Skip to content

Commit

Permalink
Container Security Context (#332)
Browse files Browse the repository at this point in the history 
Allow setting a custom security context on containers.
  • Loading branch information
@owais
owais authored Jul 6, 2021
1 parent ed25cb2 commit f6a55f6
Show file tree
Hide file tree
Showing 9 changed files with 326 additions and 8 deletions.
1 change: 0 additions & 1 deletion PROJECT
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,4 +12,3 @@ resources:
version: "3"
plugins:
manifests.sdk.operatorframework.io/v2: {}
scorecard.sdk.operatorframework.io/v2: {}
5 changes: 5 additions & 0 deletions api/v1alpha1/opentelemetrycollector_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,11 @@ type OpenTelemetryCollectorSpec struct {
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors=true
ServiceAccount string `json:"serviceAccount,omitempty"`

// SecurityContext will be set as the container security context.
// +optional
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors=true
SecurityContext *v1.SecurityContext `json:"securityContext,omitempty"`

// VolumeClaimTemplates will provide stable storage using PersistentVolumes. Only available when the mode=statefulset.
// +optional
// +listType=atomic
Expand Down
5 changes: 5 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion bundle/manifests/opentelemetry-operator.clusterserviceversion.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ metadata:
containerImage: quay.io/opentelemetry/opentelemetry-operator
createdAt: "2020-12-16T13:37:00+00:00"
description: Provides the OpenTelemetry components, including the Collector
operators.operatorframework.io/builder: operator-sdk-v1.8.0+git
operators.operatorframework.io/builder: operator-sdk-v1.9.0
operators.operatorframework.io/project_layout: go.kubebuilder.io/v2
repository: github.com/open-telemetry/opentelemetry-operator
support: OpenTelemetry Community
Expand Down
139 changes: 139 additions & 0 deletions bundle/manifests/opentelemetry.io_opentelemetrycollectors.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -288,6 +288,145 @@ spec:
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
type: object
securityContext:
description: SecurityContext will be set as the container security
context.
properties:
allowPrivilegeEscalation:
description: 'AllowPrivilegeEscalation controls whether a process
can gain more privileges than its parent process. This bool
directly controls if the no_new_privs flag will be set on the
container process. AllowPrivilegeEscalation is true always when
the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN'
type: boolean
capabilities:
description: The capabilities to add/drop when running containers.
Defaults to the default set of capabilities granted by the container
runtime.
properties:
add:
description: Added capabilities
items:
description: Capability represent POSIX capabilities type
type: string
type: array
drop:
description: Removed capabilities
items:
description: Capability represent POSIX capabilities type
type: string
type: array
type: object
privileged:
description: Run container in privileged mode. Processes in privileged
containers are essentially equivalent to root on the host. Defaults
to false.
type: boolean
procMount:
description: procMount denotes the type of proc mount to use for
the containers. The default is DefaultProcMount which uses the
container runtime defaults for readonly paths and masked paths.
This requires the ProcMountType feature flag to be enabled.
type: string
readOnlyRootFilesystem:
description: Whether this container has a read-only root filesystem.
Default is false.
type: boolean
runAsGroup:
description: The GID to run the entrypoint of the container process.
Uses runtime default if unset. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
format: int64
type: integer
runAsNonRoot:
description: Indicates that the container must run as a non-root
user. If true, the Kubelet will validate the image at runtime
to ensure that it does not run as UID 0 (root) and fail to start
the container if it does. If unset or false, no such validation
will be performed. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
type: boolean
runAsUser:
description: The UID to run the entrypoint of the container process.
Defaults to user specified in image metadata if unspecified.
May also be set in PodSecurityContext. If set in both SecurityContext
and PodSecurityContext, the value specified in SecurityContext
takes precedence.
format: int64
type: integer
seLinuxOptions:
description: The SELinux context to be applied to the container.
If unspecified, the container runtime will allocate a random
SELinux context for each container. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
properties:
level:
description: Level is SELinux level label that applies to
the container.
type: string
role:
description: Role is a SELinux role label that applies to
the container.
type: string
type:
description: Type is a SELinux type label that applies to
the container.
type: string
user:
description: User is a SELinux user label that applies to
the container.
type: string
type: object
seccompProfile:
description: The seccomp options to use by this container. If
seccomp options are provided at both the pod & container level,
the container options override the pod options.
properties:
localhostProfile:
description: localhostProfile indicates a profile defined
in a file on the node should be used. The profile must be
preconfigured on the node to work. Must be a descending
path, relative to the kubelet's configured seccomp profile
location. Must only be set if type is "Localhost".
type: string
type:
description: "type indicates which kind of seccomp profile
will be applied. Valid options are: \n Localhost - a profile
defined in a file on the node should be used. RuntimeDefault
- the container runtime default profile should be used.
Unconfined - no profile should be applied."
type: string
required:
- type
type: object
windowsOptions:
description: The Windows specific settings applied to all containers.
If unspecified, the options from the PodSecurityContext will
be used. If set in both SecurityContext and PodSecurityContext,
the value specified in SecurityContext takes precedence.
properties:
gmsaCredentialSpec:
description: GMSACredentialSpec is where the GMSA admission
webhook (https://github.com/kubernetes-sigs/windows-gmsa)
inlines the contents of the GMSA credential spec named by
the GMSACredentialSpecName field.
type: string
gmsaCredentialSpecName:
description: GMSACredentialSpecName is the name of the GMSA
credential spec to use.
type: string
runAsUserName:
description: The UserName in Windows to run the entrypoint
of the container process. Defaults to the user specified
in image metadata if unspecified. May also be set in PodSecurityContext.
If set in both SecurityContext and PodSecurityContext, the
value specified in SecurityContext takes precedence.
type: string
type: object
type: object
serviceAccount:
description: ServiceAccount indicates the name of an existing service
account to use with this instance.
Expand Down
139 changes: 139 additions & 0 deletions config/crd/bases/opentelemetry.io_opentelemetrycollectors.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,145 @@ spec:
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
type: object
securityContext:
description: SecurityContext will be set as the container security
context.
properties:
allowPrivilegeEscalation:
description: 'AllowPrivilegeEscalation controls whether a process
can gain more privileges than its parent process. This bool
directly controls if the no_new_privs flag will be set on the
container process. AllowPrivilegeEscalation is true always when
the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN'
type: boolean
capabilities:
description: The capabilities to add/drop when running containers.
Defaults to the default set of capabilities granted by the container
runtime.
properties:
add:
description: Added capabilities
items:
description: Capability represent POSIX capabilities type
type: string
type: array
drop:
description: Removed capabilities
items:
description: Capability represent POSIX capabilities type
type: string
type: array
type: object
privileged:
description: Run container in privileged mode. Processes in privileged
containers are essentially equivalent to root on the host. Defaults
to false.
type: boolean
procMount:
description: procMount denotes the type of proc mount to use for
the containers. The default is DefaultProcMount which uses the
container runtime defaults for readonly paths and masked paths.
This requires the ProcMountType feature flag to be enabled.
type: string
readOnlyRootFilesystem:
description: Whether this container has a read-only root filesystem.
Default is false.
type: boolean
runAsGroup:
description: The GID to run the entrypoint of the container process.
Uses runtime default if unset. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
format: int64
type: integer
runAsNonRoot:
description: Indicates that the container must run as a non-root
user. If true, the Kubelet will validate the image at runtime
to ensure that it does not run as UID 0 (root) and fail to start
the container if it does. If unset or false, no such validation
will be performed. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
type: boolean
runAsUser:
description: The UID to run the entrypoint of the container process.
Defaults to user specified in image metadata if unspecified.
May also be set in PodSecurityContext. If set in both SecurityContext
and PodSecurityContext, the value specified in SecurityContext
takes precedence.
format: int64
type: integer
seLinuxOptions:
description: The SELinux context to be applied to the container.
If unspecified, the container runtime will allocate a random
SELinux context for each container. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
properties:
level:
description: Level is SELinux level label that applies to
the container.
type: string
role:
description: Role is a SELinux role label that applies to
the container.
type: string
type:
description: Type is a SELinux type label that applies to
the container.
type: string
user:
description: User is a SELinux user label that applies to
the container.
type: string
type: object
seccompProfile:
description: The seccomp options to use by this container. If
seccomp options are provided at both the pod & container level,
the container options override the pod options.
properties:
localhostProfile:
description: localhostProfile indicates a profile defined
in a file on the node should be used. The profile must be
preconfigured on the node to work. Must be a descending
path, relative to the kubelet's configured seccomp profile
location. Must only be set if type is "Localhost".
type: string
type:
description: "type indicates which kind of seccomp profile
will be applied. Valid options are: \n Localhost - a profile
defined in a file on the node should be used. RuntimeDefault
- the container runtime default profile should be used.
Unconfined - no profile should be applied."
type: string
required:
- type
type: object
windowsOptions:
description: The Windows specific settings applied to all containers.
If unspecified, the options from the PodSecurityContext will
be used. If set in both SecurityContext and PodSecurityContext,
the value specified in SecurityContext takes precedence.
properties:
gmsaCredentialSpec:
description: GMSACredentialSpec is where the GMSA admission
webhook (https://github.com/kubernetes-sigs/windows-gmsa)
inlines the contents of the GMSA credential spec named by
the GMSACredentialSpecName field.
type: string
gmsaCredentialSpecName:
description: GMSACredentialSpecName is the name of the GMSA
credential spec to use.
type: string
runAsUserName:
description: The UserName in Windows to run the entrypoint
of the container process. Defaults to the user specified
in image metadata if unspecified. May also be set in PodSecurityContext.
If set in both SecurityContext and PodSecurityContext, the
value specified in SecurityContext takes precedence.
type: string
type: object
type: object
serviceAccount:
description: ServiceAccount indicates the name of an existing service
account to use with this instance.
Expand Down
3 changes: 3 additions & 0 deletions docs/otelcol_cr_spec.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,9 @@ spec:
// +optional Resources to set on the OpenTelemetry Collector pods.
resources: {}
// +optional SecurityContext will be set as the container security context.
securityContext: {}
// +optional Toleration to schedule OpenTelemetry Collector pods.
// This is only relevant to daemonsets, statefulsets and deployments
Expand Down
13 changes: 7 additions & 6 deletions pkg/collector/container.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,11 +69,12 @@ func Container(cfg config.Config, logger logr.Logger, otelcol v1alpha1.OpenTelem
}

return corev1.Container{
Name: naming.Container(),
Image: image,
VolumeMounts: volumeMounts,
Args: args,
Env: envVars,
Resources: otelcol.Spec.Resources,
Name: naming.Container(),
Image: image,
VolumeMounts: volumeMounts,
Args: args,
Env: envVars,
Resources: otelcol.Spec.Resources,
SecurityContext: otelcol.Spec.SecurityContext,
}
}
Loading

0 comments on commit f6a55f6

Please sign in to comment.