Skip to content

Commit 7f34aae

Browse files
camilamacedo86camilamacedo86
committed
✨ applying restrictive SCC for all conatiners produced by the tool
1 parent 1bd3ffe commit 7f34aae

File tree

34 files changed

+27
-312
lines changed

34 files changed

+27
-312
lines changed

‎pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -53,10 +53,6 @@ metadata:
5353
spec:
5454
template:
5555
spec:
56-
securityContext:
57-
runAsNonRoot: true
58-
seccompProfile:
59-
type: RuntimeDefault
6056
containers:
6157
- name: kube-rbac-proxy
6258
securityContext:
@@ -83,11 +79,6 @@ spec:
8379
memory: 64Mi
8480
{{- if not .ComponentConfig }}
8581
- name: manager
86-
securityContext:
87-
allowPrivilegeEscalation: false
88-
capabilities:
89-
drop:
90-
- ALL
9182
args:
9283
- "--health-probe-bind-address=:8081"
9384
- "--metrics-bind-address=127.0.0.1:8080"

‎pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_config_patch.go

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -48,17 +48,8 @@ metadata:
4848
spec:
4949
template:
5050
spec:
51-
securityContext:
52-
runAsNonRoot: true
53-
seccompProfile:
54-
type: RuntimeDefault
5551
containers:
5652
- name: manager
57-
securityContext:
58-
allowPrivilegeEscalation: false
59-
capabilities:
60-
drop:
61-
- ALL
6253
args:
6354
- "--config=controller_manager_config.yaml"
6455
volumeMounts:
@@ -67,11 +58,6 @@ spec:
6758
subPath: controller_manager_config.yaml
6859
volumes:
6960
- name: manager-config
70-
securityContext:
71-
allowPrivilegeEscalation: false
72-
capabilities:
73-
drop:
74-
- ALL
7561
configMap:
7662
name: manager-config
7763
`

‎pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -57,17 +57,8 @@ metadata:
5757
spec:
5858
template:
5959
spec:
60-
securityContext:
61-
runAsNonRoot: true
62-
seccompProfile:
63-
type: RuntimeDefault
6460
containers:
6561
- name: manager
66-
securityContext:
67-
allowPrivilegeEscalation: false
68-
capabilities:
69-
drop:
70-
- ALL
7162
ports:
7263
- containerPort: 9443
7364
name: webhook-server

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -53,10 +53,6 @@ metadata:
5353
spec:
5454
template:
5555
spec:
56-
securityContext:
57-
runAsNonRoot: true
58-
seccompProfile:
59-
type: RuntimeDefault
6056
containers:
6157
- name: kube-rbac-proxy
6258
securityContext:

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/kdefault/manager_config_patch.go

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -48,17 +48,8 @@ metadata:
4848
spec:
4949
template:
5050
spec:
51-
securityContext:
52-
runAsNonRoot: true
53-
seccompProfile:
54-
type: RuntimeDefault
5551
containers:
5652
- name: manager
57-
securityContext:
58-
allowPrivilegeEscalation: false
59-
capabilities:
60-
drop:
61-
- ALL
6253
args:
6354
- "--config=controller_manager_config.yaml"
6455
volumeMounts:
@@ -67,11 +58,6 @@ spec:
6758
subPath: controller_manager_config.yaml
6859
volumes:
6960
- name: manager-config
70-
securityContext:
71-
allowPrivilegeEscalation: false
72-
capabilities:
73-
drop:
74-
- ALL
7561
configMap:
7662
name: manager-config
7763
`

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -57,17 +57,8 @@ metadata:
5757
spec:
5858
template:
5959
spec:
60-
securityContext:
61-
runAsNonRoot: true
62-
seccompProfile:
63-
type: RuntimeDefault
6460
containers:
6561
- name: manager
66-
securityContext:
67-
allowPrivilegeEscalation: false
68-
capabilities:
69-
drop:
70-
- ALL
7162
ports:
7263
- containerPort: 9443
7364
name: webhook-server

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ spec:
7272
spec:
7373
securityContext:
7474
runAsNonRoot: true
75+
seccompProfile:
76+
type: RuntimeDefault
7577
containers:
7678
- command:
7779
- /manager
@@ -83,6 +85,9 @@ spec:
8385
name: manager
8486
securityContext:
8587
allowPrivilegeEscalation: false
88+
capabilities:
89+
drop:
90+
- ALL
8691
livenessProbe:
8792
httpGet:
8893
path: /healthz

‎pkg/plugins/golang/v2/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -52,17 +52,8 @@ metadata:
5252
spec:
5353
template:
5454
spec:
55-
securityContext:
56-
runAsNonRoot: true
57-
seccompProfile:
58-
type: RuntimeDefault
5955
containers:
6056
- name: kube-rbac-proxy
61-
securityContext:
62-
allowPrivilegeEscalation: false
63-
capabilities:
64-
drop:
65-
- ALL
6657
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
6758
args:
6859
- "--secure-listen-address=0.0.0.0:8443"

‎pkg/plugins/golang/v2/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -48,17 +48,8 @@ metadata:
4848
spec:
4949
template:
5050
spec:
51-
securityContext:
52-
runAsNonRoot: true
53-
seccompProfile:
54-
type: RuntimeDefault
5551
containers:
5652
- name: manager
57-
securityContext:
58-
allowPrivilegeEscalation: false
59-
capabilities:
60-
drop:
61-
- ALL
6253
ports:
6354
- containerPort: 9443
6455
name: webhook-server

‎test/e2e/v3/plugin_cluster_test.go

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ var _ = Describe("kubebuilder", func() {
8484
kbc.UninstallCertManager(true)
8585
})
8686

87-
It("should generate a runnable project", func() {
87+
It("should generate a runnable project go/v2 with default SA", func() {
8888
// go/v3 uses a unqiue-per-project service account name,
8989
// while go/v2 still uses "default".
9090
tmp := kbc.Kubectl.ServiceAccount
@@ -106,30 +106,39 @@ var _ = Describe("kubebuilder", func() {
106106
kbc.UninstallCertManager(false)
107107
})
108108

109-
It("should generate a runnable project", func() {
109+
It("should generate a runnable project go/v3 with v1 CRDs and Webhooks", func() {
110110
// Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist.
111-
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 17 {
112-
Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks", srvVer.GitVersion))
111+
// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
112+
// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
113+
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 {
114+
Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks"+
115+
"and securityContext.seccompProfile", srvVer.GitVersion))
113116
}
114117

115118
GenerateV3(kbc, "v1")
116119
Run(kbc)
117120
})
118121
It("should generate a runnable project with the golang base plugin v3 and kustomize v4-alpha", func() {
119122
// Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist.
120-
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 17 {
121-
Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks", srvVer.GitVersion))
123+
// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
124+
// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
125+
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 {
126+
Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks "+
127+
"and securityContext.seccompProfile", srvVer.GitVersion))
122128
}
123129

124130
GenerateV3WithKustomizeV2(kbc, "v1")
125131
Run(kbc)
126132
})
127133
It("should generate a runnable project with v1beta1 CRDs and Webhooks", func() {
128134
// Skip if cluster version < 1.15, when `.spec.preserveUnknownFields` was not a v1beta1 CRD field.
135+
// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
136+
// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
129137
// Skip if cluster version >= 1.22 because pre v1 CRDs and webhooks no longer exist.
130-
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 16 ||
138+
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 ||
131139
srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() >= 22 {
132-
Skip(fmt.Sprintf("cluster version %s does not support project defaults", srvVer.GitVersion))
140+
Skip(fmt.Sprintf("cluster version %s does not support project defaults "+
141+
"and securityContext.seccompProfile", srvVer.GitVersion))
133142
}
134143

135144
GenerateV3(kbc, "v1beta1")

0 commit comments

Comments
 (0)