Skip to content

Commit 5e69e97

Browse files
cbandycbandy
committed
Drop default container runtime capabilities
The restricted profile of Kubernetes' Pod Security Standards requires dropping all POSIX capabilities. Issue: [sc-10828] See: https://docs.k8s.io/concepts/security/pod-security-standards/
1 parent 5c04c36 commit 5e69e97

File tree

11 files changed

+112
-2
lines changed

11 files changed

+112
-2
lines changed

‎internal/controller/postgrescluster/instance_test.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -563,6 +563,9 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
563563
resources: {}
564564
securityContext:
565565
allowPrivilegeEscalation: false
566+
capabilities:
567+
drop:
568+
- ALL
566569
privileged: false
567570
readOnlyRootFilesystem: true
568571
runAsNonRoot: true
@@ -610,6 +613,9 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
610613
resources: {}
611614
securityContext:
612615
allowPrivilegeEscalation: false
616+
capabilities:
617+
drop:
618+
- ALL
613619
privileged: false
614620
readOnlyRootFilesystem: true
615621
runAsNonRoot: true
@@ -665,6 +671,9 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
665671
cpu: 5m
666672
securityContext:
667673
allowPrivilegeEscalation: false
674+
capabilities:
675+
drop:
676+
- ALL
668677
privileged: false
669678
readOnlyRootFilesystem: true
670679
runAsNonRoot: true
@@ -712,6 +721,9 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
712721
resources: {}
713722
securityContext:
714723
allowPrivilegeEscalation: false
724+
capabilities:
725+
drop:
726+
- ALL
715727
privileged: false
716728
readOnlyRootFilesystem: true
717729
runAsNonRoot: true

‎internal/controller/postgrescluster/pgbackrest_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2505,6 +2505,9 @@ containers:
25052505
resources: {}
25062506
securityContext:
25072507
allowPrivilegeEscalation: false
2508+
capabilities:
2509+
drop:
2510+
- ALL
25082511
privileged: false
25092512
readOnlyRootFilesystem: true
25102513
runAsNonRoot: true

‎internal/controller/postgrescluster/pgmonitor_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,9 @@ func TestAddPGMonitorExporterToInstancePodSpec(t *testing.T) {
9696
assert.Equal(t, container.ImagePullPolicy, corev1.PullAlways)
9797
assert.DeepEqual(t, container.Resources, resources)
9898
assert.DeepEqual(t, container.Command, []string{"/opt/cpm/bin/start.sh"})
99+
assert.DeepEqual(t, container.SecurityContext.Capabilities, &corev1.Capabilities{
100+
Drop: []corev1.Capability{"ALL"},
101+
})
99102
assert.Equal(t, *container.SecurityContext.Privileged, false)
100103
assert.Equal(t, *container.SecurityContext.ReadOnlyRootFilesystem, true)
101104
assert.Equal(t, *container.SecurityContext.AllowPrivilegeEscalation, false)

‎internal/controller/postgrescluster/volumes_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -775,6 +775,9 @@ containers:
775775
cpu: 1m
776776
securityContext:
777777
allowPrivilegeEscalation: false
778+
capabilities:
779+
drop:
780+
- ALL
778781
privileged: false
779782
readOnlyRootFilesystem: true
780783
runAsNonRoot: true
@@ -828,6 +831,9 @@ containers:
828831
cpu: 1m
829832
securityContext:
830833
allowPrivilegeEscalation: false
834+
capabilities:
835+
drop:
836+
- ALL
831837
privileged: false
832838
readOnlyRootFilesystem: true
833839
runAsNonRoot: true
@@ -883,6 +889,9 @@ containers:
883889
cpu: 1m
884890
securityContext:
885891
allowPrivilegeEscalation: false
892+
capabilities:
893+
drop:
894+
- ALL
886895
privileged: false
887896
readOnlyRootFilesystem: true
888897
runAsNonRoot: true

‎internal/initialize/security.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,13 @@ func RestrictedSecurityContext() *corev1.SecurityContext {
3535
// Prevent any container processes from gaining privileges.
3636
AllowPrivilegeEscalation: Bool(false),
3737

38+
// Drop any capabilities granted by the container runtime.
39+
// This must be uppercase to pass Pod Security Admission.
40+
// - https://releases.k8s.io/v1.24.0/staging/src/k8s.io/pod-security-admission/policy/check_capabilities_restricted.go
41+
Capabilities: &corev1.Capabilities{
42+
Drop: []corev1.Capability{"ALL"},
43+
},
44+
3845
// Processes in privileged containers are essentially root on the host.
3946
Privileged: Bool(false),
4047

‎internal/initialize/security_test.go‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
package initialize_test
1717

1818
import (
19+
"fmt"
1920
"testing"
2021

2122
"gotest.tools/v3/assert"
@@ -72,8 +73,10 @@ func TestRestrictedSecurityContext(t *testing.T) {
7273
"Privileged Pods disable most security mechanisms and must be disallowed.")
7374
}
7475

75-
assert.Assert(t, sc.Capabilities == nil,
76-
"Adding additional capabilities beyond the default set must be disallowed.")
76+
if assert.Check(t, sc.Capabilities != nil) {
77+
assert.Assert(t, sc.Capabilities.Add == nil,
78+
"Adding additional capabilities … must be disallowed.")
79+
}
7780

7881
assert.Assert(t, sc.SELinuxOptions == nil,
7982
"Setting custom SELinux options should be disallowed.")
@@ -92,6 +95,11 @@ func TestRestrictedSecurityContext(t *testing.T) {
9295
"Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed.")
9396
}
9497

98+
if assert.Check(t, sc.Capabilities != nil) {
99+
assert.Assert(t, fmt.Sprint(sc.Capabilities.Drop) == `[ALL]`,
100+
"Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.")
101+
}
102+
95103
if assert.Check(t, sc.RunAsNonRoot != nil) {
96104
assert.Assert(t, *sc.RunAsNonRoot == true,
97105
"Containers must be required to run as non-root users.")

‎internal/pgadmin/reconcile_test.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,9 @@ containers:
238238
resources: {}
239239
securityContext:
240240
allowPrivilegeEscalation: false
241+
capabilities:
242+
drop:
243+
- ALL
241244
privileged: false
242245
readOnlyRootFilesystem: true
243246
runAsNonRoot: true
@@ -275,6 +278,9 @@ initContainers:
275278
resources: {}
276279
securityContext:
277280
allowPrivilegeEscalation: false
281+
capabilities:
282+
drop:
283+
- ALL
278284
privileged: false
279285
readOnlyRootFilesystem: true
280286
runAsNonRoot: true
@@ -470,6 +476,9 @@ containers:
470476
cpu: 100m
471477
securityContext:
472478
allowPrivilegeEscalation: false
479+
capabilities:
480+
drop:
481+
- ALL
473482
privileged: false
474483
readOnlyRootFilesystem: true
475484
runAsNonRoot: true
@@ -511,6 +520,9 @@ initContainers:
511520
cpu: 100m
512521
securityContext:
513522
allowPrivilegeEscalation: false
523+
capabilities:
524+
drop:
525+
- ALL
514526
privileged: false
515527
readOnlyRootFilesystem: true
516528
runAsNonRoot: true

‎internal/pgbackrest/reconcile_test.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,9 @@ func TestAddServerToInstancePod(t *testing.T) {
567567
cpu: 5m
568568
securityContext:
569569
allowPrivilegeEscalation: false
570+
capabilities:
571+
drop:
572+
- ALL
570573
privileged: false
571574
readOnlyRootFilesystem: true
572575
runAsNonRoot: true
@@ -613,6 +616,9 @@ func TestAddServerToInstancePod(t *testing.T) {
613616
cpu: 17m
614617
securityContext:
615618
allowPrivilegeEscalation: false
619+
capabilities:
620+
drop:
621+
- ALL
616622
privileged: false
617623
readOnlyRootFilesystem: true
618624
runAsNonRoot: true
@@ -697,6 +703,9 @@ func TestAddServerToRepoPod(t *testing.T) {
697703
cpu: 5m
698704
securityContext:
699705
allowPrivilegeEscalation: false
706+
capabilities:
707+
drop:
708+
- ALL
700709
privileged: false
701710
readOnlyRootFilesystem: true
702711
runAsNonRoot: true
@@ -739,6 +748,9 @@ func TestAddServerToRepoPod(t *testing.T) {
739748
cpu: 19m
740749
securityContext:
741750
allowPrivilegeEscalation: false
751+
capabilities:
752+
drop:
753+
- ALL
742754
privileged: false
743755
readOnlyRootFilesystem: true
744756
runAsNonRoot: true

‎internal/pgbouncer/reconcile_test.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,9 @@ containers:
142142
resources: {}
143143
securityContext:
144144
allowPrivilegeEscalation: false
145+
capabilities:
146+
drop:
147+
- ALL
145148
privileged: false
146149
readOnlyRootFilesystem: true
147150
runAsNonRoot: true
@@ -170,6 +173,9 @@ containers:
170173
resources: {}
171174
securityContext:
172175
allowPrivilegeEscalation: false
176+
capabilities:
177+
drop:
178+
- ALL
173179
privileged: false
174180
readOnlyRootFilesystem: true
175181
runAsNonRoot: true
@@ -246,6 +252,9 @@ containers:
246252
cpu: 100m
247253
securityContext:
248254
allowPrivilegeEscalation: false
255+
capabilities:
256+
drop:
257+
- ALL
249258
privileged: false
250259
readOnlyRootFilesystem: true
251260
runAsNonRoot: true
@@ -279,6 +288,9 @@ containers:
279288
memory: 16Mi
280289
securityContext:
281290
allowPrivilegeEscalation: false
291+
capabilities:
292+
drop:
293+
- ALL
282294
privileged: false
283295
readOnlyRootFilesystem: true
284296
runAsNonRoot: true
@@ -346,6 +358,9 @@ containers:
346358
cpu: 100m
347359
securityContext:
348360
allowPrivilegeEscalation: false
361+
capabilities:
362+
drop:
363+
- ALL
349364
privileged: false
350365
readOnlyRootFilesystem: true
351366
runAsNonRoot: true
@@ -378,6 +393,9 @@ containers:
378393
cpu: 200m
379394
securityContext:
380395
allowPrivilegeEscalation: false
396+
capabilities:
397+
drop:
398+
- ALL
381399
privileged: false
382400
readOnlyRootFilesystem: true
383401
runAsNonRoot: true

‎internal/postgres/reconcile_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,9 @@ containers:
144144
cpu: 9m
145145
securityContext:
146146
allowPrivilegeEscalation: false
147+
capabilities:
148+
drop:
149+
- ALL
147150
privileged: false
148151
readOnlyRootFilesystem: true
149152
runAsNonRoot: true
@@ -182,6 +185,9 @@ containers:
182185
cpu: 21m
183186
securityContext:
184187
allowPrivilegeEscalation: false
188+
capabilities:
189+
drop:
190+
- ALL
185191
privileged: false
186192
readOnlyRootFilesystem: true
187193
runAsNonRoot: true
@@ -248,6 +254,9 @@ initContainers:
248254
cpu: 9m
249255
securityContext:
250256
allowPrivilegeEscalation: false
257+
capabilities:
258+
drop:
259+
- ALL
251260
privileged: false
252261
readOnlyRootFilesystem: true
253262
runAsNonRoot: true

0 commit comments

Comments
 (0)