Enabling Pod Security Admission (PSA) in Artemis Cloud IO broker

[Mohanavalli-A]

Hi Team,

Good day.

We are having the following queries on Artemis Broker (2.31.2) with Operator version 1.0.16.

1. We are trying to enble the Pod Security Admission (PSA) on Artemis Broker with below label on the namespace

pod-security.kubernetes.io/enforce: restricted

But we are getting below error

Pod eesb-broker-ss-1 in StatefulSet eesb-broker-ss failed error: pods "eesb-broker-ss-1" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "eesb-broker-container-init", "eesb-broker-container" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "eesb-broker-container-init", "eesb-broker-container" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "eesb-broker-container-init", "eesb-broker-container" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "..." must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

However we are not able to find the place holder for below parameters n the broker_activemqartemis_crd.yaml CRD file:
securityContext.allowPrivilegeEscalation
securityContext.capabilities.drop

2. If we set the parameter podSecurityContext.runAsNonRoot to true and deploy getting below error for init container:

Error: container has runAsNonRoot and image has non-numeric user (root), cannot verify user is non-root

Could you please check and let know how to unblock from these issues.

Thanks and Regards,
Mohanavalli A

[brusdev]

Hi @Mohanavalli-A to customize the container security context you can use a patch. The support for patches is already implemented and it will included in 1.0.17, for further details see https://github.com/artemiscloud/activemq-artemis-operator/issues/758

[Mohanavalli-A]

Can you please clarify if the below parameters are available in operator version 1.0.17' CRD ?

securityContext.allowPrivilegeEscalation
securityContext.capabilities

And for the previous versions, patch can be used as a workaround, could you please clarify ? Also can you please provide an example for how to make use of patch.

Also can you please comment on 2nd issue : When the parameter podSecurityContext.runAsNonRoot to true and deploy getting error for init container.

[brusdev]

ArtemisCloud operator 1.0.17 will support patches to customize managed resources, i.e. to customize securityContext.allowPrivilegeEscalation and securityContext.capabilities for the broker pod containers:

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata: 
  name: artemis-broker
spec:
  resourceTemplates:
    - selector:
        kind: StatefulSet
      patch:
        kind: StatefulSet
        spec:
          template:
            spec:
              containers:
                - name: artemis-broker-container
                  securityContext:
                    allowPrivilegeEscalation: false
                    capabilities:
                      drop:
                        - ALL
              initContainers:
                - name: artemis-broker-container-init
                  securityContext:
                    allowPrivilegeEscalation: false
                    capabilities:
                      drop:
                        - ALL

I created #799 to restrict security context of pods by default.

The non-numeric user (root) error for the init container is fixed by https://github.com/artemiscloud/activemq-artemis-broker-init-image/issues/52