panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add recommendation for securityContext and podSecurityContext (#125)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
2023-12-19 11:26:26 +00:00
committed by GitHub
co-authored by Marco Franssen
parent 50c4ac35b0
commit 6997d6a904
21 changed files with 106 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+1
View File
@@ -161,6 +161,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` | | `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
| `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` | | `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` |
| `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` | | `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` |
| `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` |
| `global.spire.image.registry` | Override all Spire image registries at once | `""` | | `global.spire.image.registry` | Override all Spire image registries at once | `""` |
| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` | | `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` |
| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` | | `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+4 -4
View File
@@ -33,11 +33,11 @@ spec:
{{- end }} {{- end }}
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers: containers:
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- include "spire-lib.securitycontext" . | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: args:
@@ -76,7 +76,7 @@ spec:
{{- if .Values.insecureScheme.enabled }} {{- if .Values.insecureScheme.enabled }}
- name: nginx - name: nginx
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- include "spire-lib.securitycontext" . | nindent 12 }}
image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }} imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
ports: ports:
@@ -98,7 +98,7 @@ spec:
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
- name: nginx-exporter - name: nginx-exporter
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- include "spire-lib.securitycontext" . | nindent 12 }}
image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }} imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
args: args:
charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml
+2 -2
View File
@@ -59,11 +59,11 @@ spec:
restartPolicy: Never restartPolicy: Never
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers: containers:
- name: pre-delete-job - name: pre-delete-job
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args: args:
- delete - delete
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+5 -5
View File
@@ -14,26 +14,26 @@ metadata:
"helm.sh/hook": test "helm.sh/hook": test
spec: spec:
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 4 }} {{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
containers: containers:
- name: curl-service-name - name: curl-service-name
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
- name: curl-service-name-namespace - name: curl-service-name-namespace
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
- name: curl-service-name-namespace-svc-cluster-local - name: curl-service-name-namespace-svc-cluster-local
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- if .Values.ingress.enabled }} {{- if .Values.ingress.enabled }}
- name: curl-ingress - name: curl-ingress
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
@@ -53,7 +53,7 @@ spec:
args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration'] args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration']
{{- end }} {{- end }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- end }} {{- end }}
{{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }} {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
hostAliases: hostAliases:
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml
+4 -12
View File
@@ -8,10 +8,8 @@ metadata:
annotations: annotations:
"helm.sh/hook": test "helm.sh/hook": test
spec: spec:
{{- with .Values.podSecurityContext }}
securityContext: securityContext:
{{- toYaml . | nindent 4 }} {{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
{{- end }}
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
initContainers: initContainers:
- name: static-busybox - name: static-busybox
@@ -22,10 +20,8 @@ spec:
- | - |
cp /bin/busybox /data/busybox cp /bin/busybox /data/busybox
chmod +x /data/busybox chmod +x /data/busybox
{{- with .Values.securityContext }}
securityContext: securityContext:
{{- toYaml . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- end }}
volumeMounts: volumeMounts:
- name: data-volume - name: data-volume
mountPath: /data mountPath: /data
@@ -41,10 +37,8 @@ spec:
[ $? -eq 0 ] && break [ $? -eq 0 ] && break
sleep 1 sleep 1
done done
{{- with .Values.securityContext }}
securityContext: securityContext:
{{- toYaml . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- end }}
volumeMounts: volumeMounts:
- name: data-volume - name: data-volume
mountPath: /data mountPath: /data
@@ -69,10 +63,8 @@ spec:
{{- (.Files.Get "files/test/jwt-decode.sh") | nindent 10 }} {{- (.Files.Get "files/test/jwt-decode.sh") | nindent 10 }}
EOF EOF
bash /data/jwt-decode.sh "${URL}"/keys "${JWT}" bash /data/jwt-decode.sh "${URL}"/keys "${JWT}"
{{- with .Values.securityContext }}
securityContext: securityContext:
{{- toYaml . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- end }}
volumeMounts: volumeMounts:
- mountPath: /data - mountPath: /data
name: data-volume name: data-volume
charts/spire/charts/spire-agent/templates/daemonset.yaml
+4 -3
View File
@@ -1,4 +1,5 @@
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
{{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }} {{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }}
apiVersion: apps/v1 apiVersion: apps/v1
kind: DaemonSet kind: DaemonSet
@@ -30,7 +31,7 @@ spec:
dnsPolicy: ClusterFirstWithHostNet dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }} serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- toYaml $podSecurityContext | nindent 8 }}
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }} {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
{{- if ne (len .Values.hostAliases) 0 }} {{- if ne (len .Values.hostAliases) 0 }}
hostAliases: hostAliases:
@@ -46,13 +47,13 @@ spec:
args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}] args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
resources: resources:
{{- toYaml .Values.waitForIt.resources | nindent 12 }} {{- toYaml .Values.waitForIt.resources | nindent 12 }}
{{- if gt (int (dig "fsGroup" 0 .Values.podSecurityContext)) 0 }} {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }}
- name: fsgroupfix - name: fsgroupfix
image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }} imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
command: ["bash", "-c"] command: ["bash", "-c"]
args: args:
- "chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}" - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}"
resources: resources:
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }} {{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
volumeMounts: volumeMounts:
charts/spire/charts/spire-server/README.md
+1
View File
@@ -303,6 +303,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | | `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | | `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
| `tornjak.resources` | Resource requests and limits | `{}` | | `tornjak.resources` | Resource requests and limits | `{}` |
| `tornjak.securityContext` | Security Context to use | `{}` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | | `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | | `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+2 -2
View File
@@ -59,11 +59,11 @@ spec:
restartPolicy: Never restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers: containers:
- name: post-install-job - name: post-install-job
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args: args:
- patch - patch
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+2 -2
View File
@@ -59,11 +59,11 @@ spec:
restartPolicy: Never restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers: containers:
- name: post-upgrade-job - name: post-upgrade-job
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args: args:
- patch - patch
charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
+3 -3
View File
@@ -63,11 +63,11 @@ spec:
restartPolicy: Never restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers: containers:
- name: pre-delete-job - name: pre-delete-job
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args: args:
- delete - delete
@@ -78,7 +78,7 @@ spec:
- --wait - --wait
- name: pre-delete-check - name: pre-delete-check
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args: args:
- wait - wait
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+2 -2
View File
@@ -59,11 +59,11 @@ spec:
restartPolicy: Never restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers: containers:
- name: post-install-job - name: post-install-job
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args: args:
- patch - patch
charts/spire/charts/spire-server/templates/statefulset.yaml
+5 -5
View File
@@ -47,14 +47,14 @@ spec:
serviceAccountName: {{ include "spire-server.serviceAccountName" . }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
shareProcessNamespace: true shareProcessNamespace: true
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
{{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }} {{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
initContainers: initContainers:
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
- name: wait - name: wait
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- include "spire-lib.securitycontext" . | nindent 12 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args: args:
- wait - wait
@@ -73,7 +73,7 @@ spec:
containers: containers:
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- include "spire-lib.securitycontext" . | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: args:
@@ -187,7 +187,7 @@ spec:
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
- name: spire-controller-manager - name: spire-controller-manager
securityContext: securityContext:
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }} {{- include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.controllerManager.securityContext) | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }} imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
args: args:
@@ -228,7 +228,7 @@ spec:
{{- if eq (.Values.tornjak.enabled | toString) "true" }} {{- if eq (.Values.tornjak.enabled | toString) "true" }}
- name: tornjak - name: tornjak
securityContext: securityContext:
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }} {{- include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.tornjak.securityContext) | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" .Values.tornjak.image.defaultTag "image" .Values.tornjak.image "global" .Values.global "ubi" true) }} image: {{ template "spire-lib.image" (dict "appVersion" .Values.tornjak.image.defaultTag "image" .Values.tornjak.image "global" .Values.global "ubi" true) }}
imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }} imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
{{- if eq (include "spire-tornjak.connectionType" .) "http" }} {{- if eq (include "spire-tornjak.connectionType" .) "http" }}
charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+4 -4
View File
@@ -11,7 +11,7 @@ metadata:
"helm.sh/hook": test "helm.sh/hook": test
spec: spec:
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 4 }} {{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
containers: containers:
- name: curl - name: curl
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
@@ -30,14 +30,14 @@ spec:
fi fi
exit 1 exit 1
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- if eq (.Values.federation.enabled | toString) "true" }} {{- if eq (.Values.federation.enabled | toString) "true" }}
- name: curl-federation-bundle-endpoint - name: curl-federation-bundle-endpoint
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}'] args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- end }} {{- end }}
{{- if .Values.federation.ingress.enabled }} {{- if .Values.federation.ingress.enabled }}
- name: federation-ingress - name: federation-ingress
@@ -51,7 +51,7 @@ spec:
mountPath: /ca mountPath: /ca
{{- end }} {{- end }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- end }} {{- end }}
{{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }} {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
hostAliases: hostAliases:
charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
+3 -3
View File
@@ -12,20 +12,20 @@ metadata:
"helm.sh/hook": test "helm.sh/hook": test
spec: spec:
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 4 }} {{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
containers: containers:
- name: curl-tornjak-backend - name: curl-tornjak-backend
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/tornjak/serverinfo'] args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/tornjak/serverinfo']
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
- name: curl-tornjak-backend-and-spire - name: curl-tornjak-backend-and-spire
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/healthcheck'] args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/healthcheck']
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
restartPolicy: Never restartPolicy: Never
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/values.yaml
+3
View File
@@ -708,6 +708,9 @@ tornjak:
# cpu: 100m # cpu: 100m
# memory: 128Mi # memory: 128Mi
## @param tornjak.securityContext [object] Security Context to use
securityContext: {}
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart. # NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we # Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
# can prioritize proper support. # can prioritize proper support.
charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+2 -2
View File
@@ -21,13 +21,13 @@ spec:
{{- end }} {{- end }}
serviceAccountName: {{ include "tornjak-frontend.serviceAccountName" . }} serviceAccountName: {{ include "tornjak-frontend.serviceAccountName" . }}
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers: containers:
- name: {{ include "tornjak-frontend.fullname" . }} - name: {{ include "tornjak-frontend.fullname" . }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global "ubi" true) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global "ubi" true) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- include "spire-lib.securitycontext" . | nindent 12 }}
ports: ports:
- name: http - name: http
containerPort: 3000 containerPort: 3000
charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml
+2 -2
View File
@@ -9,13 +9,13 @@ metadata:
"helm.sh/hook": test "helm.sh/hook": test
spec: spec:
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 4 }} {{- include "spire-lib.podsecuritycontext" . | nindent 4 }}
containers: containers:
- name: curl-tornjak-frontend - name: curl-tornjak-frontend
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-k', '-s', '-f', 'http://{{ include "tornjak-frontend.fullname" . }}.{{ include "tornjak-frontend.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/tornjak/serverinfo'] args: ['-k', '-s', '-f', 'http://{{ include "tornjak-frontend.fullname" . }}.{{ include "tornjak-frontend.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/tornjak/serverinfo']
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
restartPolicy: Never restartPolicy: Never
charts/spire/templates/_spire-lib.tpl
+55
View File
@@ -248,6 +248,61 @@ to merge in values, but spire needs arrays.
{{- $config | toPrettyJson }} {{- $config | toPrettyJson }}
{{- end }} {{- end }}
{{- define "spire-lib.default_securitycontext_values" }}
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
{{- end }}
{{- define "spire-lib.default_k8s_podsecuritycontext_values" }}
fsGroupChangePolicy: OnRootMismatch
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
{{- end }}
{{/*
Note: runAsUser, runAsGroup, fsGroup, are not needed due to it autoassigning restricted users feature of openshift
*/}}
{{- define "spire-lib.default_openshift_podsecuritycontext_values" }}
fsGroupChangePolicy: OnRootMismatch
{{- end }}
{{- define "spire-lib.securitycontext" }}
{{ include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.securityContext) }}
{{- end }}
{{/* Same as securitycontext but takes in:
root - global . context for the chart
securityContext - the subbranch of values that contains the securityContext to merge
*/}}
{{- define "spire-lib.securitycontext-extended" }}
{{- if and (dig "spire" "recommendations" "enabled" false .root.Values.global) (dig "spire" "recommendations" "securityContexts" true .root.Values.global) }}
{{- $vals := deepCopy (include "spire-lib.default_securitycontext_values" .root | fromYaml) }}
{{- $vals = mergeOverwrite $vals .securityContext }}
{{- toYaml $vals }}
{{- else }}
{{- toYaml .securityContext }}
{{- end }}
{{- end }}
{{- define "spire-lib.podsecuritycontext" }}
{{- $vals := dict }}
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "securityContexts" true .Values.global) }}
{{- if (dig "openshift" false .Values.global) }}
{{- $vals = mergeOverwrite $vals (include "spire-lib.default_openshift_podsecuritycontext_values" . | fromYaml) }}
{{- else }}
{{- $vals = mergeOverwrite $vals (include "spire-lib.default_k8s_podsecuritycontext_values" . | fromYaml) }}
{{- end }}
{{- end }}
{{- $vals = mergeOverwrite $vals .Values.podSecurityContext }}
{{- toYaml $vals }}
{{- end }}
{{- define "spire-lib.default_node_priority_class_name" }} {{- define "spire-lib.default_node_priority_class_name" }}
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }}
charts/spire/values.yaml
+2
View File
@@ -24,10 +24,12 @@ global:
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off. ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
recommendations: recommendations:
enabled: false enabled: false
priorityClassName: true priorityClassName: true
strictMode: true strictMode: true
securityContexts: true
image: image:
## @param global.spire.image.registry Override all Spire image registries at once ## @param global.spire.image.registry Override all Spire image registries at once
examples/openshift/openshift-values.yaml
-31
View File
@@ -14,34 +14,3 @@ global:
pod-security.kubernetes.io/enforce: privileged pod-security.kubernetes.io/enforce: privileged
pod-security.kubernetes.io/warn: privileged pod-security.kubernetes.io/warn: privileged
pod-security.kubernetes.io/audit: privileged pod-security.kubernetes.io/audit: privileged
spire-server:
podSecurityContext:
# These are unset so that openshift can automatically assign its own restricted uids to the pods
runAsUser: null
runAsGroup: null
fsGroup: null
spire-agent:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
upstream-spire-agent:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
spiffe-oidc-discovery-provider:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
tornjak-frontend:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
examples/production/values.yaml
-75
View File
@@ -13,29 +13,6 @@ spire-server:
notifier: notifier:
k8sbundle: k8sbundle:
namespace: spire-system namespace: spire-system
podSecurityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
controllerManager:
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
spiffe-csi-driver: spiffe-csi-driver:
namespaceOverride: spire-system namespaceOverride: spire-system
@@ -49,63 +26,11 @@ spire-agent:
name: spire-agent name: spire-agent
server: server:
namespaceOverride: spire-server namespaceOverride: spire-server
podSecurityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
upstream-spire-agent: upstream-spire-agent:
namespaceOverride: spire-system namespaceOverride: spire-system
podSecurityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
enabled: true enabled: true
insecureScheme: insecureScheme:
enabled: true enabled: true
podSecurityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
tornjak-frontend:
podSecurityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault