Skip to content

Commit a86f6d2

Browse files
stuggistuggi
authored
Merge pull request #720 from lmiccini/lmiccini/sa-projected-token
Add projected SA token volume helpers to serviceaccount package and default security pod context helper
2 parents c443cf9 + dc70b12 commit a86f6d2

4 files changed

Lines changed: 309 additions & 0 deletions

File tree

‎modules/common/pod/security.go‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/*
2+
Copyright 2026 Red Hat
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package pod
18+
19+
import (
20+
corev1 "k8s.io/api/core/v1"
21+
"k8s.io/utils/ptr"
22+
)
23+
24+
// RestrictiveSecurityContext returns a hardened container SecurityContext
25+
// suitable for unprivileged workloads. It sets RunAsNonRoot, drops all
26+
// capabilities, disables privilege escalation, and applies the RuntimeDefault
27+
// seccomp profile. The provided uid is used for both RunAsUser and RunAsGroup.
28+
// Optional addCapabilities are added back after dropping ALL.
29+
func RestrictiveSecurityContext(uid int64, addCapabilities ...corev1.Capability) *corev1.SecurityContext {
30+
return RestrictiveSecurityContextWithGID(uid, uid, addCapabilities...)
31+
}
32+
33+
// RestrictiveSecurityContextWithGID is like RestrictiveSecurityContext but
34+
// allows specifying a different GID.
35+
func RestrictiveSecurityContextWithGID(uid, gid int64, addCapabilities ...corev1.Capability) *corev1.SecurityContext {
36+
caps := &corev1.Capabilities{
37+
Drop: []corev1.Capability{"ALL"},
38+
}
39+
if len(addCapabilities) > 0 {
40+
caps.Add = addCapabilities
41+
}
42+
return &corev1.SecurityContext{
43+
RunAsUser: ptr.To(uid),
44+
RunAsGroup: ptr.To(gid),
45+
RunAsNonRoot: ptr.To(true),
46+
ReadOnlyRootFilesystem: ptr.To(true),
47+
AllowPrivilegeEscalation: ptr.To(false),
48+
Capabilities: caps,
49+
SeccompProfile: &corev1.SeccompProfile{
50+
Type: corev1.SeccompProfileTypeRuntimeDefault,
51+
},
52+
}
53+
}

‎modules/common/pod/security_test.go‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
/*
2+
Copyright 2026 Red Hat
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package pod
18+
19+
import (
20+
"testing"
21+
22+
corev1 "k8s.io/api/core/v1"
23+
)
24+
25+
func TestRestrictiveSecurityContext(t *testing.T) {
26+
var uid int64 = 42457
27+
sc := RestrictiveSecurityContext(uid)
28+
29+
if sc.RunAsUser == nil || *sc.RunAsUser != uid {
30+
t.Errorf("expected RunAsUser %d, got %v", uid, sc.RunAsUser)
31+
}
32+
if sc.RunAsGroup == nil || *sc.RunAsGroup != uid {
33+
t.Errorf("expected RunAsGroup %d, got %v", uid, sc.RunAsGroup)
34+
}
35+
if sc.RunAsNonRoot == nil || !*sc.RunAsNonRoot {
36+
t.Error("expected RunAsNonRoot true")
37+
}
38+
if sc.AllowPrivilegeEscalation == nil || *sc.AllowPrivilegeEscalation {
39+
t.Error("expected AllowPrivilegeEscalation false")
40+
}
41+
if sc.Capabilities == nil || len(sc.Capabilities.Drop) != 1 || sc.Capabilities.Drop[0] != "ALL" {
42+
t.Errorf("expected Capabilities.Drop [ALL], got %v", sc.Capabilities)
43+
}
44+
if sc.SeccompProfile == nil || sc.SeccompProfile.Type != corev1.SeccompProfileTypeRuntimeDefault {
45+
t.Errorf("expected SeccompProfile RuntimeDefault, got %v", sc.SeccompProfile)
46+
}
47+
if sc.ReadOnlyRootFilesystem == nil || !*sc.ReadOnlyRootFilesystem {
48+
t.Error("expected ReadOnlyRootFilesystem true")
49+
}
50+
}
51+
52+
func TestRestrictiveSecurityContextWithGID(t *testing.T) {
53+
var uid int64 = 42415
54+
var gid int64 = 42416
55+
sc := RestrictiveSecurityContextWithGID(uid, gid)
56+
57+
if sc.RunAsUser == nil || *sc.RunAsUser != uid {
58+
t.Errorf("expected RunAsUser %d, got %v", uid, sc.RunAsUser)
59+
}
60+
if sc.RunAsGroup == nil || *sc.RunAsGroup != gid {
61+
t.Errorf("expected RunAsGroup %d, got %v", gid, sc.RunAsGroup)
62+
}
63+
if sc.RunAsNonRoot == nil || !*sc.RunAsNonRoot {
64+
t.Error("expected RunAsNonRoot true")
65+
}
66+
if sc.AllowPrivilegeEscalation == nil || *sc.AllowPrivilegeEscalation {
67+
t.Error("expected AllowPrivilegeEscalation false")
68+
}
69+
}
70+
71+
func TestRestrictiveSecurityContextNoAddCaps(t *testing.T) {
72+
sc := RestrictiveSecurityContext(42457)
73+
if sc.Capabilities.Add != nil {
74+
t.Errorf("expected no Add capabilities, got %v", sc.Capabilities.Add)
75+
}
76+
}
77+
78+
func TestRestrictiveSecurityContextWithAddCaps(t *testing.T) {
79+
sc := RestrictiveSecurityContext(42457, "NET_BIND_SERVICE", "CHOWN")
80+
81+
if len(sc.Capabilities.Drop) != 1 || sc.Capabilities.Drop[0] != "ALL" {
82+
t.Errorf("expected Drop [ALL], got %v", sc.Capabilities.Drop)
83+
}
84+
if len(sc.Capabilities.Add) != 2 {
85+
t.Fatalf("expected 2 Add capabilities, got %d", len(sc.Capabilities.Add))
86+
}
87+
if sc.Capabilities.Add[0] != "NET_BIND_SERVICE" || sc.Capabilities.Add[1] != "CHOWN" {
88+
t.Errorf("expected Add [NET_BIND_SERVICE CHOWN], got %v", sc.Capabilities.Add)
89+
}
90+
}

‎modules/common/serviceaccount/projected_token.go‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
/*
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
8+
Unless required by applicable law or agreed to in writing, software
9+
distributed under the License is distributed on an "AS IS" BASIS,
10+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
See the License for the specific language governing permissions and
12+
limitations under the License.
13+
*/
14+
15+
package serviceaccount
16+
17+
import (
18+
corev1 "k8s.io/api/core/v1"
19+
"k8s.io/utils/ptr"
20+
)
21+
22+
const (
23+
// KubeAPIAccessVolumeName is the name of the projected volume that
24+
// replaces the default automounted service account token.
25+
KubeAPIAccessVolumeName = "kube-api-access"
26+
27+
// KubeAPIAccessMountPath is the standard mount path for the projected
28+
// service account token volume, matching the default automount path.
29+
KubeAPIAccessMountPath = "/var/run/secrets/kubernetes.io/serviceaccount"
30+
31+
// DefaultTokenExpirationSeconds is the default expiration for the
32+
// projected service account token (1 hour).
33+
DefaultTokenExpirationSeconds int64 = 3600
34+
)
35+
36+
// KubeAPIAccessVolume returns a projected Volume that provides a
37+
// time-limited service account token, the cluster CA certificate, and
38+
// the pod namespace. Use it together with AutomountServiceAccountToken=false
39+
// on the PodSpec to replace the default long-lived automounted token with a
40+
// short-lived one. An optional expirationSeconds overrides the default
41+
// token lifetime (1 hour).
42+
func KubeAPIAccessVolume(expirationSeconds ...int64) corev1.Volume {
43+
expiration := DefaultTokenExpirationSeconds
44+
if len(expirationSeconds) > 0 && expirationSeconds[0] > 0 {
45+
expiration = expirationSeconds[0]
46+
}
47+
return corev1.Volume{
48+
Name: KubeAPIAccessVolumeName,
49+
VolumeSource: corev1.VolumeSource{
50+
Projected: &corev1.ProjectedVolumeSource{
51+
DefaultMode: ptr.To[int32](0444),
52+
Sources: []corev1.VolumeProjection{
53+
{
54+
ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
55+
Path: "token",
56+
ExpirationSeconds: ptr.To(expiration),
57+
},
58+
},
59+
{
60+
ConfigMap: &corev1.ConfigMapProjection{
61+
LocalObjectReference: corev1.LocalObjectReference{
62+
Name: "kube-root-ca.crt",
63+
},
64+
Items: []corev1.KeyToPath{
65+
{
66+
Key: "ca.crt",
67+
Path: "ca.crt",
68+
},
69+
},
70+
},
71+
},
72+
{
73+
DownwardAPI: &corev1.DownwardAPIProjection{
74+
Items: []corev1.DownwardAPIVolumeFile{
75+
{
76+
Path: "namespace",
77+
FieldRef: &corev1.ObjectFieldSelector{
78+
APIVersion: "v1",
79+
FieldPath: "metadata.namespace",
80+
},
81+
},
82+
},
83+
},
84+
},
85+
},
86+
},
87+
},
88+
}
89+
}
90+
91+
// KubeAPIAccessVolumeMount returns a read-only VolumeMount for the
92+
// projected service account token volume at the standard automount path.
93+
func KubeAPIAccessVolumeMount() corev1.VolumeMount {
94+
return corev1.VolumeMount{
95+
Name: KubeAPIAccessVolumeName,
96+
MountPath: KubeAPIAccessMountPath,
97+
ReadOnly: true,
98+
}
99+
}

‎modules/common/serviceaccount/projected_token_test.go‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
8+
Unless required by applicable law or agreed to in writing, software
9+
distributed under the License is distributed on an "AS IS" BASIS,
10+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
See the License for the specific language governing permissions and
12+
limitations under the License.
13+
*/
14+
15+
package serviceaccount
16+
17+
import (
18+
"testing"
19+
20+
. "github.com/onsi/gomega" //revive:disable:dot-imports
21+
)
22+
23+
func TestKubeAPIAccessVolume(t *testing.T) {
24+
g := NewWithT(t)
25+
26+
vol := KubeAPIAccessVolume()
27+
28+
g.Expect(vol.Name).To(Equal(KubeAPIAccessVolumeName))
29+
g.Expect(vol.Projected).NotTo(BeNil())
30+
g.Expect(*vol.Projected.DefaultMode).To(Equal(int32(0444)))
31+
32+
sources := vol.Projected.Sources
33+
g.Expect(sources).To(HaveLen(3))
34+
35+
g.Expect(sources[0].ServiceAccountToken).NotTo(BeNil())
36+
g.Expect(sources[0].ServiceAccountToken.Path).To(Equal("token"))
37+
g.Expect(*sources[0].ServiceAccountToken.ExpirationSeconds).To(Equal(DefaultTokenExpirationSeconds))
38+
39+
g.Expect(sources[1].ConfigMap).NotTo(BeNil())
40+
g.Expect(sources[1].ConfigMap.Name).To(Equal("kube-root-ca.crt"))
41+
g.Expect(sources[1].ConfigMap.Items).To(HaveLen(1))
42+
g.Expect(sources[1].ConfigMap.Items[0].Key).To(Equal("ca.crt"))
43+
44+
g.Expect(sources[2].DownwardAPI).NotTo(BeNil())
45+
g.Expect(sources[2].DownwardAPI.Items).To(HaveLen(1))
46+
g.Expect(sources[2].DownwardAPI.Items[0].Path).To(Equal("namespace"))
47+
g.Expect(sources[2].DownwardAPI.Items[0].FieldRef.FieldPath).To(Equal("metadata.namespace"))
48+
}
49+
50+
func TestKubeAPIAccessVolumeCustomExpiration(t *testing.T) {
51+
g := NewWithT(t)
52+
53+
var customExpiration int64 = 7200
54+
vol := KubeAPIAccessVolume(customExpiration)
55+
56+
g.Expect(*vol.Projected.Sources[0].ServiceAccountToken.ExpirationSeconds).To(Equal(customExpiration))
57+
}
58+
59+
func TestKubeAPIAccessVolumeMount(t *testing.T) {
60+
g := NewWithT(t)
61+
62+
mount := KubeAPIAccessVolumeMount()
63+
64+
g.Expect(mount.Name).To(Equal(KubeAPIAccessVolumeName))
65+
g.Expect(mount.MountPath).To(Equal(KubeAPIAccessMountPath))
66+
g.Expect(mount.ReadOnly).To(BeTrue())
67+
}

0 commit comments

Comments
 (0)