feat: copilot suggestions

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

Author: irby

Makefile

@@ -19,6 +19,7 @@ CONTAINER_TOOL ?= docker
 
 # Helm chart and Conftest policy directory for manifest linting
 HELM_CHART_DIR ?= deploy/charts/command-cert-manager-issuer
+HELM_RELEASE_NAME ?= command-cert-manager-issuer
 POLICY_DIR ?= policy
 
 # Setting SHELL to bash allows bash commands to be executed by recipes.
@@ -84,14 +85,14 @@ lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes
 
 .PHONY: helm-template
 helm-template: ## Render Helm chart templates to stdout (includes CRDs).
-	helm template ejbca-cert-manager-issuer $(HELM_CHART_DIR) --include-crds
+	helm template $(HELM_RELEASE_NAME) $(HELM_CHART_DIR) --include-crds
 
 .PHONY: lint-manifests
 lint-manifests: conftest ## Run Conftest policy checks against every CI values file in $(HELM_CHART_DIR)/ci/.
 	@failed=0; \
 	for f in $(HELM_CHART_DIR)/ci/*-values.yaml; do \
 		echo "==> $$(basename $$f)"; \
-		helm template ejbca-cert-manager-issuer $(HELM_CHART_DIR) --include-crds -f "$$f" \
+		helm template $(HELM_RELEASE_NAME) $(HELM_CHART_DIR) --include-crds -f "$$f" \
 			| $(CONFTEST) test --policy $(POLICY_DIR) - || failed=1; \
 	done; \
 	exit $$failed

internal/command/client.go

@@ -266,7 +266,7 @@ func printClaims(log logr.Logger, token string, claimsToPrint []string) {
 		}
 	}
 
-	if issuer, err := claims.GetIssuer(); err != nil {
+	if issuer, err := claims.GetIssuer(); err == nil && issuer != "" {
 		log.Info(fmt.Sprintf("\nNOTE: If you are receiving a HTTP 401 on requests to Command, make sure an identity provider in Command is configured with '%s' as the authority.\nThe discovery endpoint for your issuer can be found at %s/.well-known/openid-configuration.", issuer, issuer))
 	}
 }

internal/command/command.go

@@ -658,12 +658,14 @@ func getEnrollmentPatternByName(log logr.Logger, s *signer, enrollmentPatternNam
 
 	queryString := fmt.Sprintf("Name -eq \"%s\"", enrollmentPatternName)
 	patterns, httpResp, err := s.client.GetEnrollmentPatterns(v1.ApiGetEnrollmentPatternsRequest{}.QueryString(queryString))
+	if httpResp != nil && httpResp.Body != nil {
+		defer httpResp.Body.Close()
+	}
 
 	if err != nil {
 		// Capture the error message which should indicate the failure reason
 		msg := ""
 		if httpResp != nil && httpResp.Body != nil {
-			defer httpResp.Body.Close()
 			bodyBytes, _ := io.ReadAll(httpResp.Body)
 			msg += string(bodyBytes)
 		}

policy/deployments.rego

@@ -0,0 +1,31 @@
+package main
+
+import rego.v1
+
+# Validate that every Deployment container and initContainer effectively runs
+# as non-root, either by setting securityContext.runAsNonRoot=true itself or
+# by inheriting a pod-level default.
+pod_run_as_non_root_default if {
+  object.get(object.get(input.spec.template.spec, "securityContext", {}), "runAsNonRoot", false) == true
+}
+container_run_as_non_root(container) if {
+  object.get(object.get(container, "securityContext", {}), "runAsNonRoot", null) == true
+}
+container_run_as_non_root(container) if {
+  object.get(object.get(container, "securityContext", {}), "runAsNonRoot", null) == null
+  pod_run_as_non_root_default
+}
+
+deny contains msg if {
+  input.kind == "Deployment"
+  container := input.spec.template.spec.containers[_]
+  not container_run_as_non_root(container)
+  msg := sprintf("Deployment %v container %v must set securityContext.runAsNonRoot to true or inherit it from the pod securityContext", [input.metadata.name, container.name])
+}
+
+deny contains msg if {
+  input.kind == "Deployment"
+  container := input.spec.template.spec.initContainers[_]
+  not container_run_as_non_root(container)
+  msg := sprintf("Deployment %v initContainer %v must set securityContext.runAsNonRoot to true or inherit it from the pod securityContext", [input.metadata.name, container.name])
+}

policy/roles.rego

@@ -19,14 +19,6 @@ deny contains msg if {
   msg := sprintf("RoleBinding %v must have a namespace set", [input.metadata.name])
 }
 
-# Validate that Deployments do not run as root
-deny contains msg if {
-  input.kind == "Deployment"
-  not input.spec.template.spec.securityContext.runAsNonRoot
-
-  msg := "Containers must not run as root"
-}
-
 # ClusterRole resources must not have a namespace applied. This is typically ignored, but good hygiene
 # to omit to avoid confusion.
 deny contains msg if {