Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add constraints to pod spec #80

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add constraints to pod spec #80

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3f95d97
Define user to be non-root and group
martinkennelly Mar 12, 2021
d67b77a
Set init fs to read-only and block priv esculation
martinkennelly Mar 12, 2021
d14e977
Define cpu/memory limit for init container
martinkennelly Mar 12, 2021
7d53183
Drop init container privileges
martinkennelly Mar 12, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 17 additions & 5 deletions deployments/server.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@ metadata:
name: network-resources-injector
namespace: kube-system
spec:
securityContext:
runAsUser: 10000
runAsGroup: 10000
runAsNonRoot: true
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does runAsNonRoot require setting nonRoot user in Dockerfile?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zshi-redhat Unfortunately, it seems that it does for NRI. I tried to remove both of the runAsUser and runAsGroup and I got the following error:

Error: container has runAsNonRoot and image will run as root

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@martinkennelly IIUC, we need to update Dockerfile to use non-root user, right?
If yes, would you mind updating the Dockerfile in this PR?

Copy link
Member Author

@martinkennelly martinkennelly Apr 12, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zshi-redhat Good idea. I tried it but it failed with k8 validation:

container has runAsNonRoot and image has non-numeric user (%s), cannot verify user is non-root

See the runAsNonRoot validate here: https://github.com/kubernetes/kubernetes/blob/5648200571889140ad246feb82c8f80a5946f167/pkg/kubelet/kuberuntime/security_context.go#L91

serviceAccount: network-resources-injector-sa
containers:
- name: webhook-server
Expand All @@ -39,8 +43,6 @@ spec:
fieldRef:
fieldPath: metadata.namespace
securityContext:
runAsUser: 10000
runAsGroup: 10000
capabilities:
drop:
- ALL
Expand All @@ -66,13 +68,23 @@ spec:
args:
- -name=network-resources-injector
- -namespace=kube-system
- -alsologtostderr
- -logtostderr
securityContext:
runAsUser: 10000
runAsGroup: 10000
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
volumeMounts:
- name: tls
mountPath: /etc/tls
resources:
requests:
memory: "50Mi"
cpu: "250m"
limits:
memory: "200Mi"
cpu: "500m"
volumes:
- name: tls
emptyDir: {}
Expand Down