diff --git a/charts/spire/README.md b/charts/spire/README.md index ae6d2fb..61b985a 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -161,6 +161,7 @@ Now you can interact with the Spire agent socket from your own application. The | `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` | | `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` | | `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` | +| `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` | | `global.spire.image.registry` | Override all Spire image registries at once | `""` | | `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` | | `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index c34f3a2..b5db413 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -33,11 +33,11 @@ spec: {{- end }} serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} containers: - name: {{ .Chart.Name }} securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} + {{- include "spire-lib.securitycontext" . | nindent 12 }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: @@ -76,7 +76,7 @@ spec: {{- if .Values.insecureScheme.enabled }} - name: nginx securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} + {{- include "spire-lib.securitycontext" . | nindent 12 }} image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }} imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }} ports: @@ -98,7 +98,7 @@ spec: {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} - name: nginx-exporter securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} + {{- include "spire-lib.securitycontext" . | nindent 12 }} image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }} imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }} args: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml index 452fea0..a2ad605 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml @@ -59,11 +59,11 @@ spec: restartPolicy: Never serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} containers: - name: pre-delete-job securityContext: - {{- toYaml .Values.securityContext | nindent 10 }} + {{- include "spire-lib.securitycontext" . | nindent 10 }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} args: - delete diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index 73a8b35..93ce0d3 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -14,26 +14,26 @@ metadata: "helm.sh/hook": test spec: securityContext: - {{- toYaml .Values.podSecurityContext | nindent 4 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 4 }} containers: - name: curl-service-name image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} - name: curl-service-name-namespace image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} - name: curl-service-name-namespace-svc-cluster-local image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} {{- if .Values.ingress.enabled }} - name: curl-ingress image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} @@ -53,7 +53,7 @@ spec: args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration'] {{- end }} securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} {{- end }} {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }} hostAliases: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml index e2bbc43..531b1ef 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml @@ -8,10 +8,8 @@ metadata: annotations: "helm.sh/hook": test spec: - {{- with .Values.podSecurityContext }} securityContext: - {{- toYaml . | nindent 4 }} - {{- end }} + {{- include "spire-lib.podsecuritycontext" . | nindent 4 }} serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} initContainers: - name: static-busybox @@ -22,10 +20,8 @@ spec: - | cp /bin/busybox /data/busybox chmod +x /data/busybox - {{- with .Values.securityContext }} securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} volumeMounts: - name: data-volume mountPath: /data @@ -41,10 +37,8 @@ spec: [ $? -eq 0 ] && break sleep 1 done - {{- with .Values.securityContext }} securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} volumeMounts: - name: data-volume mountPath: /data @@ -69,10 +63,8 @@ spec: {{- (.Files.Get "files/test/jwt-decode.sh") | nindent 10 }} EOF bash /data/jwt-decode.sh "${URL}"/keys "${JWT}" - {{- with .Values.securityContext }} securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} volumeMounts: - mountPath: /data name: data-volume diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index ffe706f..5ab152c 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -1,4 +1,5 @@ {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} +{{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }} {{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }} apiVersion: apps/v1 kind: DaemonSet @@ -30,7 +31,7 @@ spec: dnsPolicy: ClusterFirstWithHostNet serviceAccountName: {{ include "spire-agent.serviceAccountName" . }} securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- toYaml $podSecurityContext | nindent 8 }} {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }} {{- if ne (len .Values.hostAliases) 0 }} hostAliases: @@ -46,13 +47,13 @@ spec: args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}] resources: {{- toYaml .Values.waitForIt.resources | nindent 12 }} - {{- if gt (int (dig "fsGroup" 0 .Values.podSecurityContext)) 0 }} + {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }} - name: fsgroupfix image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }} imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }} command: ["bash", "-c"] args: - - "chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}" + - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}" resources: {{- toYaml .Values.fsGroupFix.resources | nindent 12 }} volumeMounts: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f5da446..a8c0891 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -303,6 +303,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | | `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | | `tornjak.resources` | Resource requests and limits | `{}` | +| `tornjak.securityContext` | Security Context to use | `{}` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | | `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | | `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 77b6470..457f46b 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -59,11 +59,11 @@ spec: restartPolicy: Never serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} containers: - name: post-install-job securityContext: - {{- toYaml .Values.securityContext | nindent 10 }} + {{- include "spire-lib.securitycontext" . | nindent 10 }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} args: - patch diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index d1b255f..4d4d517 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -59,11 +59,11 @@ spec: restartPolicy: Never serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} containers: - name: post-upgrade-job securityContext: - {{- toYaml .Values.securityContext | nindent 10 }} + {{- include "spire-lib.securitycontext" . | nindent 10 }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} args: - patch diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml index 1416a82..86226a1 100644 --- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml @@ -63,11 +63,11 @@ spec: restartPolicy: Never serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} containers: - name: pre-delete-job securityContext: - {{- toYaml .Values.securityContext | nindent 10 }} + {{- include "spire-lib.securitycontext" . | nindent 10 }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} args: - delete @@ -78,7 +78,7 @@ spec: - --wait - name: pre-delete-check securityContext: - {{- toYaml .Values.securityContext | nindent 10 }} + {{- include "spire-lib.securitycontext" . | nindent 10 }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} args: - wait diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index 27a73d9..1d462bc 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -59,11 +59,11 @@ spec: restartPolicy: Never serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} containers: - name: post-install-job securityContext: - {{- toYaml .Values.securityContext | nindent 10 }} + {{- include "spire-lib.securitycontext" . | nindent 10 }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} args: - patch diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 2e16719..69201d8 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -47,14 +47,14 @@ spec: serviceAccountName: {{ include "spire-server.serviceAccountName" . }} shareProcessNamespace: true securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} {{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }} {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} initContainers: {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} - name: wait securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} + {{- include "spire-lib.securitycontext" . | nindent 12 }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} args: - wait @@ -73,7 +73,7 @@ spec: containers: - name: {{ .Chart.Name }} securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} + {{- include "spire-lib.securitycontext" . | nindent 12 }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: @@ -187,7 +187,7 @@ spec: {{- if eq (.Values.controllerManager.enabled | toString) "true" }} - name: spire-controller-manager securityContext: - {{- toYaml .Values.controllerManager.securityContext | nindent 12 }} + {{- include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.controllerManager.securityContext) | nindent 12 }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }} imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }} args: @@ -228,7 +228,7 @@ spec: {{- if eq (.Values.tornjak.enabled | toString) "true" }} - name: tornjak securityContext: - {{- toYaml .Values.controllerManager.securityContext | nindent 12 }} + {{- include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.tornjak.securityContext) | nindent 12 }} image: {{ template "spire-lib.image" (dict "appVersion" .Values.tornjak.image.defaultTag "image" .Values.tornjak.image "global" .Values.global "ubi" true) }} imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }} {{- if eq (include "spire-tornjak.connectionType" .) "http" }} diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml index 12850e9..9c48b62 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -11,7 +11,7 @@ metadata: "helm.sh/hook": test spec: securityContext: - {{- toYaml .Values.podSecurityContext | nindent 4 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 4 }} containers: - name: curl image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} @@ -30,14 +30,14 @@ spec: fi exit 1 securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} {{- if eq (.Values.federation.enabled | toString) "true" }} - name: curl-federation-bundle-endpoint image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}'] securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} {{- end }} {{- if .Values.federation.ingress.enabled }} - name: federation-ingress @@ -51,7 +51,7 @@ spec: mountPath: /ca {{- end }} securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} {{- end }} {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }} hostAliases: diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml index cacc94d..c259f12 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml @@ -12,20 +12,20 @@ metadata: "helm.sh/hook": test spec: securityContext: - {{- toYaml .Values.podSecurityContext | nindent 4 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 4 }} containers: - name: curl-tornjak-backend image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/tornjak/serverinfo'] securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} - name: curl-tornjak-backend-and-spire image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/healthcheck'] securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} restartPolicy: Never {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 1c515e3..69e4ccb 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -708,6 +708,9 @@ tornjak: # cpu: 100m # memory: 128Mi + ## @param tornjak.securityContext [object] Security Context to use + securityContext: {} + # NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart. # Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we # can prioritize proper support. diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index 79fe5dd..84e152b 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -21,13 +21,13 @@ spec: {{- end }} serviceAccountName: {{ include "tornjak-frontend.serviceAccountName" . }} securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} containers: - name: {{ include "tornjak-frontend.fullname" . }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global "ubi" true) }} imagePullPolicy: {{ .Values.image.pullPolicy }} securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} + {{- include "spire-lib.securitycontext" . | nindent 12 }} ports: - name: http containerPort: 3000 diff --git a/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml index 7f5bdc4..a528ae3 100644 --- a/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml @@ -9,13 +9,13 @@ metadata: "helm.sh/hook": test spec: securityContext: - {{- toYaml .Values.podSecurityContext | nindent 4 }} + {{- include "spire-lib.podsecuritycontext" . | nindent 4 }} containers: - name: curl-tornjak-frontend image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] args: ['-k', '-s', '-f', 'http://{{ include "tornjak-frontend.fullname" . }}.{{ include "tornjak-frontend.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/tornjak/serverinfo'] securityContext: - {{- toYaml .Values.securityContext | nindent 8 }} + {{- include "spire-lib.securitycontext" . | nindent 8 }} restartPolicy: Never diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 1641c72..71c2ad9 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -248,6 +248,61 @@ to merge in values, but spire needs arrays. {{- $config | toPrettyJson }} {{- end }} +{{- define "spire-lib.default_securitycontext_values" }} +allowPrivilegeEscalation: false +runAsNonRoot: true +readOnlyRootFilesystem: true +capabilities: + drop: [ALL] +seccompProfile: + type: RuntimeDefault +{{- end }} + +{{- define "spire-lib.default_k8s_podsecuritycontext_values" }} +fsGroupChangePolicy: OnRootMismatch +runAsUser: 1000 +runAsGroup: 1000 +fsGroup: 1000 +{{- end }} + +{{/* +Note: runAsUser, runAsGroup, fsGroup, are not needed due to it autoassigning restricted users feature of openshift +*/}} +{{- define "spire-lib.default_openshift_podsecuritycontext_values" }} +fsGroupChangePolicy: OnRootMismatch +{{- end }} + +{{- define "spire-lib.securitycontext" }} +{{ include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.securityContext) }} +{{- end }} + +{{/* Same as securitycontext but takes in: +root - global . context for the chart +securityContext - the subbranch of values that contains the securityContext to merge +*/}} +{{- define "spire-lib.securitycontext-extended" }} +{{- if and (dig "spire" "recommendations" "enabled" false .root.Values.global) (dig "spire" "recommendations" "securityContexts" true .root.Values.global) }} +{{- $vals := deepCopy (include "spire-lib.default_securitycontext_values" .root | fromYaml) }} +{{- $vals = mergeOverwrite $vals .securityContext }} +{{- toYaml $vals }} +{{- else }} +{{- toYaml .securityContext }} +{{- end }} +{{- end }} + +{{- define "spire-lib.podsecuritycontext" }} +{{- $vals := dict }} +{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "securityContexts" true .Values.global) }} +{{- if (dig "openshift" false .Values.global) }} +{{- $vals = mergeOverwrite $vals (include "spire-lib.default_openshift_podsecuritycontext_values" . | fromYaml) }} +{{- else }} +{{- $vals = mergeOverwrite $vals (include "spire-lib.default_k8s_podsecuritycontext_values" . | fromYaml) }} +{{- end }} +{{- end }} +{{- $vals = mergeOverwrite $vals .Values.podSecurityContext }} +{{- toYaml $vals }} +{{- end }} + {{- define "spire-lib.default_node_priority_class_name" }} {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 59c461e..52d8dea 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -24,10 +24,12 @@ global: ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off. ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. + ## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts recommendations: enabled: false priorityClassName: true strictMode: true + securityContexts: true image: ## @param global.spire.image.registry Override all Spire image registries at once diff --git a/examples/openshift/openshift-values.yaml b/examples/openshift/openshift-values.yaml index 7b219c0..d0d01d3 100644 --- a/examples/openshift/openshift-values.yaml +++ b/examples/openshift/openshift-values.yaml @@ -14,34 +14,3 @@ global: pod-security.kubernetes.io/enforce: privileged pod-security.kubernetes.io/warn: privileged pod-security.kubernetes.io/audit: privileged - -spire-server: - podSecurityContext: - # These are unset so that openshift can automatically assign its own restricted uids to the pods - runAsUser: null - runAsGroup: null - fsGroup: null - -spire-agent: - podSecurityContext: - runAsUser: null - runAsGroup: null - fsGroup: null - -upstream-spire-agent: - podSecurityContext: - runAsUser: null - runAsGroup: null - fsGroup: null - -spiffe-oidc-discovery-provider: - podSecurityContext: - runAsUser: null - runAsGroup: null - fsGroup: null - -tornjak-frontend: - podSecurityContext: - runAsUser: null - runAsGroup: null - fsGroup: null diff --git a/examples/production/values.yaml b/examples/production/values.yaml index ca6b116..a62e661 100644 --- a/examples/production/values.yaml +++ b/examples/production/values.yaml @@ -13,29 +13,6 @@ spire-server: notifier: k8sbundle: namespace: spire-system - podSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: OnRootMismatch - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - seccompProfile: - type: RuntimeDefault - - controllerManager: - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - seccompProfile: - type: RuntimeDefault spiffe-csi-driver: namespaceOverride: spire-system @@ -49,63 +26,11 @@ spire-agent: name: spire-agent server: namespaceOverride: spire-server - podSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - seccompProfile: - type: RuntimeDefault upstream-spire-agent: namespaceOverride: spire-system - podSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - seccompProfile: - type: RuntimeDefault spiffe-oidc-discovery-provider: enabled: true insecureScheme: enabled: true - podSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: OnRootMismatch - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - seccompProfile: - type: RuntimeDefault - -tornjak-frontend: - podSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: OnRootMismatch - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - seccompProfile: - type: RuntimeDefault