Skip to content

Commit 9ac1f05

Browse files
tuminoidtuminoid
committed
add explicit securitycontexts to controllers
Add explicit, secure securityContexts for all managers except CAPD, which is privileged and for testing purposes. These securityContexts do not change the configuration, just make it explicit and enforced, except for the seccompPolicy which changes from Unconfined to RuntimeDefault. Syscalls filtered by RuntimeDefault policy are 95% namespaced and require capabilities (which we drop) in the first place, so no practical change there either.
1 parent 281297c commit 9ac1f05

File tree

5 files changed

+143
-93
lines changed

5 files changed

+143
-93
lines changed

‎bootstrap/kubeadm/config/manager/manager.yaml

Lines changed: 33 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -16,31 +16,43 @@ spec:
1616
control-plane: controller-manager
1717
spec:
1818
containers:
19-
- command:
20-
- /manager
21-
args:
22-
- "--leader-elect"
23-
- "--metrics-bind-addr=localhost:8080"
24-
- "--feature-gates=MachinePool=${EXP_MACHINE_POOL:=false},KubeadmBootstrapFormatIgnition=${EXP_KUBEADM_BOOTSTRAP_FORMAT_IGNITION:=false}"
25-
- "--bootstrap-token-ttl=${KUBEADM_BOOTSTRAP_TOKEN_TTL:=15m}"
26-
image: controller:latest
27-
name: manager
28-
ports:
29-
- containerPort: 9440
30-
name: healthz
31-
protocol: TCP
32-
readinessProbe:
33-
httpGet:
34-
path: /readyz
35-
port: healthz
36-
livenessProbe:
37-
httpGet:
38-
path: /healthz
39-
port: healthz
19+
- command:
20+
- /manager
21+
args:
22+
- "--leader-elect"
23+
- "--metrics-bind-addr=localhost:8080"
24+
- "--feature-gates=MachinePool=${EXP_MACHINE_POOL:=false},KubeadmBootstrapFormatIgnition=${EXP_KUBEADM_BOOTSTRAP_FORMAT_IGNITION:=false}"
25+
- "--bootstrap-token-ttl=${KUBEADM_BOOTSTRAP_TOKEN_TTL:=15m}"
26+
image: controller:latest
27+
name: manager
28+
ports:
29+
- containerPort: 9440
30+
name: healthz
31+
protocol: TCP
32+
readinessProbe:
33+
httpGet:
34+
path: /readyz
35+
port: healthz
36+
livenessProbe:
37+
httpGet:
38+
path: /healthz
39+
port: healthz
40+
securityContext:
41+
allowPrivilegeEscalation: false
42+
capabilities:
43+
drop:
44+
- ALL
45+
privileged: false
46+
runAsUser: 65532
47+
runAsGroup: 65532
4048
terminationGracePeriodSeconds: 10
4149
serviceAccountName: manager
4250
tolerations:
4351
- effect: NoSchedule
4452
key: node-role.kubernetes.io/master
4553
- effect: NoSchedule
4654
key: node-role.kubernetes.io/control-plane
55+
securityContext:
56+
runAsNonRoot: true
57+
seccompProfile:
58+
type: RuntimeDefault

‎config/manager/manager.yaml

Lines changed: 45 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -17,43 +17,55 @@ spec:
1717
control-plane: controller-manager
1818
spec:
1919
containers:
20-
- command:
21-
- /manager
22-
args:
23-
- "--leader-elect"
24-
- "--metrics-bind-addr=localhost:8080"
25-
- "--feature-gates=MachinePool=${EXP_MACHINE_POOL:=false},ClusterResourceSet=${EXP_CLUSTER_RESOURCE_SET:=false},ClusterTopology=${CLUSTER_TOPOLOGY:=false},RuntimeSDK=${EXP_RUNTIME_SDK:=false}"
26-
image: controller:latest
27-
name: manager
28-
env:
29-
- name: POD_NAMESPACE
30-
valueFrom:
31-
fieldRef:
32-
fieldPath: metadata.namespace
33-
- name: POD_NAME
34-
valueFrom:
35-
fieldRef:
36-
fieldPath: metadata.name
37-
- name: POD_UID
38-
valueFrom:
39-
fieldRef:
40-
fieldPath: metadata.uid
41-
ports:
42-
- containerPort: 9440
43-
name: healthz
44-
protocol: TCP
45-
readinessProbe:
46-
httpGet:
47-
path: /readyz
48-
port: healthz
49-
livenessProbe:
50-
httpGet:
51-
path: /healthz
52-
port: healthz
20+
- command:
21+
- /manager
22+
args:
23+
- "--leader-elect"
24+
- "--metrics-bind-addr=localhost:8080"
25+
- "--feature-gates=MachinePool=${EXP_MACHINE_POOL:=false},ClusterResourceSet=${EXP_CLUSTER_RESOURCE_SET:=false},ClusterTopology=${CLUSTER_TOPOLOGY:=false},RuntimeSDK=${EXP_RUNTIME_SDK:=false}"
26+
image: controller:latest
27+
name: manager
28+
env:
29+
- name: POD_NAMESPACE
30+
valueFrom:
31+
fieldRef:
32+
fieldPath: metadata.namespace
33+
- name: POD_NAME
34+
valueFrom:
35+
fieldRef:
36+
fieldPath: metadata.name
37+
- name: POD_UID
38+
valueFrom:
39+
fieldRef:
40+
fieldPath: metadata.uid
41+
ports:
42+
- containerPort: 9440
43+
name: healthz
44+
protocol: TCP
45+
readinessProbe:
46+
httpGet:
47+
path: /readyz
48+
port: healthz
49+
livenessProbe:
50+
httpGet:
51+
path: /healthz
52+
port: healthz
53+
securityContext:
54+
allowPrivilegeEscalation: false
55+
capabilities:
56+
drop:
57+
- ALL
58+
privileged: false
59+
runAsUser: 65532
60+
runAsGroup: 65532
5361
terminationGracePeriodSeconds: 10
5462
serviceAccountName: manager
5563
tolerations:
5664
- effect: NoSchedule
5765
key: node-role.kubernetes.io/master
5866
- effect: NoSchedule
5967
key: node-role.kubernetes.io/control-plane
68+
securityContext:
69+
runAsNonRoot: true
70+
seccompProfile:
71+
type: RuntimeDefault

‎controlplane/kubeadm/config/manager/manager.yaml

Lines changed: 45 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -16,43 +16,55 @@ spec:
1616
control-plane: controller-manager
1717
spec:
1818
containers:
19-
- command:
20-
- /manager
21-
args:
22-
- "--leader-elect"
23-
- "--metrics-bind-addr=localhost:8080"
24-
- "--feature-gates=ClusterTopology=${CLUSTER_TOPOLOGY:=false},KubeadmBootstrapFormatIgnition=${EXP_KUBEADM_BOOTSTRAP_FORMAT_IGNITION:=false}"
25-
image: controller:latest
26-
name: manager
27-
env:
28-
- name: POD_NAMESPACE
29-
valueFrom:
30-
fieldRef:
31-
fieldPath: metadata.namespace
32-
- name: POD_NAME
33-
valueFrom:
34-
fieldRef:
35-
fieldPath: metadata.name
36-
- name: POD_UID
37-
valueFrom:
38-
fieldRef:
39-
fieldPath: metadata.uid
40-
ports:
41-
- containerPort: 9440
42-
name: healthz
43-
protocol: TCP
44-
readinessProbe:
45-
httpGet:
46-
path: /readyz
47-
port: healthz
48-
livenessProbe:
49-
httpGet:
50-
path: /healthz
51-
port: healthz
19+
- command:
20+
- /manager
21+
args:
22+
- "--leader-elect"
23+
- "--metrics-bind-addr=localhost:8080"
24+
- "--feature-gates=ClusterTopology=${CLUSTER_TOPOLOGY:=false},KubeadmBootstrapFormatIgnition=${EXP_KUBEADM_BOOTSTRAP_FORMAT_IGNITION:=false}"
25+
image: controller:latest
26+
name: manager
27+
env:
28+
- name: POD_NAMESPACE
29+
valueFrom:
30+
fieldRef:
31+
fieldPath: metadata.namespace
32+
- name: POD_NAME
33+
valueFrom:
34+
fieldRef:
35+
fieldPath: metadata.name
36+
- name: POD_UID
37+
valueFrom:
38+
fieldRef:
39+
fieldPath: metadata.uid
40+
ports:
41+
- containerPort: 9440
42+
name: healthz
43+
protocol: TCP
44+
readinessProbe:
45+
httpGet:
46+
path: /readyz
47+
port: healthz
48+
livenessProbe:
49+
httpGet:
50+
path: /healthz
51+
port: healthz
52+
securityContext:
53+
allowPrivilegeEscalation: false
54+
capabilities:
55+
drop:
56+
- ALL
57+
privileged: false
58+
runAsUser: 65532
59+
runAsGroup: 65532
5260
terminationGracePeriodSeconds: 10
5361
serviceAccountName: manager
5462
tolerations:
5563
- effect: NoSchedule
5664
key: node-role.kubernetes.io/master
5765
- effect: NoSchedule
5866
key: node-role.kubernetes.io/control-plane
67+
securityContext:
68+
runAsNonRoot: true
69+
seccompProfile:
70+
type: RuntimeDefault

‎docs/book/src/developer/providers/v1.3-to-v1.4.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,12 @@ maintainers of providers and consumers of our Go API.
55

66
## Minimum Go version
77

8-
* The Go version used by Cluster API is still Go 1.19.x
8+
- The Go version used by Cluster API is still Go 1.19.x
99

1010
## Dependencies
1111

1212
**Note**: Only the most relevant dependencies are listed, `k8s.io/` and `ginkgo`/`gomega` dependencies in Cluster API are kept in sync with the versions used by `sigs.k8s.io/controller-runtime`.
1313

14-
1514
## Changes by Kind
1615

1716
### Deprecation
@@ -36,5 +35,8 @@ maintainers of providers and consumers of our Go API.
3635

3736
- `clusterctl upgrade apply` no longer requires a namespace when updating providers. It is now optional and in a future release it will be deprecated. The new syntax is `[namespace/]provider:version`.
3837
- `WatchDeploymentLogs` is changed to `WatchDeploymentLogsByName`, it works same as before. Another function `WatchDeploymentLogsByLabelSelector` is added to stream logs of deployment by label selector.
38+
- Cluster API controllers are now using an explicit security context by default.
3939

4040
### Suggested changes for providers
41+
42+
- Providers should add an explicit security context to their controllers deployment, see [#7831](https://github.com/kubernetes-sigs/cluster-api/pull/7831) for reference.

‎test/extension/config/default/manager.yaml

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,26 @@ spec:
1414
app: test-extension-manager
1515
spec:
1616
containers:
17-
- command:
18-
- /manager
19-
image: controller:latest
20-
name: manager
17+
- command:
18+
- /manager
19+
image: controller:latest
20+
name: manager
21+
securityContext:
22+
allowPrivilegeEscalation: false
23+
capabilities:
24+
drop:
25+
- ALL
26+
privileged: false
27+
runAsUser: 65532
28+
runAsGroup: 65532
2129
terminationGracePeriodSeconds: 10
2230
serviceAccountName: manager
2331
tolerations:
2432
- effect: NoSchedule
2533
key: node-role.kubernetes.io/master
2634
- effect: NoSchedule
2735
key: node-role.kubernetes.io/control-plane
36+
securityContext:
37+
runAsNonRoot: true
38+
seccompProfile:
39+
type: RuntimeDefault

0 commit comments

Comments
 (0)