BUG/MINOR: kubernetes-ingress: Add pod securityContext and set allowPrivilegeEscalation

Set allowPrivilegeEscalation in PSP and container securityContext to
permit adding NET_BIND_SERVICE capability. Add pod securityContext for
an unprivileged controller.

Signed-off-by: Dinko Korunic <[email protected]>

Author: dkorunic

haproxy/templates/podsecuritypolicy.yaml

@@ -41,7 +41,7 @@ metadata:
     apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
 {{- end }}
 spec:
-  allowPrivilegeEscalation: false
+  allowPrivilegeEscalation: true
   allowedCapabilities:
     - NET_BIND_SERVICE
   defaultAllowPrivilegeEscalation: false

haproxy/values.yaml

@@ -366,7 +366,7 @@ securityContext: {}
 #  runAsNonRoot: true
 #  runAsUser: 1000
 #  runAsGroup: 1000
-#  allowPrivilegeEscalation: false
+#  allowPrivilegeEscalation: true
 #  capabilities:
 #    drop:
 #      - ALL

kubernetes-ingress/templates/controller-daemonset.yaml

@@ -78,6 +78,12 @@ spec:
 {{- end }}
 {{- if .Values.controller.runtimeClassName }}
       runtimeClassName: {{ .Values.controller.runtimeClassName }}
+{{- end }}
+{{- if .Values.controller.unprivileged }}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser:  1000
+        runAsGroup: 1000
 {{- end }}
       containers:
         - name: {{ template "kubernetes-ingress.name" . }}-{{ .Values.controller.name }}
@@ -114,7 +120,7 @@ spec:
             runAsNonRoot: true
             runAsUser:  1000
             runAsGroup: 1000
-            allowPrivilegeEscalation: false
+            allowPrivilegeEscalation: true
             capabilities:
               drop:
                 - ALL

kubernetes-ingress/templates/controller-deployment.yaml

@@ -79,6 +79,12 @@ spec:
 {{- end }}
 {{- if .Values.controller.runtimeClassName }}
       runtimeClassName: {{ .Values.controller.runtimeClassName }}
+{{- end }}
+{{- if .Values.controller.unprivileged }}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser:  1000
+        runAsGroup: 1000
 {{- end }}
       containers:
         - name: {{ template "kubernetes-ingress.name" . }}-{{ .Values.controller.name }}
@@ -115,7 +121,7 @@ spec:
             runAsNonRoot: true
             runAsUser:  1000
             runAsGroup: 1000
-            allowPrivilegeEscalation: false
+            allowPrivilegeEscalation: true
             capabilities:
               drop:
                 - ALL

kubernetes-ingress/templates/controller-podsecuritypolicy.yaml

@@ -43,7 +43,7 @@ metadata:
     seccomp.security.alpha.kubernetes.io/defaultProfileName:  'runtime/default'
     apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
 spec:
-  allowPrivilegeEscalation: false
+  allowPrivilegeEscalation: true
   allowedCapabilities:
     - NET_BIND_SERVICE
   defaultAllowPrivilegeEscalation: false