Motivation
This would improve the default security out of the box for helm chart users. If the containers currently support it, there isn't much downside to improving the default security.
It also helps clarifying to the end-user that these values are officially supported and will not cause any problem with the containers (e.g.: readOnlyRootFilesystem: true could for example cause problems for containers expecting to write to specific directories). By having them already specified, the end-user does not need to do extensive testing to ensure it does not cause any issue.
Feature
Have each Helm chart container securityContext provide the highest default that they can sustain. For example, this would, in general, be a good default in line with Kubernetes PSS (https://kubernetes.io/docs/concepts/security/pod-security-standards/) to try and reach towards (obviously just a target, not possible to attain for falco itself):
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefaultAlternatives
Each end-user has to do extensive testing to figure out which securityContext setting is appropriate and which may cause problem. This is also risky since some settings may not cause errors until the container has been running for a while.
Additional context
Falco sidekick does not currently provide any securityContext nor a commented one :
|
# -- Sidekick container securityContext |
|
securityContext: {} |
This then leaves the end-user to do extensive testing on his own to figure out the highest/optimal securityContext
Falco exporter does not provide default securityContext but gives some better suggestion through comment:
|
securityContext: |
|
{} |
|
# capabilities: |
|
# drop: |
|
# - ALL |
|
# readOnlyRootFilesystem: true |
|
# runAsNonRoot: true |
|
# runAsUser: 1000 |
It would be great to have a good default provided out of the box as suggested in the
Feature section
Event-generator seems to be in a similar situation as falco-exporter
Falco itself is very hard to find the optimal securityContext for the end-user. There are currently some default configuration implemented, but they are not all working at the moment (see falcosecurity/falco#2487). It would be nice to have a strong default securityContext here as well, especially since it is not easy to find the appropriate settings in each context (e.g.: ebpf, modern-bpf, module, etc.) In this case, the securityContext would be dynamically computed.
Motivation
This would improve the default security out of the box for helm chart users. If the containers currently support it, there isn't much downside to improving the default security.
It also helps clarifying to the end-user that these values are officially supported and will not cause any problem with the containers (e.g.:
readOnlyRootFilesystem: truecould for example cause problems for containers expecting to write to specific directories). By having them already specified, the end-user does not need to do extensive testing to ensure it does not cause any issue.Feature
Have each Helm chart container securityContext provide the highest default that they can sustain. For example, this would, in general, be a good default in line with Kubernetes PSS (https://kubernetes.io/docs/concepts/security/pod-security-standards/) to try and reach towards (obviously just a target, not possible to attain for falco itself):
Alternatives
Each end-user has to do extensive testing to figure out which securityContext setting is appropriate and which may cause problem. This is also risky since some settings may not cause errors until the container has been running for a while.
Additional context
Falco sidekick does not currently provide any securityContext nor a commented one :
charts/falcosidekick/values.yaml
Lines 23 to 24 in 6fff4e1
This then leaves the end-user to do extensive testing on his own to figure out the highest/optimal securityContext
Falco exporter does not provide default securityContext but gives some better suggestion through comment:
charts/falco-exporter/values.yaml
Lines 73 to 80 in 6fff4e1
It would be great to have a good default provided out of the box as suggested in the
FeaturesectionEvent-generator seems to be in a similar situation as falco-exporter
Falco itself is very hard to find the optimal securityContext for the end-user. There are currently some default configuration implemented, but they are not all working at the moment (see falcosecurity/falco#2487). It would be nice to have a strong default securityContext here as well, especially since it is not easy to find the appropriate settings in each context (e.g.:
ebpf,modern-bpf,module, etc.) In this case, the securityContext would be dynamically computed.