Chart: Tighten securityContexts and Pod Security Policies.

[Gacko]

What this PR does / why we need it:

This PR tightens the security context settings of all the containers involved in the chart. The single commits contain detailed information about what has been changed and why.

I first of all fixed some minor issues in the values.yaml, improved the documentation and aligned & improved both the helpers and the templating itself, before I actually applied more restrictive default values in the values.yaml and the Pod Security Policies. This brings the chart a big step forward to being compliant with the Pod Security Standards profile Restricted.

I'm aware of Pod Security Policies being deprecated since Kubernetes v1.21.0 and removed in v1.25.0. But since there probably are several users out there still running on Kubernetes v1.24.0 or below, it could make sense to provide a chart compatible and well prepared for moving to Pod Security Standards in Kubernetes v1.25.0 and above.

This is why I also put some effort into the still existing Pod Security Policies. I did not add any new resources related to them, only refactored the templating and tightened their default values, and so they still can easily be removed once support for v1.24.0 and below gets dropped.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• CVE Report (Scanner found CVE and adding report)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation only

Which issue/s this PR fixes

How Has This Been Tested?

I spun up a Kubernetes cluster and tested the changes made in each commit separately and manually, including different values for also testing edge cases and special conditions.

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have added unit and/or e2e tests to cover my changes.
• All new and existing tests passed.

[netlify]

✅ Deploy Preview for kubernetes-ingress-nginx canceled.

Name	Link
🔨 Latest commit	3635927
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-ingress-nginx/deploys/6549d82f08b5490008c20155

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

Hi @Gacko. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[rikatz]

/hold cancel
/lgtm
Thank you!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Gacko, rikatz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• charts/ingress-nginx/OWNERS [rikatz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[strongjz]

/cherry-pick release-1.9

[k8s-infra-cherrypick-robot]

@strongjz: #10491 failed to apply on top of branch "release-1.9":

Applying: Values: Fix docs of `controller.podSecurityContext` & `controller.sysctls`.
Using index info to reconstruct a base tree...
M	charts/ingress-nginx/README.md
M	charts/ingress-nginx/values.yaml
Falling back to patching base and 3-way merge...
Auto-merging charts/ingress-nginx/values.yaml
Auto-merging charts/ingress-nginx/README.md
Applying: Values: Add missing `controller.containerSecurityContext`.
Applying: Values: Fix docs of `defaultBackend.podSecurityContext` & `defaultBackend.containerSecurityContext`.
Applying: Helpers: Rename `controller.containerSecurityContext` to `ingress-nginx.controller.containerSecurityContext`.
Using index info to reconstruct a base tree...
M	charts/ingress-nginx/templates/_helpers.tpl
M	charts/ingress-nginx/templates/controller-daemonset.yaml
M	charts/ingress-nginx/templates/controller-deployment.yaml
Falling back to patching base and 3-way merge...
Auto-merging charts/ingress-nginx/templates/controller-deployment.yaml
Auto-merging charts/ingress-nginx/templates/controller-daemonset.yaml
Auto-merging charts/ingress-nginx/templates/_helpers.tpl
Applying: Helpers: Improve `extraModules`.
Using index info to reconstruct a base tree...
M	charts/ingress-nginx/templates/_helpers.tpl
Falling back to patching base and 3-way merge...
Auto-merging charts/ingress-nginx/templates/_helpers.tpl
CONFLICT (content): Merge conflict in charts/ingress-nginx/templates/_helpers.tpl
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0005 Helpers: Improve `extraModules`.
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.