From 24b4bea632d98375db4bfc544646bf5078cacb7c Mon Sep 17 00:00:00 2001
From: Fernando Mendoza <fermendozarcs@gmail.com>
Date: Thu, 25 Jul 2019 23:05:45 +0200
Subject: [PATCH] gypsydiver/cluster autoscaler trim down psp (#15903)

* Trim down PodSecurityPolicy

Signed-off-by: Fernando Mendoza <fermendozarcs@gmail.com>

* keep extensions as psp apiGroup

Signed-off-by: Fernando Mendoza <fermendozarcs@gmail.com>

* bump chart version

Signed-off-by: Fernando Mendoza <fermendozarcs@gmail.com>

* keep extensions as psp apiGroup

Signed-off-by: Fernando Mendoza <fermendozarcs@gmail.com>

* add helm labels

Signed-off-by: Fernando Mendoza <fermendozarcs@gmail.com>

* add readme note

Signed-off-by: Fernando Mendoza <fermendozarcs@gmail.com>
---
 stable/cluster-autoscaler/Chart.yaml          |  2 +-
 stable/cluster-autoscaler/README.md           |  4 ++
 .../templates/clusterrole.yaml                |  2 +-
 .../templates/podsecuritypolicy.yaml          | 48 +++++++++++++------
 4 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/stable/cluster-autoscaler/Chart.yaml b/stable/cluster-autoscaler/Chart.yaml
index 9597b0596e..ceac63f7e7 100644
--- a/stable/cluster-autoscaler/Chart.yaml
+++ b/stable/cluster-autoscaler/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 description: Scales worker nodes within autoscaling groups.
 icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png
 name: cluster-autoscaler
-version: 2.0.0
+version: 3.0.0
 appVersion: 1.13.1
 home: https://github.com/kubernetes/autoscaler
 sources:
diff --git a/stable/cluster-autoscaler/README.md b/stable/cluster-autoscaler/README.md
index ef232cd703..97e44b17ab 100644
--- a/stable/cluster-autoscaler/README.md
+++ b/stable/cluster-autoscaler/README.md
@@ -295,3 +295,7 @@ Containers:
       --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster/<ClusterName>
       --v=4
 ```
+
+#### PodSecurityPolicy
+
+Though enough for the majority of installations, the default PodSecurityPolicy _could_ be too restrictive depending on the specifics of your release. Please make sure to check that the template fits with any customizations made or disable it by setting `rbac.pspEnabled` to `false`.
diff --git a/stable/cluster-autoscaler/templates/clusterrole.yaml b/stable/cluster-autoscaler/templates/clusterrole.yaml
index 4c9f55c81c..7fa49c4f32 100644
--- a/stable/cluster-autoscaler/templates/clusterrole.yaml
+++ b/stable/cluster-autoscaler/templates/clusterrole.yaml
@@ -112,7 +112,7 @@ rules:
     resources:
     - podsecuritypolicies
     resourceNames:
-    - privileged-{{ template "cluster-autoscaler.fullname" . }}
+    - {{ template "cluster-autoscaler.fullname" . }}
     verbs:
     - use
 {{- end -}}
diff --git a/stable/cluster-autoscaler/templates/podsecuritypolicy.yaml b/stable/cluster-autoscaler/templates/podsecuritypolicy.yaml
index 43d60570dd..f95e53816f 100644
--- a/stable/cluster-autoscaler/templates/podsecuritypolicy.yaml
+++ b/stable/cluster-autoscaler/templates/podsecuritypolicy.yaml
@@ -2,25 +2,43 @@
 apiVersion: extensions/v1beta1
 kind: PodSecurityPolicy
 metadata:
-  name: privileged-{{ template "cluster-autoscaler.fullname" . }}
+  name: {{ template "cluster-autoscaler.fullname" . }}
+  labels:
+{{ include "cluster-autoscaler.labels" . | indent 4 }}
 spec:
-  allowedCapabilities:
-  - '*'
-  fsGroup:
-    rule: RunAsAny
-  privileged: true
+  # Prevents running in privileged mode
+  privileged: false
+  # Required to prevent escalations to root.
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+    - ALL
+  volumes:
+    - 'configMap'
+    - 'secret'
+    - 'hostPath'
+  allowedHostPaths:
+    - pathPrefix: {{ .Values.sslCertHostPath }}
+{{- if eq .Values.cloudProvider "gce" }}
+    - pathPrefix: {{ .Values.cloudConfigPath }}
+{{- end }}
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
   runAsUser:
     rule: RunAsAny
   seLinux:
     rule: RunAsAny
   supplementalGroups:
-    rule: RunAsAny
-  volumes:
-  - '*'
-  hostPID: true
-  hostIPC: true
-  hostNetwork: true
-  hostPorts:
-  - min: 1
-    max: 65536
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
 {{- end }}