panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add recommendation for namespacePSS (#131)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
2023-12-21 00:15:56 +00:00
committed by GitHub
co-authored by Marco Franssen
parent 0555c87eef
commit c39dd44526
5 changed files with 45 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+2
View File
@@ -160,11 +160,13 @@ Now you can interact with the Spire agent socket from your own application. The
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | | `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` | | `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` | | `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` |
| `global.spire.recommendations.namespacePSS` | When chart namespace creation is enabled, label them with preffered Pod Security Standard labels | `true` |
| `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` | | `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` |
| `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` | | `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` |
| `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` | | `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` |
| `global.spire.recommendations.prometheus` | Enable prometheus exporters for monitoring | `true` | | `global.spire.recommendations.prometheus` | Enable prometheus exporters for monitoring | `true` |
| `global.spire.image.registry` | Override all Spire image registries at once | `""` | | `global.spire.image.registry` | Override all Spire image registries at once | `""` |
| `global.spire.namespaces.create` | Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created. | `false` |
| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` | | `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` |
| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` | | `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` |
| `global.spire.namespaces.system.annotations` | Annotations to apply to the Spire system Namespace. | `{}` | | `global.spire.namespaces.system.annotations` | Annotations to apply to the Spire system Namespace. | `{}` |
charts/spire/templates/spire-server-namespace.yaml
+21 -5
View File
@@ -1,14 +1,30 @@
{{- if .Values.global.spire.namespaces.server.create }} {{- define "spire.namespace.default_server_labels" }}
"pod-security.kubernetes.io/warn": restricted
"pod-security.kubernetes.io/audit": restricted
"pod-security.kubernetes.io/enforce": restricted
{{- end }}
{{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.server.create }}
{{- $labels := dict }}
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }}
{{- $labels = mergeOverwrite $labels (include "spire.namespace.default_server_labels" . | fromYaml) }}
{{- if (dig "openshift" false .Values.global) }}
{{- $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }}
{{- if (index .Values "spiffe-oidc-discovery-provider").enabled }}
{{- $_ := set $labels "pod-security.kubernetes.io/enforce" "privileged" }}
{{- end }}
{{- end }}
{{- end }}
{{- $labels = mergeOverwrite $labels .Values.global.spire.namespaces.server.labels }}
apiVersion: v1 apiVersion: v1
kind: Namespace kind: Namespace
metadata: metadata:
name: {{ .Values.global.spire.namespaces.server.name }} name: {{ .Values.global.spire.namespaces.server.name }}
{{- if .Values.global.spire.namespaces.server.labels }} {{- with $labels }}
labels: labels:
{{- .Values.global.spire.namespaces.server.labels | toYaml | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- if .Values.global.spire.namespaces.server.annotations }} {{- with .Values.global.spire.namespaces.server.annotations }}
annotations: annotations:
{{- .Values.global.spire.namespaces.server.annotations | toYaml | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/templates/spire-system-namespace.yaml
+18 -5
View File
@@ -1,14 +1,27 @@
{{- if .Values.global.spire.namespaces.system.create }} {{- define "spire.namespace.default_system_labels" }}
"pod-security.kubernetes.io/warn": privileged
"pod-security.kubernetes.io/audit": privileged
"pod-security.kubernetes.io/enforce": privileged
{{- end }}
{{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.system.create }}
{{- $labels := dict }}
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }}
{{- $labels = mergeOverwrite $labels (include "spire.namespace.default_system_labels" . | fromYaml) }}
{{- if (dig "openshift" false .Values.global) }}
{{- $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }}
{{- end }}
{{- end }}
{{- $labels = mergeOverwrite $labels .Values.global.spire.namespaces.server.labels }}
apiVersion: v1 apiVersion: v1
kind: Namespace kind: Namespace
metadata: metadata:
name: {{ .Values.global.spire.namespaces.system.name }} name: {{ .Values.global.spire.namespaces.system.name }}
{{- if .Values.global.spire.namespaces.system.labels }} {{- with $labels }}
labels: labels:
{{- .Values.global.spire.namespaces.system.labels | toYaml | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- if .Values.global.spire.namespaces.system.annotations }} {{- with .Values.global.spire.namespaces.system.annotations }}
annotations: annotations:
{{- .Values.global.spire.namespaces.system.annotations | toYaml | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/values.yaml
+4
View File
@@ -23,6 +23,7 @@ global:
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off. ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces ## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts ## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
@@ -30,6 +31,7 @@ global:
recommendations: recommendations:
enabled: false enabled: false
namespaceLayout: true namespaceLayout: true
namespacePSS: true
priorityClassName: true priorityClassName: true
strictMode: true strictMode: true
securityContexts: true securityContexts: true
@@ -40,6 +42,8 @@ global:
registry: "" registry: ""
namespaces: namespaces:
## @param global.spire.namespaces.create Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created.
create: false
system: system:
## @param global.spire.namespaces.system.name Name of the Spire system Namespace. ## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
name: "spire-system" name: "spire-system"
examples/openshift/openshift-values.yaml
-14
View File
@@ -1,16 +1,2 @@
global: global:
openshift: true openshift: true
spire:
namespaces:
system:
labels:
security.openshift.io/scc.podSecurityLabelSync: "false"
pod-security.kubernetes.io/enforce: privileged
pod-security.kubernetes.io/warn: privileged
pod-security.kubernetes.io/audit: privileged
server:
labels:
security.openshift.io/scc.podSecurityLabelSync: "false"
pod-security.kubernetes.io/enforce: privileged
pod-security.kubernetes.io/warn: privileged
pod-security.kubernetes.io/audit: privileged