run as non-root by default (#294)

* run as non-root by default

* fix CI

* fix format

* fix

* set cap_fowner

* more logs

* more logs

* fix user in runner

* enable tmate to debug

* apply tmate for debug

* fix UID & GID

* cleanup

* cleanup

Author: freeznet

.ci/helm.sh

@@ -138,6 +138,7 @@ function ci::verify_function_mesh() {
       WC=$(${KUBECTL} get pods -lname=${FUNCTION_NAME} --field-selector=status.phase=Running | wc -l)
     done
     ${KUBECTL} describe pod -lname=${FUNCTION_NAME}
+    ${KUBECTL} logs -lname=${FUNCTION_NAME}  --all-containers=true
 }
 
 function ci::verify_hpa() {

controllers/spec/common.go

@@ -57,10 +57,10 @@ const (
 
 	EnvGoFunctionConfigs = "GO_FUNCTION_CONF"
 
-	DefaultRunnerUserID  = "10001"
-	DefaultRunnerUser    = "pulsar"
-	DefaultRunnerGroupID = "10000"
-	DefaultRunnerGroup   = "pulsar"
+	DefaultRunnerUserID  int64 = 10000
+	DefaultRunnerUser          = "pulsar"
+	DefaultRunnerGroupID int64 = 10001
+	DefaultRunnerGroup         = "pulsar"
 )
 
 var GRPCPort = corev1.ContainerPort{
@@ -136,6 +136,10 @@ func MakeStatefulSetSpec(replicas *int32, container *corev1.Container,
 
 func MakePodTemplate(container *corev1.Container, volumes []corev1.Volume,
 	labels map[string]string, policy v1alpha1.PodPolicy) *corev1.PodTemplateSpec {
+	podSecurityContext := getDefaultRunnerPodSecurityContext(DefaultRunnerUserID, DefaultRunnerGroupID, false)
+	if policy.SecurityContext != nil {
+		podSecurityContext = policy.SecurityContext
+	}
 	return &corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
 			Labels:      mergeLabels(labels, policy.Labels),
@@ -149,7 +153,7 @@ func MakePodTemplate(container *corev1.Container, volumes []corev1.Volume,
 			NodeSelector:                  policy.NodeSelector,
 			Affinity:                      policy.Affinity,
 			Tolerations:                   policy.Tolerations,
-			SecurityContext:               policy.SecurityContext,
+			SecurityContext:               podSecurityContext,
 			ImagePullSecrets:              policy.ImagePullSecrets,
 			ServiceAccountName:            policy.ServiceAccountName,
 		},
@@ -382,6 +386,9 @@ func getProcessGoRuntimeArgs(goExecFilePath string, function *v1alpha1.Function)
 		"&&",
 		"echo goFunctionConfigs=\"'${goFunctionConfigs}'\"",
 		"&&",
+		"ls -l",
+		goExecFilePath,
+		"&&",
 		"chmod +x",
 		goExecFilePath,
 		"&&",
@@ -655,6 +662,16 @@ func getSourceRunnerImage(spec *v1alpha1.SourceSpec) string {
 	return DefaultRunnerImage
 }
 
+// getDefaultRunnerPodSecurityContext returns a default PodSecurityContext that runs as non-root
+func getDefaultRunnerPodSecurityContext(uid, gid int64, nonRoot bool) *corev1.PodSecurityContext {
+	return &corev1.PodSecurityContext{
+		RunAsUser:    &uid,
+		RunAsGroup:   &gid,
+		RunAsNonRoot: &nonRoot,
+		FSGroup:      &gid,
+	}
+}
+
 func getJavaSecretProviderArgs(secretMaps map[string]v1alpha1.SecretRef) []string {
 	var ret []string
 	if len(secretMaps) > 0 {

controllers/spec/common_test.go

@@ -186,8 +186,9 @@ func TestMakeGoFunctionCommand(t *testing.T) {
 	assert.True(t, strings.HasPrefix(innerCommands[2], " GO_FUNCTION_CONF"))
 	assert.Equal(t, innerCommands[3], " goFunctionConfigs=${GO_FUNCTION_CONF} ")
 	assert.Equal(t, innerCommands[4], " echo goFunctionConfigs=\"'${goFunctionConfigs}'\" ")
-	assert.Equal(t, innerCommands[5], " chmod +x /pulsar/go-func ")
-	assert.Equal(t, innerCommands[6], " exec /pulsar/go-func -instance-conf ${goFunctionConfigs}")
+	assert.Equal(t, innerCommands[5], " ls -l /pulsar/go-func ")
+	assert.Equal(t, innerCommands[6], " chmod +x /pulsar/go-func ")
+	assert.Equal(t, innerCommands[7], " exec /pulsar/go-func -instance-conf ${goFunctionConfigs}")
 }
 
 const TestClusterName string = "test-pulsar"

controllers/spec/function.go

@@ -96,6 +96,9 @@ func MakeFunctionContainer(function *v1alpha1.Function) *corev1.Container {
 		ImagePullPolicy: imagePullPolicy,
 		EnvFrom:         generateContainerEnvFrom(function.Spec.Pulsar.PulsarConfig, function.Spec.Pulsar.AuthSecret, function.Spec.Pulsar.TLSSecret),
 		VolumeMounts:    makeFunctionVolumeMounts(function),
+		SecurityContext: &corev1.SecurityContext{
+			Capabilities: &corev1.Capabilities{Add: []corev1.Capability{"CAP_FOWNER"}},
+		},
 	}
 }
 

controllers/spec/sink.go

@@ -85,6 +85,9 @@ func MakeSinkContainer(sink *v1alpha1.Sink) *corev1.Container {
 		ImagePullPolicy: imagePullPolicy,
 		EnvFrom:         generateContainerEnvFrom(sink.Spec.Pulsar.PulsarConfig, sink.Spec.Pulsar.AuthSecret, sink.Spec.Pulsar.TLSSecret),
 		VolumeMounts:    makeSinkVolumeMounts(sink),
+		SecurityContext: &corev1.SecurityContext{
+			Capabilities: &corev1.Capabilities{Add: []corev1.Capability{"CAP_FOWNER"}},
+		},
 	}
 }
 

controllers/spec/source.go

@@ -80,6 +80,9 @@ func MakeSourceContainer(source *v1alpha1.Source) *corev1.Container {
 		ImagePullPolicy: imagePullPolicy,
 		EnvFrom:         generateContainerEnvFrom(source.Spec.Pulsar.PulsarConfig, source.Spec.Pulsar.AuthSecret, source.Spec.Pulsar.TLSSecret),
 		VolumeMounts:    makeSourceVolumeMounts(source),
+		SecurityContext: &corev1.SecurityContext{
+			Capabilities: &corev1.Capabilities{Add: []corev1.Capability{"CAP_FOWNER"}},
+		},
 	}
 }
 

images/pulsar-functions-base-runner/Dockerfile

@@ -5,8 +5,9 @@ FROM ubuntu:20.04 as functions-runner
 
 ENV GID=10001
 ENV UID=10000
+ENV USER=pulsar
 RUN groupadd -g $GID pulsar
-RUN adduser -u $UID --gid $GID --disabled-login --disabled-password --gecos '' pulsar
+RUN adduser -u $UID --gid $GID --disabled-login --disabled-password --gecos '' $USER
 
 RUN mkdir -p /pulsar/bin/ \
     && mkdir -p /pulsar/lib/ \

images/pulsar-functions-go-runner/Dockerfile

@@ -2,4 +2,4 @@ FROM pulsar-functions-runner-base:latest
 
 WORKDIR /pulsar
 
-USER $UID
+USER $USER

images/pulsar-functions-java-runner/Dockerfile

@@ -8,4 +8,4 @@ COPY --from=pulsar --chown=$UID:$GID /pulsar/instances/deps /pulsar/instances/de
 
 WORKDIR /pulsar
 
-USER $UID
+USER $USER

images/pulsar-functions-python-runner/Dockerfile

@@ -34,4 +34,4 @@ WORKDIR /pulsar
 RUN if [ -f "/pulsar/bin/install-pulsar-client-37.sh" ]; then /pulsar/bin/install-pulsar-client-37.sh ; fi
 RUN if [ -f "/pulsar/bin/install-pulsar-client.sh" ]; then /pulsar/bin/install-pulsar-client.sh ; fi
 
-USER $UID
+USER $USER