Skip to content

Commit 4adce61

Browse files
duckhawkduckhawk
authored
Fix seccomp profile (#153)
Signed-off-by: v.oleynikov <[email protected]>
1 parent 53af0e0 commit 4adce61

File tree

5 files changed

+25
-15
lines changed

5 files changed

+25
-15
lines changed

‎charts/helm_lib/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
apiVersion: v2
22
type: library
33
name: deckhouse_lib_helm
4-
version: 1.64.2
4+
version: 1.64.3
55
description: "Helm utils template definitions for Deckhouse modules."

‎charts/helm_lib/README.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -650,16 +650,18 @@ list:
650650

651651
### helm_lib_module_container_security_context_pss_restricted_flexible
652652

653-
SecurityContext for Deckhouse UID/GID 64535, PSS Restricted
653+
SecurityContext for Deckhouse UID/GID 64535 (or root), PSS Restricted
654654
Optional keys:
655655
.ro – bool, read-only root FS (default true)
656656
.caps – []string, capabilities.add (default empty)
657657
.uid – int, runAsUser/runAsGroup (default 64535)
658658
.seccompProfile – bool, disable seccompProfile when false (default true)
659+
.runAsNonRoot – bool, run as Deckhouse user when true, root when false (default true)
660+
.seccompProfile – bool, disable seccompProfile when false (default true)
659661

660662
#### Usage
661663

662-
`include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false) `
664+
`include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) `
663665

664666

665667

‎charts/helm_lib/templates/_csi_controller.tpl‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,7 @@ spec:
241241
automountServiceAccountToken: true
242242
containers:
243243
- name: provisioner
244-
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }}
244+
{{- include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" true "seccompProfile" true) | nindent 8 }}
245245
image: {{ $provisionerImage | quote }}
246246
args:
247247
- "--timeout={{ $provisionerTimeout }}"
@@ -294,7 +294,7 @@ spec:
294294
{{- include "provisioner_resources" $context | nindent 12 }}
295295
{{- end }}
296296
- name: attacher
297-
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }}
297+
{{- include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" true "seccompProfile" true) | nindent 8 }}
298298
image: {{ $attacherImage | quote }}
299299
args:
300300
- "--timeout={{ $attacherTimeout }}"
@@ -325,7 +325,7 @@ spec:
325325
{{- end }}
326326
{{- if $resizerEnabled }}
327327
- name: resizer
328-
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }}
328+
{{- include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" true "seccompProfile" true) | nindent 8 }}
329329
image: {{ $resizerImage | quote }}
330330
args:
331331
- "--timeout={{ $resizerTimeout }}"
@@ -357,7 +357,7 @@ spec:
357357
{{- end }}
358358
{{- if $syncerEnabled }}
359359
- name: syncer
360-
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }}
360+
{{- include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" true "seccompProfile" true) | nindent 8 }}
361361
image: {{ $syncerImage | quote }}
362362
args:
363363
- "--leader-election"
@@ -384,7 +384,7 @@ spec:
384384
{{- end }}
385385
{{- if $snapshotterEnabled }}
386386
- name: snapshotter
387-
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }}
387+
{{- include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" true "seccompProfile" true) | nindent 8 }}
388388
image: {{ $snapshotterImage | quote }}
389389
args:
390390
- "--timeout={{ $snapshotterTimeout }}"
@@ -418,7 +418,7 @@ spec:
418418
{{- end }}
419419
{{- end }}
420420
- name: livenessprobe
421-
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }}
421+
{{- include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" true "seccompProfile" true) | nindent 8 }}
422422
image: {{ $livenessprobeImage | quote }}
423423
args:
424424
- "--csi-address=$(ADDRESS)"
@@ -454,7 +454,7 @@ spec:
454454
{{- if $forceCsiControllerPrivilegedContainer }}
455455
{{- include "helm_lib_module_container_security_context_escalated_sys_admin_privileged" . | nindent 8 }}
456456
{{- else }}
457-
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }}
457+
{{- include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" true "seccompProfile" true) | nindent 8 }}
458458
{{- end }}
459459
image: {{ $controllerImage | quote }}
460460
args:

‎charts/helm_lib/templates/_csi_node.tpl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ spec:
138138
{{- end }}
139139
containers:
140140
- name: node-driver-registrar
141-
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" $context | nindent 8 }}
141+
{{- include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" true "seccompProfile" true "uid" "0" "runAsNonRoot" false) | nindent 8 }}
142142
image: {{ $driverRegistrarImage | quote }}
143143
args:
144144
- "--v=5"
@@ -182,6 +182,8 @@ spec:
182182
securityContext:
183183
privileged: true
184184
readOnlyRootFilesystem: true
185+
seccompProfile:
186+
type: RuntimeDefault
185187
{{- if $setSysAdminCapability }}
186188
capabilities:
187189
add:

‎charts/helm_lib/templates/_module_security_context.tpl‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,15 @@ securityContext:
6969
{{- end }}
7070

7171

72-
{{- /* SecurityContext for Deckhouse UID/GID 64535, PSS Restricted */ -}}
72+
{{- /* SecurityContext for Deckhouse UID/GID 64535 (or root), PSS Restricted */ -}}
7373
{{- /* Optional keys: */ -}}
7474
{{- /* .ro – bool, read-only root FS (default true) */ -}}
7575
{{- /* .caps – []string, capabilities.add (default empty) */ -}}
7676
{{- /* .uid – int, runAsUser/runAsGroup (default 64535) */ -}}
7777
{{- /* .seccompProfile – bool, disable seccompProfile when false (default true) */ -}}
78-
{{- /* Usage: include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false) */ -}}
78+
{{- /* .runAsNonRoot – bool, run as Deckhouse user when true, root when false (default true) */ -}}
79+
{{- /* .seccompProfile – bool, disable seccompProfile when false (default true) */ -}}
80+
{{- /* Usage: include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) */ -}}
7981
{{- define "helm_lib_module_container_security_context_pss_restricted_flexible" -}}
8082
{{- $ro := true -}}
8183
{{- if hasKey . "ro" -}}
@@ -87,10 +89,14 @@ securityContext:
8789
{{- end -}}
8890
{{- $caps := default (list) .caps -}}
8991
{{- $uid := default 64535 .uid -}}
92+
{{- $runAsNonRoot := true -}}
93+
{{- if hasKey . "runAsNonRoot" -}}
94+
{{- $runAsNonRoot = .runAsNonRoot -}}
95+
{{- end -}}
9096

9197
securityContext:
9298
readOnlyRootFilesystem: {{ $ro }}
93-
allowPrivilegeEscalation: false
99+
allowPrivilegeEscalation: {{ not $runAsNonRoot }}
94100
capabilities:
95101
drop:
96102
- ALL
@@ -99,7 +105,7 @@ securityContext:
99105
{{- end }}
100106
runAsUser: {{ $uid }}
101107
runAsGroup: {{ $uid }}
102-
runAsNonRoot: true
108+
runAsNonRoot: {{ $runAsNonRoot }}
103109
{{- if $seccompProfile }}
104110
seccompProfile:
105111
type: RuntimeDefault

0 commit comments

Comments
 (0)