[release-1.4] Add all securityContext fields in injected containers (i…

…stio#19832) * Add all securityContext fields in injected containers Fixes istio#17318 * Update injection unit tests Co-authored-by: Romain Lenglet <[email protected]>
brian-avery · Dec 28, 2019 · 0130466 · 0130466
1 parent 7fe9629
commit 0130466
Show file tree

Hide file tree

Showing 86 changed files with 1,306 additions and 21 deletions.
diff --git a/install/kubernetes/helm/istio/files/injection-template.yaml b/install/kubernetes/helm/istio/files/injection-template.yaml
@@ -43,14 +43,18 @@ initContainers:
   resources: {}
 {{- end }}
   securityContext:
-    runAsUser: 0
-    runAsNonRoot: false
+    allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
     capabilities:
       add:
       - NET_ADMIN
-    {{- if .Values.global.proxy.privileged }}
-    privileged: true
-    {{- end }}
+      - NET_RAW
+      drop:
+      - ALL
+    privileged: {{ .Values.global.proxy.privileged }}
+    readOnlyRootFilesystem: false
+    runAsGroup: 0
+    runAsNonRoot: false
+    runAsUser: 0
   restartPolicy: Always
 {{- end }}
 {{  end -}}
@@ -65,9 +69,17 @@ initContainers:
   imagePullPolicy: IfNotPresent
   resources: {}
   securityContext:
-    runAsUser: 0
-    runAsNonRoot: false
+    allowPrivilegeEscalation: true
+    capabilities:
+      add:
+      - SYS_ADMIN
+      drop:
+      - ALL
     privileged: true
+    readOnlyRootFilesystem: false
+    runAsGroup: 0
+    runAsNonRoot: false
+    runAsUser: 0
 {{ end }}
 {{- end }}
 containers:
@@ -288,21 +300,22 @@ containers:
     failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
   {{ end -}}
   securityContext:
-    {{- if .Values.global.proxy.privileged }}
-    privileged: true
-    {{- end }}
-    {{- if ne .Values.global.proxy.enableCoreDump true }}
-    readOnlyRootFilesystem: true
-    {{- end }}
-    {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
+    allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
     capabilities:
+      {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
       add:
       - NET_ADMIN
+      {{- end }}
+      drop:
+      - ALL
+    privileged: {{ .Values.global.proxy.privileged }}
+    readOnlyRootFilesystem: {{ not .Values.global.proxy.enableCoreDump }}
     runAsGroup: 1337
-    {{ else -}}
-    {{ if .Values.global.sds.enabled }}
-    runAsGroup: 1337
-    {{- end }}
+    {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
+    runAsNonRoot: false
+    runAsUser: 0
+    {{- else -}}
+    runAsNonRoot: true
     runAsUser: 1337
     {{- end }}
   resources:

diff --git a/istioctl/cmd/testdata/uninject/cronjob-with-app.yaml.injected b/istioctl/cmd/testdata/uninject/cronjob-with-app.yaml.injected
@@ -80,8 +80,14 @@ spec:
                 cpu: 10m
                 memory: 30Mi
             securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
               privileged: false
               readOnlyRootFilesystem: true
+              runAsGroup: 1337
+              runAsNonRoot: true
               runAsUser: 1337
             volumeMounts:
             - mountPath: /etc/istio/proxy
@@ -110,9 +116,18 @@ spec:
             name: istio-init
             resources: {}
             securityContext:
+              allowPrivilegeEscalation: false
               capabilities:
                 add:
                 - NET_ADMIN
+                - NET_RAW
+                drop:
+                - ALL
+              privileged: false
+              readOnlyRootFilesystem: false
+              runAsGroup: 0
+              runAsNonRoot: false
+              runAsUser: 0
           restartPolicy: OnFailure
           volumes:
           - emptyDir:

diff --git a/istioctl/cmd/testdata/uninject/cronjob.yaml.injected b/istioctl/cmd/testdata/uninject/cronjob.yaml.injected
@@ -102,7 +102,14 @@ spec:
                 cpu: 100m
                 memory: 128Mi
             securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              privileged: false
               readOnlyRootFilesystem: true
+              runAsGroup: 1337
+              runAsNonRoot: true
               runAsUser: 1337
             volumeMounts:
             - mountPath: /etc/istio/proxy
@@ -137,9 +144,16 @@ spec:
                 cpu: 10m
                 memory: 10Mi
             securityContext:
+              allowPrivilegeEscalation: false
               capabilities:
                 add:
                 - NET_ADMIN
+                - NET_RAW
+                drop:
+                - ALL
+              privileged: false
+              readOnlyRootFilesystem: false
+              runAsGroup: 0
               runAsNonRoot: false
               runAsUser: 0
           restartPolicy: OnFailure

diff --git a/istioctl/cmd/testdata/uninject/daemonset.yaml.injected b/istioctl/cmd/testdata/uninject/daemonset.yaml.injected
@@ -107,7 +107,14 @@ spec:
             cpu: 100m
             memory: 128Mi
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: true
           runAsUser: 1337
         volumeMounts:
         - mountPath: /etc/istio/proxy
@@ -142,9 +149,16 @@ spec:
             cpu: 10m
             memory: 10Mi
         securityContext:
+          allowPrivilegeEscalation: false
           capabilities:
             add:
             - NET_ADMIN
+            - NET_RAW
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: false
+          runAsGroup: 0
           runAsNonRoot: false
           runAsUser: 0
       volumes:

diff --git a/istioctl/cmd/testdata/uninject/deploymentconfig-multi.yaml.injected b/istioctl/cmd/testdata/uninject/deploymentconfig-multi.yaml.injected
@@ -126,7 +126,14 @@ items:
               cpu: 100m
               memory: 128Mi
           securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1337
+            runAsNonRoot: true
             runAsUser: 1337
           volumeMounts:
           - mountPath: /etc/istio/proxy
@@ -161,9 +168,16 @@ items:
               cpu: 10m
               memory: 10Mi
           securityContext:
+            allowPrivilegeEscalation: false
             capabilities:
               add:
               - NET_ADMIN
+              - NET_RAW
+              drop:
+              - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsGroup: 0
             runAsNonRoot: false
             runAsUser: 0
         volumes:

diff --git a/istioctl/cmd/testdata/uninject/deploymentconfig.yaml.injected b/istioctl/cmd/testdata/uninject/deploymentconfig.yaml.injected
@@ -111,7 +111,14 @@ spec:
             cpu: 100m
             memory: 128Mi
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: true
           runAsUser: 1337
         volumeMounts:
         - mountPath: /etc/istio/proxy
@@ -146,9 +153,16 @@ spec:
             cpu: 10m
             memory: 10Mi
         securityContext:
+          allowPrivilegeEscalation: false
           capabilities:
             add:
             - NET_ADMIN
+            - NET_RAW
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: false
+          runAsGroup: 0
           runAsNonRoot: false
           runAsUser: 0
       volumes:

diff --git a/istioctl/cmd/testdata/uninject/enable-core-dump.yaml.injected b/istioctl/cmd/testdata/uninject/enable-core-dump.yaml.injected
@@ -112,6 +112,14 @@ spec:
             cpu: 100m
             memory: 128Mi
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: true
           runAsUser: 1337
         volumeMounts:
         - mountPath: /etc/istio/proxy
@@ -146,9 +154,16 @@ spec:
             cpu: 10m
             memory: 10Mi
         securityContext:
+          allowPrivilegeEscalation: false
           capabilities:
             add:
             - NET_ADMIN
+            - NET_RAW
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: false
+          runAsGroup: 0
           runAsNonRoot: false
           runAsUser: 0
       - args:
@@ -161,7 +176,15 @@ spec:
         name: enable-core-dump
         resources: {}
         securityContext:
+          allowPrivilegeEscalation: true
+          capabilities:
+            add:
+            - SYS_ADMIN
+            drop:
+            - ALL
           privileged: true
+          readOnlyRootFilesystem: false
+          runAsGroup: 0
           runAsNonRoot: false
           runAsUser: 0
       volumes:

diff --git a/istioctl/cmd/testdata/uninject/job.yaml.injected b/istioctl/cmd/testdata/uninject/job.yaml.injected
@@ -100,7 +100,14 @@ spec:
             cpu: 100m
             memory: 128Mi
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: true
           runAsUser: 1337
         volumeMounts:
         - mountPath: /etc/istio/proxy
@@ -135,9 +142,16 @@ spec:
             cpu: 10m
             memory: 10Mi
         securityContext:
+          allowPrivilegeEscalation: false
           capabilities:
             add:
             - NET_ADMIN
+            - NET_RAW
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: false
+          runAsGroup: 0
           runAsNonRoot: false
           runAsUser: 0
       restartPolicy: Never

diff --git a/istioctl/cmd/testdata/uninject/list.yaml.injected b/istioctl/cmd/testdata/uninject/list.yaml.injected
@@ -117,7 +117,14 @@ items:
               cpu: 100m
               memory: 128Mi
           securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1337
+            runAsNonRoot: true
             runAsUser: 1337
           volumeMounts:
           - mountPath: /etc/istio/proxy
@@ -156,9 +163,16 @@ items:
               cpu: 10m
               memory: 10Mi
           securityContext:
+            allowPrivilegeEscalation: false
             capabilities:
               add:
               - NET_ADMIN
+              - NET_RAW
+              drop:
+              - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsGroup: 0
             runAsNonRoot: false
             runAsUser: 0
         volumes:
@@ -291,7 +305,14 @@ items:
               cpu: 100m
               memory: 128Mi
           securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1337
+            runAsNonRoot: true
             runAsUser: 1337
           volumeMounts:
           - mountPath: /etc/istio/proxy
@@ -326,9 +347,15 @@ items:
               cpu: 10m
               memory: 10Mi
           securityContext:
+            allowPrivilegeEscalation: false
             capabilities:
               add:
               - NET_ADMIN
+              drop:
+              - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsGroup: 0
             runAsNonRoot: false
             runAsUser: 0
         volumes: