxyCLIArgs(t *testing.T) {
517565
wantTrue := true
518566
wantFalse := false

0 commit comments

Comments
 (0)