Skip to content

Commit 2aab876

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #2277 from bertinatto/kms-plugins-lifecycle-restrict-sidecar
CNTRPLANE-3226: kms: set security context for KMS plugin sidecar
2 parents 3fa3bb6 + 0cefd74 commit 2aab876

4 files changed

Lines changed: 54 additions & 4 deletions

File tree

‎pkg/operator/encryption/kms/pluginlifecycle/sidecar.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,7 @@ func AddKMSPluginSidecarToStaticPodSpec(ctx context.Context, podSpec *corev1.Pod
7676
if err := ensureVolumeMountInContainer(podSpec.InitContainers, name, volumeMount); err != nil {
7777
return err
7878
}
79-
// The resource-dir files are owned by root, so the sidecar needs root to read files in that directory.
80-
if err := setRunAsUser(podSpec.InitContainers, name, 0); err != nil {
79+
if err := setRunAsRoot(podSpec.InitContainers, name); err != nil {
8180
return err
8281
}
8382
}
@@ -290,13 +289,16 @@ func ensureReferenceDataVolume(podSpec *corev1.PodSpec, secretName string) error
290289
return ensureVolume(podSpec, volume)
291290
}
292291

293-
func setRunAsUser(containers []corev1.Container, containerName string, uid int64) error {
292+
// setRunAsRoot sets RunAsUser=0 on the named container.
293+
// The resource-dir files are owned by root and protected by SELinux, so the sidecar needs
294+
// uid 0 and the proper SELinux label (indirectly obtained via host network) to read them.
295+
func setRunAsRoot(containers []corev1.Container, containerName string) error {
294296
for i, c := range containers {
295297
if c.Name == containerName {
296298
if c.SecurityContext == nil {
297299
containers[i].SecurityContext = &corev1.SecurityContext{}
298300
}
299-
containers[i].SecurityContext.RunAsUser = ptr.To(uid)
301+
containers[i].SecurityContext.RunAsUser = ptr.To(int64(0))
300302
return nil
301303
}
302304
}

‎pkg/operator/encryption/kms/pluginlifecycle/sidecar_test.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,12 @@ func TestAddKMSPluginSidecarToPodSpec(t *testing.T) {
186186
corev1.ResourceCPU: resource.MustParse("10m"),
187187
},
188188
},
189+
SecurityContext: &corev1.SecurityContext{
190+
ReadOnlyRootFilesystem: ptr.To(true),
191+
AllowPrivilegeEscalation: ptr.To(false),
192+
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
193+
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
194+
},
189195
VolumeMounts: []corev1.VolumeMount{socketMount, refDataMount},
190196
},
191197
},
@@ -233,6 +239,12 @@ func TestAddKMSPluginSidecarToPodSpec(t *testing.T) {
233239
corev1.ResourceCPU: resource.MustParse("10m"),
234240
},
235241
},
242+
SecurityContext: &corev1.SecurityContext{
243+
ReadOnlyRootFilesystem: ptr.To(true),
244+
AllowPrivilegeEscalation: ptr.To(false),
245+
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
246+
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
247+
},
236248
VolumeMounts: []corev1.VolumeMount{socketMount, refDataMount},
237249
},
238250
{
@@ -259,6 +271,12 @@ func TestAddKMSPluginSidecarToPodSpec(t *testing.T) {
259271
corev1.ResourceCPU: resource.MustParse("10m"),
260272
},
261273
},
274+
SecurityContext: &corev1.SecurityContext{
275+
ReadOnlyRootFilesystem: ptr.To(true),
276+
AllowPrivilegeEscalation: ptr.To(false),
277+
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
278+
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
279+
},
262280
VolumeMounts: []corev1.VolumeMount{socketMount, refDataMount},
263281
},
264282
},
@@ -487,6 +505,12 @@ func TestAddKMSPluginSidecarToPodSpec(t *testing.T) {
487505
corev1.ResourceCPU: resource.MustParse("10m"),
488506
},
489507
},
508+
SecurityContext: &corev1.SecurityContext{
509+
ReadOnlyRootFilesystem: ptr.To(true),
510+
AllowPrivilegeEscalation: ptr.To(false),
511+
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
512+
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
513+
},
490514
VolumeMounts: []corev1.VolumeMount{socketMount, refDataMount},
491515
},
492516
},

‎pkg/operator/encryption/kms/pluginlifecycle/vault.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,5 +120,11 @@ func (v *vault) BuildSidecarContainer() (corev1.Container, error) {
120120
corev1.ResourceCPU: resource.MustParse("10m"),
121121
},
122122
},
123+
SecurityContext: &corev1.SecurityContext{
124+
ReadOnlyRootFilesystem: ptr.To(true),
125+
AllowPrivilegeEscalation: ptr.To(false),
126+
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
127+
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
128+
},
123129
}, nil
124130
}

‎pkg/operator/encryption/kms/pluginlifecycle/vault_test.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,12 @@ func TestVaultSidecarProvider_BuildSidecarContainer(t *testing.T) {
9191
corev1.ResourceCPU: resource.MustParse("10m"),
9292
},
9393
},
94+
SecurityContext: &corev1.SecurityContext{
95+
ReadOnlyRootFilesystem: ptr.To(true),
96+
AllowPrivilegeEscalation: ptr.To(false),
97+
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
98+
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
99+
},
94100
},
95101
},
96102
},
@@ -151,6 +157,12 @@ func TestVaultSidecarProvider_BuildSidecarContainer(t *testing.T) {
151157
corev1.ResourceCPU: resource.MustParse("10m"),
152158
},
153159
},
160+
SecurityContext: &corev1.SecurityContext{
161+
ReadOnlyRootFilesystem: ptr.To(true),
162+
AllowPrivilegeEscalation: ptr.To(false),
163+
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
164+
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
165+
},
154166
},
155167
},
156168
},
@@ -196,6 +208,12 @@ func TestVaultSidecarProvider_BuildSidecarContainer(t *testing.T) {
196208
corev1.ResourceCPU: resource.MustParse("10m"),
197209
},
198210
},
211+
SecurityContext: &corev1.SecurityContext{
212+
ReadOnlyRootFilesystem: ptr.To(true),
213+
AllowPrivilegeEscalation: ptr.To(false),
214+
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
215+
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
216+
},
199217
},
200218
},
201219
},

0 commit comments

Comments
 (0)