Allow for SPIRE Agent to run as non root user (#209)

Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>

charts/spire/README.md

@@ -226,6 +226,12 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-agent.extraContainers | list | `[]` |  |
 | spire-agent.extraVolumeMounts | list | `[]` |  |
 | spire-agent.extraVolumes | list | `[]` |  |
+| spire-agent.fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy |
+| spire-agent.fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
+| spire-agent.fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry |
+| spire-agent.fsGroupFix.image.tag | string | `"latest-20230517"` | Overrides the image tag |
+| spire-agent.fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
+| spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
 | spire-agent.fullnameOverride | string | `""` |  |
 | spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking |
 | spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |

charts/spire/charts/spire-agent/README.md

@@ -35,6 +35,12 @@ A Helm chart to install the SPIRE agent.
 | extraContainers | list | `[]` |  |
 | extraVolumeMounts | list | `[]` |  |
 | extraVolumes | list | `[]` |  |
+| fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy |
+| fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
+| fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry |
+| fsGroupFix.image.tag | string | `"latest-20230517"` | Overrides the image tag |
+| fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
+| fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
 | fullnameOverride | string | `""` |  |
 | healthChecks.port | int | `9980` | override the host port used for health checking |
 | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -43,6 +43,22 @@ spec:
           args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
           resources:
             {{- toYaml .Values.waitForIt.resources | nindent 12 }}
+        {{- if gt (int (dig "fsGroup" 0 .Values.podSecurityContext)) 0 }}
+        - name: fsgroupfix
+          image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }}
+          imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
+          command: ["bash", "-c"]
+          args:
+            - "chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}"
+          resources:
+            {{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
+          volumeMounts:
+            - name: spire-agent-socket-dir
+              mountPath: {{ include "spire-agent.socket-path" . | dir }}
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+        {{- end }}
         {{- if gt (len .Values.initContainers) 0 }}
         {{- toYaml .Values.initContainers | nindent 8 }}
         {{- end }}

charts/spire/charts/spire-agent/values.yaml

@@ -109,6 +109,23 @@ waitForIt:
     tag: latest-20230517
   resources: {}
 
+# When running as non root, needed to ensure the socket path has the correct permissions.
+# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
+fsGroupFix:
+  image:
+    # -- The OCI registry to pull the image from
+    registry: cgr.dev
+    # -- The repository within the registry
+    repository: chainguard/bash
+    # -- The image pull policy
+    pullPolicy: Always
+    # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+    version: ""
+    # -- Overrides the image tag
+    tag: latest-20230517
+  # -- Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+  resources: {}
+
 # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
 workloadAttestors:
   # unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.

examples/production/values.yaml

@@ -54,6 +54,18 @@ spire-agent:
   server:
     namespaceOverride: spire-server
   priorityClassName: system-node-critical
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
 
   logLevel: info