Hardening: add security context; split geonode PVC into individual PVCs, to allow more granular handling and better control of subdirectory creation (avoid subPath)

Author: jwkaltz

charts/geonode/templates/geonode/geonode-pvc.yaml

@@ -1,7 +1,46 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: pvc-{{ .Release.Name }}-geonode
+  name: pvc-{{ .Release.Name }}-geonode-statics
+  namespace: {{ .Release.Namespace }}
+spec:
+  accessModes:
+  - {{ .Values.global.accessMode }}
+  storageClassName: {{ .Values.global.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.geonode.persistant.storageSize }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pvc-{{ .Release.Name }}-geonode-geoserver-data
+  namespace: {{ .Release.Namespace }}
+spec:
+  accessModes:
+  - {{ .Values.global.accessMode }}
+  storageClassName: {{ .Values.global.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.geonode.persistant.storageSize }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pvc-{{ .Release.Name }}-geonode-backup-restore
+  namespace: {{ .Release.Namespace }}
+spec:
+  accessModes:
+  - {{ .Values.global.accessMode }}
+  storageClassName: {{ .Values.global.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.geonode.persistant.storageSize }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pvc-{{ .Release.Name }}-geonode-data
   namespace: {{ .Release.Namespace }}
 spec:
   accessModes:

charts/geonode/templates/geonode/jobs/geonode-statics-job.yaml

@@ -22,10 +22,25 @@ spec:
       - name: {{ .Values.geonode.imagePullSecret }}
 {{ end }}
       restartPolicy: OnFailure
+      securityContext:
+        runAsNonRoot: true
+        fsGroup: {{ .Values.geonode.securityContext.fsGroup | default .Values.global.securityContext.fsGroup }}
+
       containers:
       - name: {{ .Values.geonode.container_name }}-statics-job
         image: "{{ .Values.geonode.image.name }}:{{ .Values.geonode.image.tag }}"
         imagePullPolicy: {{ .Values.geonode.imagePullPolicy }}
+        securityContext:
+          runAsUser: {{ .Values.geonode.securityContext.runAsUser | default .Values.global.securityContext.runAsUser }}
+          runAsGroup: {{ .Values.geonode.securityContext.runAsGroup | default .Values.global.securityContext.runAsGroup }}
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          seccompProfile:
+            type: RuntimeDefault
+
         command:
         - bash
         - -c
@@ -72,9 +87,8 @@ spec:
         - name: DATABASE_URL
           value: "postgis://$(GEONODE_DATABASE):$(GEONODE_DATABASE_PASSWORD)@$(DATABASE_HOST):$(DATABASE_PORT)/$(GEONODE_DATABASE)"
         volumeMounts:
-        - name: "{{ include "persistant_volume_name" . }}"
+        - name: pvc-data
           mountPath: /data
-          subPath: data
         - name: cache-volume
           mountPath: /tmp
         - name: tasks-py
@@ -88,13 +102,15 @@ spec:
           mountPath: "/usr/src/geonode/geonode/geonode-k8s-settings-additions.py"
           subPath: geonode-k8s-settings-additions.py
           readOnly: true
-        - name: "{{ include "persistant_volume_name" . }}"
+        - name: pvc-statics
           mountPath: /mnt/volumes/statics
-          subPath: statics
       volumes:
-      - name: "{{ include "persistant_volume_name" . }}"
+      - name: pvc-statics
         persistentVolumeClaim:
-          claimName: pvc-{{ .Release.Name }}-geonode
+          claimName: {{ include "pvc_statics_name" . }}
+      - name: pvc-data
+        persistentVolumeClaim:
+          claimName: {{ include "pvc_data_name" . }}
       - name: tasks-py
         configMap:
           name: {{ .Release.Name }}-geonode-tasks-py
@@ -115,7 +131,6 @@ spec:
           items:
           - key: geonode-k8s-settings-additions.py
             path: "geonode-k8s-settings-additions.py"
-
       # Using an emptyDir to cache compiled statics... it will survive container crashes, but not pod restarts
       - name: cache-volume
         emptyDir: {}