panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add recommendation for securityContext and podSecurityContext (#125)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
2023-12-19 11:26:26 +00:00
committed by GitHub
co-authored by Marco Franssen
parent 50c4ac35b0
commit 6997d6a904
21 changed files with 106 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1
View File
@@ -303,6 +303,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
| `tornjak.resources` | Resource requests and limits | `{}` |
| `tornjak.securityContext` | Security Context to use | `{}` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+2 -2
View File
@@ -59,11 +59,11 @@ spec:
restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+2 -2
View File
@@ -59,11 +59,11 @@ spec:
restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers:
- name: post-upgrade-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
+3 -3
View File
@@ -63,11 +63,11 @@ spec:
restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers:
- name: pre-delete-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- delete
@@ -78,7 +78,7 @@ spec:
- --wait
- name: pre-delete-check
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- wait
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+2 -2
View File
@@ -59,11 +59,11 @@ spec:
restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
charts/spire/charts/spire-server/templates/statefulset.yaml
+5 -5
View File
@@ -47,14 +47,14 @@ spec:
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
shareProcessNamespace: true
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
{{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
initContainers:
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
- name: wait
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
{{- include "spire-lib.securitycontext" . | nindent 12 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- wait
@@ -73,7 +73,7 @@ spec:
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
{{- include "spire-lib.securitycontext" . | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
@@ -187,7 +187,7 @@ spec:
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
- name: spire-controller-manager
securityContext:
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
{{- include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.controllerManager.securityContext) | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
args:
@@ -228,7 +228,7 @@ spec:
{{- if eq (.Values.tornjak.enabled | toString) "true" }}
- name: tornjak
securityContext:
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
{{- include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.tornjak.securityContext) | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" .Values.tornjak.image.defaultTag "image" .Values.tornjak.image "global" .Values.global "ubi" true) }}
imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+4 -4
View File
@@ -11,7 +11,7 @@ metadata:
"helm.sh/hook": test
spec:
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 4 }}
{{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
containers:
- name: curl
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
@@ -30,14 +30,14 @@ spec:
fi
exit 1
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- if eq (.Values.federation.enabled | toString) "true" }}
- name: curl-federation-bundle-endpoint
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl']
args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- end }}
{{- if .Values.federation.ingress.enabled }}
- name: federation-ingress
@@ -51,7 +51,7 @@ spec:
mountPath: /ca
{{- end }}
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- end }}
{{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
hostAliases:
charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
+3 -3
View File
@@ -12,20 +12,20 @@ metadata:
"helm.sh/hook": test
spec:
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 4 }}
{{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
containers:
- name: curl-tornjak-backend
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl']
args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/tornjak/serverinfo']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- include "spire-lib.securitycontext" . | nindent 8 }}
- name: curl-tornjak-backend-and-spire
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl']
args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/healthcheck']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- include "spire-lib.securitycontext" . | nindent 8 }}
restartPolicy: Never
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+3
View File
@@ -708,6 +708,9 @@ tornjak:
# cpu: 100m
# memory: 128Mi
## @param tornjak.securityContext [object] Security Context to use
securityContext: {}
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
# can prioritize proper support.