Skip to content

Commit 0e0b6a6

Browse files
becitstherebecitsthere
committed
NVSHAS-8497: Run controller in non-priv mode
1 parent 541ba44 commit 0e0b6a6

File tree

5 files changed

+226
-14
lines changed

5 files changed

+226
-14
lines changed

‎charts/core/templates/controller-deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- $pre530 := (semverCompare "<5.2.10" .Values.tag) -}}
12
{{- if .Values.controller.enabled -}}
23
{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
34
apiVersion: apps/v1
@@ -96,8 +97,13 @@ spec:
9697
{{- end }}
9798
{{- end }}
9899
{{- end }}
100+
{{- if $pre530 }}
99101
securityContext:
100102
privileged: true
103+
{{- else }}
104+
securityContext:
105+
runAsUser: 0
106+
{{- end }}
101107
resources:
102108
{{- if .Values.controller.resources }}
103109
{{ toYaml .Values.controller.resources | indent 12 }}
@@ -153,6 +159,7 @@ spec:
153159
name: nv-share
154160
readOnly: false
155161
{{- end }}
162+
{{- if $pre530 }}
156163
{{- if .Values.containerd.enabled }}
157164
- mountPath: /var/run/containerd/containerd.sock
158165
{{- else if .Values.k3s.enabled }}
@@ -172,6 +179,7 @@ spec:
172179
- mountPath: /host/cgroup
173180
name: cgroup-vol
174181
readOnly: true
182+
{{- end }}
175183
- mountPath: /etc/config
176184
name: config-volume
177185
readOnly: true
@@ -224,6 +232,7 @@ spec:
224232
readOnly: false
225233
{{- end }}
226234
{{- end }}
235+
{{- if $pre530 }}
227236
- name: runtime-sock
228237
hostPath:
229238
{{- if .Values.containerd.enabled }}
@@ -243,6 +252,7 @@ spec:
243252
- name: cgroup-vol
244253
hostPath:
245254
path: /sys/fs/cgroup
255+
{{- end }}
246256
- name: config-volume
247257
projected:
248258
sources:

‎charts/core/templates/enforcer-daemonset.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- $pre530 := (semverCompare "<5.2.10" .Values.tag) -}}
12
{{- if .Values.enforcer.enabled -}}
23
{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
34
apiVersion: apps/v1
@@ -91,6 +92,7 @@ spec:
9192
{{- toYaml . | nindent 12 }}
9293
{{- end }}
9394
volumeMounts:
95+
{{- if $pre530 }}
9496
{{- if .Values.containerd.enabled }}
9597
- mountPath: /var/run/containerd/containerd.sock
9698
{{- else if .Values.k3s.enabled }}
@@ -110,6 +112,7 @@ spec:
110112
- mountPath: /host/cgroup
111113
name: cgroup-vol
112114
readOnly: true
115+
{{- end }}
113116
- mountPath: /lib/modules
114117
name: modules-vol
115118
readOnly: true
@@ -133,6 +136,7 @@ spec:
133136
terminationGracePeriodSeconds: 1200
134137
restartPolicy: Always
135138
volumes:
139+
{{- if $pre530 }}
136140
- name: runtime-sock
137141
hostPath:
138142
{{- if .Values.containerd.enabled }}
@@ -152,6 +156,7 @@ spec:
152156
- name: cgroup-vol
153157
hostPath:
154158
path: /sys/fs/cgroup
159+
{{- end }}
155160
- name: modules-vol
156161
hostPath:
157162
path: /lib/modules

‎charts/core/templates/psp.yaml

Lines changed: 77 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,6 @@ roleRef:
7272
name: neuvector-binding-psp
7373
subjects:
7474
{{- if .Values.leastPrivilege }}
75-
- kind: ServiceAccount
76-
name: controller
77-
namespace: {{ .Release.Namespace }}
7875
- kind: ServiceAccount
7976
name: enforcer
8077
namespace: {{ .Release.Namespace }}
@@ -83,4 +80,81 @@ subjects:
8380
name: {{ .Values.serviceAccount }}
8481
namespace: {{ .Release.Namespace }}
8582
{{- end }}
83+
84+
{{- if .Values.leastPrivilege }}
85+
---
86+
apiVersion: policy/v1beta1
87+
kind: PodSecurityPolicy
88+
metadata:
89+
name: neuvector-binding-psp-controller
90+
labels:
91+
chart: {{ template "neuvector.chart" . }}
92+
heritage: Helm
93+
release: {{ .Release.Name }}
94+
spec:
95+
privileged: false
96+
readOnlyRootFilesystem: false
97+
allowPrivilegeEscalation: false
98+
allowedCapabilities: null
99+
requiredDropCapabilities:
100+
- ALL
101+
volumes:
102+
- configMap
103+
- downwardAPI
104+
- emptyDir
105+
- persistentVolumeClaim
106+
- azureFile
107+
- projected
108+
- secret
109+
hostNetwork: false
110+
hostIPC: false
111+
hostPID: false
112+
runAsUser:
113+
rule: 'RunAsAny'
114+
seLinux:
115+
rule: 'RunAsAny'
116+
supplementalGroups:
117+
rule: 'RunAsAny'
118+
fsGroup:
119+
rule: 'RunAsAny'
120+
---
121+
apiVersion: rbac.authorization.k8s.io/v1
122+
kind: Role
123+
metadata:
124+
name: neuvector-binding-psp-controller
125+
namespace: {{ .Release.Namespace }}
126+
labels:
127+
chart: {{ template "neuvector.chart" . }}
128+
heritage: Helm
129+
release: {{ .Release.Name }}
130+
rules:
131+
- apiGroups:
132+
- policy
133+
- extensions
134+
resources:
135+
- podsecuritypolicies
136+
verbs:
137+
- use
138+
resourceNames:
139+
- neuvector-binding-psp-controller
140+
---
141+
apiVersion: rbac.authorization.k8s.io/v1
142+
kind: RoleBinding
143+
metadata:
144+
name: neuvector-binding-psp-controller
145+
namespace: {{ .Release.Namespace }}
146+
labels:
147+
chart: {{ template "neuvector.chart" . }}
148+
heritage: Helm
149+
release: {{ .Release.Name }}
150+
roleRef:
151+
apiGroup: rbac.authorization.k8s.io
152+
kind: Role
153+
name: neuvector-binding-psp-controller
154+
subjects:
155+
- kind: ServiceAccount
156+
name: controller
157+
namespace: {{ .Release.Namespace }}
158+
{{- end }}
159+
86160
{{- end }}

‎charts/core/templates/rolebinding-least.yaml

Lines changed: 77 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -62,15 +62,6 @@ subjects:
6262
- kind: ServiceAccount
6363
name: controller
6464
namespace: {{ .Release.Namespace }}
65-
- kind: ServiceAccount
66-
name: enforcer
67-
namespace: {{ .Release.Namespace }}
68-
- kind: ServiceAccount
69-
name: scanner
70-
namespace: {{ .Release.Namespace }}
71-
- kind: ServiceAccount
72-
name: registry-adapter
73-
namespace: {{ .Release.Namespace }}
7465
{{- if $oc3 }}
7566
userNames:
7667
- system:serviceaccount:{{ .Release.Namespace }}:controller
@@ -94,10 +85,85 @@ roleRef:
9485
name: system:openshift:scc:privileged
9586
subjects:
9687
- kind: ServiceAccount
97-
name: controller
88+
name: enforcer
9889
namespace: {{ .Release.Namespace }}
90+
91+
---
92+
93+
allowHostDirVolumePlugin: false
94+
allowHostIPC: false
95+
allowHostNetwork: false
96+
allowHostPID: false
97+
allowHostPorts: false
98+
allowPrivilegeEscalation: false
99+
allowPrivilegedContainer: false
100+
allowedCapabilities: null
101+
apiVersion: security.openshift.io/v1
102+
defaultAddCapabilities: null
103+
fsGroup:
104+
type: RunAsAny
105+
groups: []
106+
kind: SecurityContextConstraints
107+
metadata:
108+
name: neuvector-scc-controller
109+
priority: null
110+
readOnlyRootFilesystem: false
111+
requiredDropCapabilities:
112+
- ALL
113+
runAsUser:
114+
type: RunAsAny
115+
seLinuxContext:
116+
type: RunAsAny
117+
supplementalGroups:
118+
type: RunAsAny
119+
users: []
120+
volumes:
121+
- configMap
122+
- downwardAPI
123+
- emptyDir
124+
- persistentVolumeClaim
125+
- azureFile
126+
- projected
127+
- secret
128+
129+
---
130+
131+
apiVersion: rbac.authorization.k8s.io/v1
132+
kind: ClusterRole
133+
metadata:
134+
name: system:openshift:scc:neuvector-scc-controller
135+
labels:
136+
chart: {{ template "neuvector.chart" . }}
137+
release: {{ .Release.Name }}
138+
heritage: Helm
139+
rules:
140+
- apiGroups:
141+
- security.openshift.io
142+
resourceNames:
143+
- neuvector-scc-controller
144+
resources:
145+
- securitycontextconstraints
146+
verbs:
147+
- use
148+
149+
---
150+
151+
apiVersion: rbac.authorization.k8s.io/v1
152+
kind: RoleBinding
153+
metadata:
154+
name: system:openshift:scc:neuvector-scc-controller
155+
namespace: {{ .Release.Namespace }}
156+
labels:
157+
chart: {{ template "neuvector.chart" . }}
158+
release: {{ .Release.Name }}
159+
heritage: Helm
160+
roleRef:
161+
apiGroup: rbac.authorization.k8s.io
162+
kind: ClusterRole
163+
name: system:openshift:scc:neuvector-scc-controller
164+
subjects:
99165
- kind: ServiceAccount
100-
name: enforcer
166+
name: controller
101167
namespace: {{ .Release.Namespace }}
102168
{{- end }}
103169
{{- end }}

‎test/deployment_test.go

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,63 @@ func TestControllerDeployment(t *testing.T) {
3030
}
3131
}
3232

33+
func TestControllerDeploymentPre53(t *testing.T) {
34+
helmChartPath := "../charts/core"
35+
36+
options := &helm.Options{
37+
SetValues: map[string]string{
38+
"tag": "5.2.4",
39+
},
40+
}
41+
42+
// Test ingress
43+
out := helm.RenderTemplate(t, options, helmChartPath, nvRel, []string{"templates/controller-deployment.yaml"})
44+
outs := splitYaml(out)
45+
46+
if len(outs) != 1 {
47+
t.Errorf("Resource count is wrong. count=%v\n", len(outs))
48+
}
49+
50+
var dep appsv1.Deployment
51+
helm.UnmarshalK8SYaml(t, outs[0], &dep)
52+
if dep.Spec.Template.Spec.Containers[0].VolumeMounts[0].Name != "runtime-sock" {
53+
t.Errorf("VolumeMounts[0] is wrong, %v\n", dep.Spec.Template.Spec.Containers[0].VolumeMounts[0])
54+
}
55+
if *dep.Spec.Template.Spec.Containers[0].SecurityContext.Privileged != true {
56+
t.Errorf("Privileged is wrong, %v\n", *dep.Spec.Template.Spec.Containers[0].SecurityContext.Privileged)
57+
}
58+
}
59+
60+
func TestControllerDeploymentPost53(t *testing.T) {
61+
helmChartPath := "../charts/core"
62+
63+
options := &helm.Options{
64+
SetValues: map[string]string{
65+
"tag": "5.3.0",
66+
},
67+
}
68+
69+
// Test ingress
70+
out := helm.RenderTemplate(t, options, helmChartPath, nvRel, []string{"templates/controller-deployment.yaml"})
71+
outs := splitYaml(out)
72+
73+
if len(outs) != 1 {
74+
t.Errorf("Resource count is wrong. count=%v\n", len(outs))
75+
}
76+
77+
var dep appsv1.Deployment
78+
helm.UnmarshalK8SYaml(t, outs[0], &dep)
79+
if dep.Spec.Template.Spec.Containers[0].VolumeMounts[0].Name != "config-volume" {
80+
t.Errorf("VolumeMounts[0] is wrong, %v\n", dep.Spec.Template.Spec.Containers[0].VolumeMounts[0])
81+
}
82+
if dep.Spec.Template.Spec.Containers[0].SecurityContext.Privileged != nil {
83+
t.Errorf("SecurityContext.Privileged should be nil\n")
84+
}
85+
if *dep.Spec.Template.Spec.Containers[0].SecurityContext.RunAsUser != 0 {
86+
t.Errorf("SecurityContext.RunAsUser should be 0\n")
87+
}
88+
}
89+
3390
func TestControllerDeploymentRegistry(t *testing.T) {
3491
helmChartPath := "../charts/core"
3592

0 commit comments

Comments
 (0)