Skip to content

Commit bffdcca

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #776 from vyzigold/least-privileges
[OSPRH-4293] Run containers with least privileges
2 parents f723141 + 1655d36 commit bffdcca

File tree

12 files changed

+116
-88
lines changed

12 files changed

+116
-88
lines changed

‎pkg/autoscaling/aodh_statefulset.go‎

Lines changed: 23 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
corev1 "k8s.io/api/core/v1"
3131
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3232
"k8s.io/apimachinery/pkg/util/intstr"
33+
"k8s.io/utils/ptr"
3334

3435
memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1"
3536
topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
@@ -38,7 +39,7 @@ import (
3839

3940
const (
4041
// ServiceCommand -
41-
ServiceCommand = "/usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start"
42+
ServiceCommand = "/usr/local/bin/kolla_start"
4243
)
4344

4445
// AodhStatefulSet func
@@ -49,7 +50,7 @@ func AodhStatefulSet(
4950
topology *topologyv1.Topology,
5051
memcached *memcachedv1.Memcached,
5152
) (*appsv1.StatefulSet, error) {
52-
runAsUser := int64(0)
53+
aodhUser := int64(AodhUserID)
5354

5455
livenessProbe := &corev1.Probe{
5556
// TODO might need tuning
@@ -139,13 +140,10 @@ func AodhStatefulSet(
139140
Command: []string{
140141
"/bin/bash",
141142
},
142-
Args: args,
143-
Image: instance.Spec.Aodh.APIImage,
144-
Name: "aodh-api",
145-
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
146-
SecurityContext: &corev1.SecurityContext{
147-
RunAsUser: &runAsUser,
148-
},
143+
Args: args,
144+
Image: instance.Spec.Aodh.APIImage,
145+
Name: "aodh-api",
146+
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
149147
VolumeMounts: apiVolumeMounts,
150148
}
151149

@@ -154,13 +152,10 @@ func AodhStatefulSet(
154152
Command: []string{
155153
"/bin/bash",
156154
},
157-
Args: args,
158-
Image: instance.Spec.Aodh.EvaluatorImage,
159-
Name: "aodh-evaluator",
160-
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
161-
SecurityContext: &corev1.SecurityContext{
162-
RunAsUser: &runAsUser,
163-
},
155+
Args: args,
156+
Image: instance.Spec.Aodh.EvaluatorImage,
157+
Name: "aodh-evaluator",
158+
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
164159
VolumeMounts: evaluatorVolumeMounts,
165160
}
166161

@@ -169,13 +164,10 @@ func AodhStatefulSet(
169164
Command: []string{
170165
"/bin/bash",
171166
},
172-
Args: args,
173-
Image: instance.Spec.Aodh.NotifierImage,
174-
Name: "aodh-notifier",
175-
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
176-
SecurityContext: &corev1.SecurityContext{
177-
RunAsUser: &runAsUser,
178-
},
167+
Args: args,
168+
Image: instance.Spec.Aodh.NotifierImage,
169+
Name: "aodh-notifier",
170+
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
179171
VolumeMounts: notifierVolumeMounts,
180172
}
181173

@@ -184,13 +176,10 @@ func AodhStatefulSet(
184176
Command: []string{
185177
"/bin/bash",
186178
},
187-
Args: args,
188-
Image: instance.Spec.Aodh.ListenerImage,
189-
Name: "aodh-listener",
190-
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
191-
SecurityContext: &corev1.SecurityContext{
192-
RunAsUser: &runAsUser,
193-
},
179+
Args: args,
180+
Image: instance.Spec.Aodh.ListenerImage,
181+
Name: "aodh-listener",
182+
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
194183
VolumeMounts: listenerVolumeMounts,
195184
}
196185

@@ -208,6 +197,10 @@ func AodhStatefulSet(
208197
notifierContainer,
209198
listenerContainer,
210199
},
200+
SecurityContext: &corev1.PodSecurityContext{
201+
RunAsUser: &aodhUser,
202+
RunAsNonRoot: ptr.To(true),
203+
},
211204
},
212205
}
213206

‎pkg/autoscaling/const.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ const (
4444

4545
// PrometheusEndpointSecret is the name of the secret containing Prometheus endpoint configuration
4646
PrometheusEndpointSecret = "metric-storage-prometheus-endpoint"
47+
48+
// AodhUserID -
49+
AodhUserID = 42402
4750
)
4851

4952
// PrometheusReplicas -

‎pkg/autoscaling/dbsync.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,11 @@ import (
2222
batchv1 "k8s.io/api/batch/v1"
2323
corev1 "k8s.io/api/core/v1"
2424
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
25+
"k8s.io/utils/ptr"
2526
)
2627

2728
const (
28-
dbSyncCommand = "/usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start"
29+
dbSyncCommand = "/usr/local/bin/kolla_start"
2930
)
3031

3132
// DbSyncJob func
@@ -42,7 +43,7 @@ func DbSyncJob(instance *autoscalingv1beta1.Autoscaling, labels map[string]strin
4243
volumeMounts = append(volumeMounts, instance.Spec.Aodh.TLS.CreateVolumeMounts(nil)...)
4344
}
4445

45-
runAsUser := int64(0)
46+
runAsUser := int64(AodhUserID)
4647
envVars := map[string]env.Setter{}
4748
envVars["KOLLA_CONFIG_STRATEGY"] = env.SetValue("COPY_ALWAYS")
4849
envVars["KOLLA_BOOTSTRAP"] = env.SetValue("TRUE")
@@ -80,7 +81,8 @@ func DbSyncJob(instance *autoscalingv1beta1.Autoscaling, labels map[string]strin
8081
Args: args,
8182
Image: instance.Spec.Aodh.APIImage,
8283
SecurityContext: &corev1.SecurityContext{
83-
RunAsUser: &runAsUser,
84+
RunAsUser: &runAsUser,
85+
RunAsNonRoot: ptr.To(true),
8486
},
8587
Env: env.MergeEnvs(aodhPassword, envVars),
8688
VolumeMounts: volumeMounts,

‎pkg/ceilometer/const.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,7 @@ const (
3434

3535
// KollaConfigNotification -
3636
KollaConfigNotification = "/var/lib/config-data/merged/config-notification.json"
37+
38+
// CeilometerUserID -
39+
CeilometerUserID = 42405
3740
)

‎pkg/ceilometer/statefulset.go‎

Lines changed: 31 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ import (
3535

3636
const (
3737
// ServiceCommand -
38-
ServiceCommand = "/usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start"
38+
ServiceCommand = "/usr/local/bin/kolla_start"
3939
// CentralHCScript is the path to the central health check script
4040
CentralHCScript = "/var/lib/openstack/bin/centralhealth.py"
4141
// NotificationHCScript is the path to the notification health check script
@@ -49,7 +49,7 @@ func StatefulSet(
4949
labels map[string]string,
5050
topology *topologyv1.Topology,
5151
) (*appsv1.StatefulSet, error) {
52-
runAsUser := int64(0)
52+
ceilometerUser := int64(CeilometerUserID)
5353

5454
// container probes
5555
sgRootEndpointCurl := corev1.HTTPGetAction{
@@ -141,13 +141,10 @@ func StatefulSet(
141141
Command: []string{
142142
"/bin/bash",
143143
},
144-
Args: args,
145-
Image: instance.Spec.CentralImage,
146-
Name: "ceilometer-central-agent",
147-
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsCentral),
148-
SecurityContext: &corev1.SecurityContext{
149-
RunAsUser: &runAsUser,
150-
},
144+
Args: args,
145+
Image: instance.Spec.CentralImage,
146+
Name: "ceilometer-central-agent",
147+
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsCentral),
151148
VolumeMounts: centralVolumeMounts,
152149
LivenessProbe: centralLivenessProbe,
153150
}
@@ -156,32 +153,31 @@ func StatefulSet(
156153
Command: []string{
157154
"/bin/bash",
158155
},
159-
Args: args,
160-
Image: instance.Spec.NotificationImage,
161-
Name: "ceilometer-notification-agent",
162-
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsNotification),
163-
SecurityContext: &corev1.SecurityContext{
164-
RunAsUser: &runAsUser,
165-
},
156+
Args: args,
157+
Image: instance.Spec.NotificationImage,
158+
Name: "ceilometer-notification-agent",
159+
Env: env.MergeEnvs([]corev1.EnvVar{}, envVarsNotification),
166160
VolumeMounts: notificationVolumeMounts,
167161
LivenessProbe: notificationLivenessProbe,
168162
}
169163
sgCoreContainer := corev1.Container{
170164
ImagePullPolicy: corev1.PullAlways,
171165
Image: instance.Spec.SgCoreImage,
172166
Name: "sg-core",
167+
VolumeMounts: getSgCoreVolumeMounts(),
173168
SecurityContext: &corev1.SecurityContext{
174-
RunAsUser: &runAsUser,
169+
AllowPrivilegeEscalation: ptr.To(false),
170+
Capabilities: &corev1.Capabilities{
171+
Drop: []corev1.Capability{
172+
"ALL",
173+
},
174+
},
175175
},
176-
VolumeMounts: getSgCoreVolumeMounts(),
177176
}
178177
proxyContainer := corev1.Container{
179178
ImagePullPolicy: corev1.PullAlways,
180179
Image: instance.Spec.ProxyImage,
181180
Name: "proxy-httpd",
182-
SecurityContext: &corev1.SecurityContext{
183-
RunAsUser: &runAsUser,
184-
},
185181
Ports: []corev1.ContainerPort{{
186182
ContainerPort: int32(CeilometerPrometheusPort),
187183
Name: "proxy-httpd",
@@ -191,6 +187,14 @@ func StatefulSet(
191187
LivenessProbe: sgLivenessProbe,
192188
Command: []string{"/usr/sbin/httpd"},
193189
Args: []string{"-DFOREGROUND"},
190+
SecurityContext: &corev1.SecurityContext{
191+
AllowPrivilegeEscalation: ptr.To(false),
192+
Capabilities: &corev1.Capabilities{
193+
Drop: []corev1.Capability{
194+
"ALL",
195+
},
196+
},
197+
},
194198
}
195199

196200
pod := corev1.PodTemplateSpec{
@@ -207,6 +211,12 @@ func StatefulSet(
207211
sgCoreContainer,
208212
proxyContainer,
209213
},
214+
SecurityContext: &corev1.PodSecurityContext{
215+
RunAsUser: &ceilometerUser,
216+
RunAsGroup: &ceilometerUser,
217+
RunAsNonRoot: ptr.To(true),
218+
FSGroup: &ceilometerUser,
219+
},
210220
},
211221
}
212222

‎pkg/mysqldexporter/statefulset.go‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,6 @@ func StatefulSet(
4242
labels map[string]string,
4343
topology *topologyv1.Topology,
4444
) (*appsv1.StatefulSet, error) {
45-
runAsUser := int64(0)
46-
4745
envVars := map[string]env.Setter{}
4846
envVars["CONFIG_HASH"] = env.SetValue(configHash)
4947

@@ -108,7 +106,12 @@ func StatefulSet(
108106
Name: ServiceName,
109107
Env: env.MergeEnvs([]corev1.EnvVar{}, envVars),
110108
SecurityContext: &corev1.SecurityContext{
111-
RunAsUser: &runAsUser,
109+
AllowPrivilegeEscalation: ptr.To(false),
110+
Capabilities: &corev1.Capabilities{
111+
Drop: []corev1.Capability{
112+
"ALL",
113+
},
114+
},
112115
},
113116
VolumeMounts: volumeMounts,
114117
}
@@ -125,6 +128,12 @@ func StatefulSet(
125128
mysqldExporterContainer,
126129
},
127130
Volumes: volumes,
131+
SecurityContext: &corev1.PodSecurityContext{
132+
RunAsNonRoot: ptr.To(true),
133+
SeccompProfile: &corev1.SeccompProfile{
134+
Type: corev1.SeccompProfileTypeRuntimeDefault,
135+
},
136+
},
128137
},
129138
}
130139

‎templates/autoscaling/config/aodh-api-config.json‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
{
3030
"source": "/var/lib/openstack/config/ssl.conf",
3131
"dest": "/etc/httpd/conf.d/ssl.conf",
32-
"owner": "root",
32+
"owner": "aodh",
3333
"perm": "0644"
3434
},
3535
{
@@ -70,5 +70,12 @@
7070
"optional": true,
7171
"merge": true
7272
}
73+
],
74+
"permissions": [
75+
{
76+
"path": "/etc/httpd/run",
77+
"owner": "aodh:apache",
78+
"recurse": true
79+
}
7380
]
7481
}

‎templates/autoscaling/config/httpd.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-A
1919
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
2020
CustomLog /dev/stdout combined env=!forwarded
2121
CustomLog /dev/stdout proxy env=forwarded
22+
ErrorLog /dev/stdout
2223

2324
# XXX: To disable SSL
2425
#Include conf.d/*.conf

‎tests/kuttl/suites/autoscaling/tests/01-assert.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,25 +11,25 @@ spec:
1111
containers:
1212
- args:
1313
- -c
14-
- /usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start
14+
- /usr/local/bin/kolla_start
1515
command:
1616
- /bin/bash
1717
name: aodh-api
1818
- args:
1919
- -c
20-
- /usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start
20+
- /usr/local/bin/kolla_start
2121
command:
2222
- /bin/bash
2323
name: aodh-evaluator
2424
- args:
2525
- -c
26-
- /usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start
26+
- /usr/local/bin/kolla_start
2727
command:
2828
- /bin/bash
2929
name: aodh-notifier
3030
- args:
3131
- -c
32-
- /usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start
32+
- /usr/local/bin/kolla_start
3333
command:
3434
- /bin/bash
3535
name: aodh-listener
@@ -68,25 +68,25 @@ spec:
6868
containers:
6969
- args:
7070
- -c
71-
- /usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start
71+
- /usr/local/bin/kolla_start
7272
command:
7373
- /bin/bash
7474
name: aodh-api
7575
- args:
7676
- -c
77-
- /usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start
77+
- /usr/local/bin/kolla_start
7878
command:
7979
- /bin/bash
8080
name: aodh-evaluator
8181
- args:
8282
- -c
83-
- /usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start
83+
- /usr/local/bin/kolla_start
8484
command:
8585
- /bin/bash
8686
name: aodh-notifier
8787
- args:
8888
- -c
89-
- /usr/local/bin/kolla_set_configs && /usr/local/bin/kolla_start
89+
- /usr/local/bin/kolla_start
9090
command:
9191
- /bin/bash
9292
name: aodh-listener

0 commit comments

Comments
 (0)