From b6716aee177243f37401eee5a0350d569cf6f26d Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Sat, 11 Mar 2023 03:11:19 -0800
Subject: [PATCH] Test that it is possible to lock down security of pods (#84)

---
 .github/tests/lockdown/deps-values.yaml | 54 +++++++++++++++++++++++++
 .github/tests/lockdown/pre-install.sh   |  5 +++
 .github/tests/lockdown/values.yaml      | 20 +++++++++
 3 files changed, 79 insertions(+)
 create mode 100644 .github/tests/lockdown/deps-values.yaml
 create mode 100755 .github/tests/lockdown/pre-install.sh
 create mode 100644 .github/tests/lockdown/values.yaml

diff --git a/.github/tests/lockdown/deps-values.yaml b/.github/tests/lockdown/deps-values.yaml
new file mode 100644
index 0000000..acbe67e
--- /dev/null
+++ b/.github/tests/lockdown/deps-values.yaml
@@ -0,0 +1,54 @@
+global:
+  telemetry:
+    prometheus:
+      enabled: true
+
+spiffe-csi-driver:
+  enabled: false
+
+spire-agent:
+  enabled: false
+
+spiffe-oidc-discovery-provider:
+  enabled: true
+  insecureScheme:
+    enabled: true
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
+
+spire-server:
+  nodeAttestor:
+    k8sPsat:
+      serviceAccountAllowList: ["lockdown:spire-agent"]
+  notifier:
+    k8sbundle:
+      namespace: lockdown
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
+  controllerManager:
+    securityContext:
+      allowPrivilegeEscalation: false
+      runAsNonRoot: true
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: [ALL]
+      seccompProfile:
+        type: RuntimeDefault
diff --git a/.github/tests/lockdown/pre-install.sh b/.github/tests/lockdown/pre-install.sh
new file mode 100755
index 0000000..e2eb28a
--- /dev/null
+++ b/.github/tests/lockdown/pre-install.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+kubectl label namespace "$scenario" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "${scenario}-deps"
+kubectl label namespace "${scenario}-deps" pod-security.kubernetes.io/enforce=restricted
+helm install -n "${scenario}-deps" spire -f "${TEST_DIR}"/deps-values.yaml
diff --git a/.github/tests/lockdown/values.yaml b/.github/tests/lockdown/values.yaml
new file mode 100644
index 0000000..182e582
--- /dev/null
+++ b/.github/tests/lockdown/values.yaml
@@ -0,0 +1,20 @@
+global:
+  telemetry:
+    prometheus:
+      enabled: true
+
+spiffe-csi-driver:
+  enabled: true
+
+spire-agent:
+  enabled: true
+  serviceAccount:
+    name: spire-agent
+  server:
+    address: spire-server.lockdown-deps
+
+spiffe-oidc-discovery-provider:
+  enabled: false
+
+spire-server:
+  enabled: false