Skip to content

Commit 6e04e04

Browse files
jlarribajlarriba
authored
Merge pull request #10 from vyzigold/ck_lowest_privileges
[OSPRH-21081] Lower privileges for CK related pods
2 parents 55fc7f4 + 515eab1 commit 6e04e04

File tree

6 files changed

+29
-24
lines changed

6 files changed

+29
-24
lines changed

‎pkg/cloudkitty/const.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@ const (
6262
CaConfigmapName = "lokistack-ca"
6363
// CaConfigmapKey is the key in the CA configmap
6464
CaConfigmapKey = "ca.crt"
65+
66+
// CloudKittyUserID -
67+
CloudKittyUserID = 42406
6568
)
6669

6770
// ResultRequeue is a ctrl.Result that requeues after NormalDuration

‎pkg/cloudkitty/dbsync.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323
batchv1 "k8s.io/api/batch/v1"
2424
corev1 "k8s.io/api/core/v1"
2525
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
26+
"k8s.io/utils/ptr"
2627
)
2728

2829
const (
@@ -34,7 +35,7 @@ const (
3435
// If we are doing rolling upgrades we'll need to use the flag
3536
// conditionally (only for adoption) and do the restart cycle of
3637
// services as described in the upstream rolling upgrades process.
37-
dbSyncCommand = "/usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start"
38+
dbSyncCommand = "/usr/local/bin/kolla_start"
3839
)
3940

4041
// DbSyncJob func
@@ -51,7 +52,7 @@ func DbSyncJob(instance *telemetryv1.CloudKitty, labels map[string]string, annot
5152
volumeMounts = append(volumeMounts, instance.Spec.CloudKittyAPI.TLS.CreateVolumeMounts(nil)...)
5253
}
5354

54-
runAsUser := int64(0)
55+
runAsUser := int64(CloudKittyUserID)
5556
envVars := map[string]env.Setter{}
5657
envVars["KOLLA_CONFIG_STRATEGY"] = env.SetValue("COPY_ALWAYS")
5758
envVars["KOLLA_BOOTSTRAP"] = env.SetValue("TRUE")
@@ -92,7 +93,8 @@ func DbSyncJob(instance *telemetryv1.CloudKitty, labels map[string]string, annot
9293
Args: args,
9394
Image: instance.Spec.CloudKittyAPI.ContainerImage,
9495
SecurityContext: &corev1.SecurityContext{
95-
RunAsUser: &runAsUser,
96+
RunAsUser: &runAsUser,
97+
RunAsNonRoot: ptr.To(true),
9698
},
9799
Env: env.MergeEnvs(cloudKittyPassword, envVars),
98100
VolumeMounts: volumeMounts,

‎pkg/cloudkitty/storageinit.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323
batchv1 "k8s.io/api/batch/v1"
2424
corev1 "k8s.io/api/core/v1"
2525
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
26+
"k8s.io/utils/ptr"
2627
)
2728

2829
const (
@@ -34,7 +35,7 @@ const (
3435
// If we are doing rolling upgrades we'll need to use the flag
3536
// conditionally (only for adoption) and do the restart cycle of
3637
// services as described in the upstream rolling upgrades process.
37-
storageInitCommand = "/usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start"
38+
storageInitCommand = "/usr/local/bin/kolla_start"
3839
)
3940

4041
// StorageInitJob func
@@ -50,7 +51,7 @@ func StorageInitJob(instance *telemetryv1.CloudKitty, labels map[string]string,
5051
volumeMounts = append(volumeMounts, instance.Spec.CloudKittyAPI.TLS.CreateVolumeMounts(nil)...)
5152
}
5253

53-
runAsUser := int64(0)
54+
runAsUser := int64(CloudKittyUserID)
5455
envVars := map[string]env.Setter{}
5556
envVars["KOLLA_CONFIG_STRATEGY"] = env.SetValue("COPY_ALWAYS")
5657
envVars["KOLLA_BOOTSTRAP"] = env.SetValue("TRUE")
@@ -91,7 +92,8 @@ func StorageInitJob(instance *telemetryv1.CloudKitty, labels map[string]string,
9192
Args: args,
9293
Image: instance.Spec.CloudKittyAPI.ContainerImage,
9394
SecurityContext: &corev1.SecurityContext{
94-
RunAsUser: &runAsUser,
95+
RunAsUser: &runAsUser,
96+
RunAsNonRoot: ptr.To(true),
9597
},
9698
Env: env.MergeEnvs(cloudKittyPassword, envVars),
9799
VolumeMounts: volumeMounts,

‎pkg/cloudkitty/volumes.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66

77
var (
88
// scriptMode is the default permissions mode for Scripts volume
9-
scriptMode int32 = 0740
9+
scriptMode int32 = 0755
1010
// configMode is the 640 permissions mode
1111
configMode int32 = 0640
1212
// certMode is the 400 permissions mode

‎pkg/cloudkittyapi/statefulset.go‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,12 @@ import (
2727
corev1 "k8s.io/api/core/v1"
2828
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2929
"k8s.io/apimachinery/pkg/util/intstr"
30+
"k8s.io/utils/ptr"
3031
)
3132

3233
const (
3334
// ServiceCommand -
34-
ServiceCommand = "/usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start"
35+
ServiceCommand = "/usr/local/bin/kolla_start"
3536
)
3637

3738
// StatefulSet func
@@ -42,8 +43,7 @@ func StatefulSet(
4243
annotations map[string]string,
4344
topology *topologyv1.Topology,
4445
) (*appsv1.StatefulSet, error) {
45-
runAsUser := int64(0)
46-
//cloudKittyUser := int64(telemetryv1.CloudKittyUserID)
46+
runAsUser := int64(cloudkitty.CloudKittyUserID)
4747

4848
livenessProbe := &corev1.Probe{
4949
// TODO might need tuning
@@ -140,10 +140,7 @@ func StatefulSet(
140140
"-c",
141141
"/usr/bin/tail -n+1 -F " + LogFile + " 2>/dev/null",
142142
},
143-
Image: instance.Spec.ContainerImage,
144-
SecurityContext: &corev1.SecurityContext{
145-
RunAsUser: &runAsUser,
146-
},
143+
Image: instance.Spec.ContainerImage,
147144
Env: env.MergeEnvs([]corev1.EnvVar{}, envVars),
148145
VolumeMounts: []corev1.VolumeMount{GetLogVolumeMount()},
149146
Resources: instance.Spec.Resources,
@@ -153,18 +150,19 @@ func StatefulSet(
153150
Command: []string{
154151
"/bin/bash",
155152
},
156-
Args: args,
157-
Image: instance.Spec.ContainerImage,
158-
SecurityContext: &corev1.SecurityContext{
159-
RunAsUser: &runAsUser,
160-
},
153+
Args: args,
154+
Image: instance.Spec.ContainerImage,
161155
Env: env.MergeEnvs([]corev1.EnvVar{}, envVars),
162156
VolumeMounts: volumeMounts,
163157
Resources: instance.Spec.Resources,
164158
ReadinessProbe: readinessProbe,
165159
LivenessProbe: livenessProbe,
166160
},
167161
},
162+
SecurityContext: &corev1.PodSecurityContext{
163+
RunAsUser: &runAsUser,
164+
RunAsNonRoot: ptr.To(true),
165+
},
168166
Volumes: volumes,
169167
},
170168
},

‎pkg/cloudkittyproc/statefulset.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,12 @@ import (
2424
appsv1 "k8s.io/api/apps/v1"
2525
corev1 "k8s.io/api/core/v1"
2626
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
27+
"k8s.io/utils/ptr"
2728
)
2829

2930
const (
3031
// ServiceCommand -
31-
ServiceCommand = "/usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start"
32+
ServiceCommand = "/usr/local/bin/kolla_start"
3233
// CloudKittyHCScript is the path to the health check script
3334
CloudKittyHCScript = "/var/lib/openstack/bin/healthcheck.py"
3435
)
@@ -41,9 +42,7 @@ func StatefulSet(
4142
annotations map[string]string,
4243
topology *topologyv1.Topology,
4344
) *appsv1.StatefulSet {
44-
cloudKittyUser := int64(0)
45-
// cloudKittyUser := int64(telemetryv1.CloudKittyUserID)
46-
// cloudKittyGroup := int64(telemetryv1.CloudKittyGroupID)
45+
runAsUser := int64(cloudkitty.CloudKittyUserID)
4746

4847
// TODO until we determine how to properly query for these
4948
livenessProbe := &corev1.Probe{
@@ -105,7 +104,8 @@ func StatefulSet(
105104
Args: args,
106105
Image: instance.Spec.ContainerImage,
107106
SecurityContext: &corev1.SecurityContext{
108-
RunAsUser: &cloudKittyUser,
107+
RunAsUser: &runAsUser,
108+
RunAsNonRoot: ptr.To(true),
109109
},
110110
Env: env.MergeEnvs([]corev1.EnvVar{}, envVars),
111111
VolumeMounts: volumeMounts,

0 commit comments

Comments
 (0)