Skip to content

Commit 4a42bf4

Browse files
cbandycbandy
committed
Set runAsNonRoot at the container-level only
Some service meshes require privileged init-containers or sidecars, and the pod-level setting prevents these from working correctly. We satisfy Kubernetes' Restricted Pod Security policy by setting "runAsNonRoot" for all our containers, so setting it on the pod is redundant. Issue: [sc-15204] See: https://kubernetes.io/docs/concepts/security/pod-security-admission/ See: https://kubernetes.io/docs/concepts/security/pod-security-standards/
1 parent b5d6cc3 commit 4a42bf4

File tree

10 files changed

+14
-32
lines changed

10 files changed

+14
-32
lines changed

‎internal/controller/postgrescluster/pgadmin_test.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -528,7 +528,6 @@ schedulerName: default-scheduler
528528
securityContext:
529529
fsGroup: 26
530530
fsGroupChangePolicy: OnRootMismatch
531-
runAsNonRoot: true
532531
terminationGracePeriodSeconds: 30
533532
`
534533
if serverVersion.LessThan(version.MustParseGeneric("1.20")) {
@@ -541,7 +540,6 @@ restartPolicy: Always
541540
schedulerName: default-scheduler
542541
securityContext:
543542
fsGroup: 26
544-
runAsNonRoot: true
545543
terminationGracePeriodSeconds: 30
546544
`
547545
}
@@ -668,7 +666,6 @@ schedulerName: default-scheduler
668666
securityContext:
669667
fsGroup: 26
670668
fsGroupChangePolicy: OnRootMismatch
671-
runAsNonRoot: true
672669
terminationGracePeriodSeconds: 30
673670
tolerations:
674671
- key: sometoleration
@@ -704,7 +701,6 @@ restartPolicy: Always
704701
schedulerName: default-scheduler
705702
securityContext:
706703
fsGroup: 26
707-
runAsNonRoot: true
708704
terminationGracePeriodSeconds: 30
709705
tolerations:
710706
- key: sometoleration

‎internal/controller/postgrescluster/pgbackrest.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -715,7 +715,7 @@ func generateBackupJobSpecIntent(postgresCluster *v1beta1.PostgresCluster,
715715
// This will ensure the Job always has the latest configs mounted following a
716716
// failure as needed to successfully verify config hashes and run the Job.
717717
RestartPolicy: corev1.RestartPolicyNever,
718-
SecurityContext: initialize.RestrictedPodSecurityContext(),
718+
SecurityContext: initialize.PodSecurityContext(),
719719
ServiceAccountName: serviceAccountName,
720720
},
721721
},

‎internal/controller/postgrescluster/pgbackrest_test.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,6 @@ restartPolicy: Always
344344
schedulerName: default-scheduler
345345
securityContext:
346346
fsGroup: 26
347-
runAsNonRoot: true
348347
shareProcessNamespace: true
349348
terminationGracePeriodSeconds: 30
350349
tolerations:
@@ -2519,7 +2518,6 @@ enableServiceLinks: false
25192518
restartPolicy: Never
25202519
securityContext:
25212520
fsGroupChangePolicy: OnRootMismatch
2522-
runAsNonRoot: true
25232521
volumes:
25242522
- name: pgbackrest-config
25252523
projected:

‎internal/controller/postgrescluster/pgbouncer.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -447,7 +447,7 @@ func (r *Reconciler) generatePGBouncerDeployment(
447447
// Do not add environment variables describing services in this namespace.
448448
deploy.Spec.Template.Spec.EnableServiceLinks = initialize.Bool(false)
449449

450-
deploy.Spec.Template.Spec.SecurityContext = initialize.RestrictedPodSecurityContext()
450+
deploy.Spec.Template.Spec.SecurityContext = initialize.PodSecurityContext()
451451

452452
// set the image pull secrets, if any exist
453453
deploy.Spec.Template.Spec.ImagePullSecrets = cluster.Spec.ImagePullSecrets

‎internal/controller/postgrescluster/pgbouncer_test.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,6 @@ enableServiceLinks: false
470470
restartPolicy: Always
471471
securityContext:
472472
fsGroupChangePolicy: OnRootMismatch
473-
runAsNonRoot: true
474473
shareProcessNamespace: true
475474
topologySpreadConstraints:
476475
- labelSelector:

‎internal/controller/postgrescluster/volumes_test.go‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -811,7 +811,6 @@ schedulerName: default-scheduler
811811
securityContext:
812812
fsGroup: 26
813813
fsGroupChangePolicy: OnRootMismatch
814-
runAsNonRoot: true
815814
terminationGracePeriodSeconds: 30
816815
volumes:
817816
- name: postgres-data
@@ -860,7 +859,6 @@ restartPolicy: Never
860859
schedulerName: default-scheduler
861860
securityContext:
862861
fsGroup: 26
863-
runAsNonRoot: true
864862
terminationGracePeriodSeconds: 30
865863
volumes:
866864
- name: postgres-data
@@ -924,7 +922,6 @@ schedulerName: default-scheduler
924922
securityContext:
925923
fsGroup: 26
926924
fsGroupChangePolicy: OnRootMismatch
927-
runAsNonRoot: true
928925
terminationGracePeriodSeconds: 30
929926
volumes:
930927
- name: postgres-wal
@@ -972,7 +969,6 @@ restartPolicy: Never
972969
schedulerName: default-scheduler
973970
securityContext:
974971
fsGroup: 26
975-
runAsNonRoot: true
976972
terminationGracePeriodSeconds: 30
977973
volumes:
978974
- name: postgres-wal
@@ -1038,7 +1034,6 @@ schedulerName: default-scheduler
10381034
securityContext:
10391035
fsGroup: 26
10401036
fsGroupChangePolicy: OnRootMismatch
1041-
runAsNonRoot: true
10421037
terminationGracePeriodSeconds: 30
10431038
volumes:
10441039
- name: pgbackrest-repo
@@ -1089,7 +1084,6 @@ restartPolicy: Never
10891084
schedulerName: default-scheduler
10901085
securityContext:
10911086
fsGroup: 26
1092-
runAsNonRoot: true
10931087
terminationGracePeriodSeconds: 30
10941088
volumes:
10951089
- name: pgbackrest-repo

‎internal/initialize/security.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,10 @@ import (
1919
corev1 "k8s.io/api/core/v1"
2020
)
2121

22-
// RestrictedPodSecurityContext returns a v1.PodSecurityContext with safe defaults.
23-
// See https://docs.k8s.io/concepts/security/pod-security-standards/
24-
func RestrictedPodSecurityContext() *corev1.PodSecurityContext {
22+
// PodSecurityContext returns a v1.PodSecurityContext with some defaults.
23+
func PodSecurityContext() *corev1.PodSecurityContext {
2524
onRootMismatch := corev1.FSGroupChangeOnRootMismatch
2625
return &corev1.PodSecurityContext{
27-
// Fail to start a container if its image runs as UID 0 (root).
28-
RunAsNonRoot: Bool(true),
29-
3026
// If set to "OnRootMismatch", if the root of the volume already has
3127
// the correct permissions, the recursive permission change can be skipped
3228
FSGroupChangePolicy: &onRootMismatch,

‎internal/initialize/security_test.go‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,12 @@ import (
2424
"github.com/crunchydata/postgres-operator/internal/initialize"
2525
)
2626

27-
func TestRestrictedPodSecurityContext(t *testing.T) {
28-
psc := initialize.RestrictedPodSecurityContext()
27+
func TestPodSecurityContext(t *testing.T) {
28+
psc := initialize.PodSecurityContext()
29+
30+
if assert.Check(t, psc.FSGroupChangePolicy != nil) {
31+
assert.Equal(t, string(*psc.FSGroupChangePolicy), "OnRootMismatch")
32+
}
2933

3034
// Kubernetes describes recommended security profiles:
3135
// - https://docs.k8s.io/concepts/security/pod-security-standards/
@@ -47,9 +51,9 @@ func TestRestrictedPodSecurityContext(t *testing.T) {
4751
// > operators and developers of security-critical applications, as well as
4852
// > lower-trust users.
4953
t.Run("Restricted", func(t *testing.T) {
50-
if assert.Check(t, psc.RunAsNonRoot != nil) {
51-
assert.Assert(t, *psc.RunAsNonRoot == true,
52-
"Containers must be required to run as non-root users.")
54+
if assert.Check(t, psc.RunAsNonRoot == nil) {
55+
assert.Assert(t, initialize.RestrictedSecurityContext().RunAsNonRoot != nil,
56+
`RunAsNonRoot should be delegated to the container-level v1.SecurityContext`)
5357
}
5458

5559
assert.Assert(t, psc.SeccompProfile == nil,

‎internal/postgres/reconcile.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ func InstancePod(ctx context.Context,
262262
// PodSecurityContext returns a v1.PodSecurityContext for cluster that can write
263263
// to PersistentVolumes.
264264
func PodSecurityContext(cluster *v1beta1.PostgresCluster) *corev1.PodSecurityContext {
265-
podSecurityContext := initialize.RestrictedPodSecurityContext()
265+
podSecurityContext := initialize.PodSecurityContext()
266266

267267
// Use the specified supplementary groups except for root. The CRD has
268268
// similar validation, but we should never emit a PodSpec with that group.

‎internal/postgres/reconcile_test.go‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -604,25 +604,21 @@ func TestPodSecurityContext(t *testing.T) {
604604
assert.Assert(t, marshalMatches(PodSecurityContext(cluster), `
605605
fsGroup: 26
606606
fsGroupChangePolicy: OnRootMismatch
607-
runAsNonRoot: true
608607
`))
609608

610609
cluster.Spec.OpenShift = initialize.Bool(true)
611610
assert.Assert(t, marshalMatches(PodSecurityContext(cluster), `
612611
fsGroupChangePolicy: OnRootMismatch
613-
runAsNonRoot: true
614612
`))
615613

616614
cluster.Spec.SupplementalGroups = []int64{}
617615
assert.Assert(t, marshalMatches(PodSecurityContext(cluster), `
618616
fsGroupChangePolicy: OnRootMismatch
619-
runAsNonRoot: true
620617
`))
621618

622619
cluster.Spec.SupplementalGroups = []int64{999, 65000}
623620
assert.Assert(t, marshalMatches(PodSecurityContext(cluster), `
624621
fsGroupChangePolicy: OnRootMismatch
625-
runAsNonRoot: true
626622
supplementalGroups:
627623
- 999
628624
- 65000
@@ -632,7 +628,6 @@ supplementalGroups:
632628
assert.Assert(t, marshalMatches(PodSecurityContext(cluster), `
633629
fsGroup: 26
634630
fsGroupChangePolicy: OnRootMismatch
635-
runAsNonRoot: true
636631
supplementalGroups:
637632
- 999
638633
- 65000

0 commit comments

Comments
 (0)