Repository navigation
Conversation
Only the server pod had a configurable security context (podSecurityContext). The containers, the email cron job and the GPG and JWT key jobs had none, and the cron job hardcoded runAsUser and fsGroup, so a namespace could not satisfy the Pod Security Admission "restricted" profile without patching the rendered manifests. Add, all empty by default: - containerSecurityContext: containers running the passbolt image (server, email cron job, GPG and JWT key jobs) - app.cache.redis.sentinelProxy.securityContext: redisproxy sidecar in the server and email cron job pods - app.databaseInitContainer.securityContext: database init container - cronJobEmail.podSecurityContext, jobCreateGpgKeys.podSecurityContext, jobCreateJwtKeys.podSecurityContext: pod-level contexts of the jobs When cronJobEmail.podSecurityContext is empty the cron job keeps runAsUser: 33 and fsGroup: 33, so the rendered output is unchanged for existing installs apart from the key order of that block. Refs passbolt#129
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds values to set security contexts on every workload the chart renders. Only the server pod had one (
podSecurityContext); the containers, the email cron job and the GPG/JWT key jobs had none, and the cron job hardcodedrunAsUser: 33/fsGroup: 33. A namespace enforcing the Pod Security Admissionrestrictedprofile therefore cannot run the chart without patching the rendered manifests (the approach described in #129).New values, all empty by default:
containerSecurityContextproc-emailcron job, GPG and JWT key jobsapp.cache.redis.sentinelProxy.securityContextredisproxysidecar (server and cron job pods)app.databaseInitContainer.securityContextcronJobEmail.podSecurityContextjobCreateGpgKeys.podSecurityContext,jobCreateJwtKeys.podSecurityContextWhen
cronJobEmail.podSecurityContextis empty the cron job still getsrunAsUser: 33andfsGroup: 33(the default lives in the template, not invalues.yaml, because Helm would otherwise merge a user value into it andfsGroupcould not be removed). A value set there replaces the default.Refs #129. That issue also asks for defaults; this PR keeps every default empty so existing installs render the same, and leaves choosing defaults to the maintainers.
Compatibility
No behaviour change with default values. Rendering with
tests/values-test.yamlbefore and after differs in the cron job only by key order inside itssecurityContext(fsGroupnow precedesrunAsUser, becausetoYamlsorts keys). WithOpenshift: truethe render is identical.Tests
tests/security_context_test.yaml: 10 cases covering the defaults (no container context, cron job keeps 33/33), each new value on each workload, the cron job override replacing the default, and the OpenShift case.helm unittest .: 31 suites, 106 tests pass.helm lint .passes.I have not run the changed chart on a cluster with these values applied. For reference, the
5.16.0-1-ce-non-rootimage runssupervisordas uid 33 with no effective capabilities, soallowPrivilegeEscalation: false,capabilities.drop: [ALL]andseccompProfile: RuntimeDefaultare what I would expect to work; I would treat that as unconfirmed until someone runs it.