From f715786d2ffa905b31f098b3ced197f91a9fe008 Mon Sep 17 00:00:00 2001 From: Cedric Lamoriniere Date: Mon, 6 Jul 2020 11:32:53 +0200 Subject: [PATCH] [stable/datadog] Add PSP and SCC (#22529) * [stable/datadog] Add PSP and SCC Signed-off-by: cedric lamoriniere * update after review Signed-off-by: cedric lamoriniere --- stable/datadog/CHANGELOG.md | 4 ++ stable/datadog/Chart.yaml | 2 +- stable/datadog/README.md | 9 ++- stable/datadog/ci/psp-test.yaml | 9 +++ stable/datadog/templates/agent-psp.yaml | 33 ++++++++++ stable/datadog/templates/agent-scc.yaml | 56 ++++++++++++++++ stable/datadog/values.yaml | 87 +++++++++++++++++++++---- 7 files changed, 185 insertions(+), 15 deletions(-) create mode 100644 stable/datadog/ci/psp-test.yaml create mode 100644 stable/datadog/templates/agent-psp.yaml create mode 100644 stable/datadog/templates/agent-scc.yaml diff --git a/stable/datadog/CHANGELOG.md b/stable/datadog/CHANGELOG.md index 7300ad9198..04a3c9ca38 100644 --- a/stable/datadog/CHANGELOG.md +++ b/stable/datadog/CHANGELOG.md @@ -1,5 +1,9 @@ # Datadog changelog +## 2.3.23 + +* Add the possibility to create a `PodSecurityPolicy` or a `SecurityContextConstraints` (Openshift) for the Agent's Daemonset Pods. + ## 2.3.22 * Remove duplicate imagePullSecrets diff --git a/stable/datadog/Chart.yaml b/stable/datadog/Chart.yaml index 3d154392dd..2ebfd41896 100644 --- a/stable/datadog/Chart.yaml +++ b/stable/datadog/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: datadog -version: 2.3.22 +version: 2.3.23 appVersion: "7" description: Datadog Agent keywords: diff --git a/stable/datadog/README.md b/stable/datadog/README.md index e8a32ba7d8..81e6cd69d4 100644 --- a/stable/datadog/README.md +++ b/stable/datadog/README.md @@ -370,7 +370,14 @@ helm install --name \ | `agents.customAgentConfig` | Specify custom contents for the datadog agent config (datadog.yaml). Note the `agents.useConfigMap` parameter needs to be set to `true` for this parameter to be taken into account. | `{}` | | `agents.updateStrategy` | Which update strategy to deploy the daemonset | RollingUpdate with 10% maxUnavailable | | `agents.volumes` | Additional volumes for the daemonset or deployment | `nil` | -| `agents.volumeMounts` | Additional volumeMounts for the daemonset or deployment | `nil` | +| `agents.volumeMounts` | Additional volumeMounts for the daemonset or deployment | `nil` | +| `agents.podSecurity.podSecurityPolicy.create` | If true, create a PodSecurityPolicy resource for the Agent's Pods | `False` | +| `agents.podSecurity.securityContextConstraints.create` | If true, create a SecurityContextConstraints resource for the Agent's Pods | `False` | +| `agents.podSecurity.privileged` | If true, allowed privileged containers | `False` | +| `agents.podSecurity.capabilites` | list of allowed capabilities | `[SYS_ADMIN, SYS_RESOURCE, SYS_ADMIN, IPC_LOCK]`| +| `agents.podSecurity.volumes` | list of allowed volumes types | `[configMap,downwardAPI,emptyDir,ostPath,secret]`| +| `agents.podSecurity.seccompProfiles` | List of allowed seccomp profiles | `["*"]` | +| `agents.podSecurity.apparmorProfiles` | List of allowed apparmor profiles | `["*"]` | | `datadog.leaderElection` | Enable the leader Election feature | `false` | | `datadog.leaderLeaseDuration` | The duration for which a leader stays elected. | 60 sec, 15 if Cluster Checks enabled | | `datadog.collectEvents` | Enable Kubernetes event collection. Requires leader election. | `false` | diff --git a/stable/datadog/ci/psp-test.yaml b/stable/datadog/ci/psp-test.yaml new file mode 100644 index 0000000000..af4cfa0b7c --- /dev/null +++ b/stable/datadog/ci/psp-test.yaml @@ -0,0 +1,9 @@ +# Empty values file for testing default parameters. +datadog: + apiKey: "00000000000000000000000000000000" + appKey: "0000000000000000000000000000000000000000" + +agents: + podSecurity: + podSecurityPolicy: + create: true diff --git a/stable/datadog/templates/agent-psp.yaml b/stable/datadog/templates/agent-psp.yaml new file mode 100644 index 0000000000..51645300fa --- /dev/null +++ b/stable/datadog/templates/agent-psp.yaml @@ -0,0 +1,33 @@ +{{- if .Values.agents.podSecurity.podSecurityPolicy.create}} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "datadog.fullname" . }} + labels: + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + app.kubernetes.io/name: "{{ template "datadog.fullname" . }}" + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: {{ join "," .Values.agents.podSecurity.seccompProfiles | quote }} + apparmor.security.beta.kubernetes.io/allowedProfileNames: {{ join "," .Values.agents.podSecurity.apparmorProfiles | quote }} + seccomp.security.alpha.kubernetes.io/defaultProfileName: "runtime/default" + apparmor.security.beta.kubernetes.io/defaultProfileName: "runtime/default" +spec: + privileged: {{ .Values.agents.podSecurity.privileged }} + hostNetwork: {{ .Values.agents.useHostNetwork }} + hostPID: {{ .Values.datadog.dogstatsd.useHostPID }} + allowedCapabilities: +{{ toYaml .Values.agents.podSecurity.capabilites | indent 4 }} + volumes: +{{ toYaml .Values.agents.podSecurity.volumes | indent 4 }} + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: +{{ toYaml .Values.datadog.securityContext | indent 4 }} + supplementalGroups: + rule: RunAsAny +{{- end }} diff --git a/stable/datadog/templates/agent-scc.yaml b/stable/datadog/templates/agent-scc.yaml new file mode 100644 index 0000000000..f018f75aa8 --- /dev/null +++ b/stable/datadog/templates/agent-scc.yaml @@ -0,0 +1,56 @@ +{{- if .Values.agents.podSecurity.securityContextConstraints.create }} +kind: SecurityContextConstraints +apiVersion: security.openshift.io/v1 +metadata: + name: {{ template "datadog.fullname" . }} + labels: + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + app.kubernetes.io/name: "{{ template "datadog.fullname" . }}" + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +users: +- system:serviceaccount:{{ .Release.Namespace }}:{{ template "datadog.fullname" . }} +priority: 10 +# Allow host ports for dsd / trace intake ++allowHostPorts: {{ or .Values.datadog.dogstatsd.useHostPort .Values.datadog.apm.enabled }} +# Allow host PID for dogstatsd origin detection +allowHostPID: {{ .Values.datadog.dogstatsd.useHostPID }} +# Allow host network for the CRIO check to reach Prometheus through localhost +allowHostNetwork: {{ .Values.agents.useHostNetwork }} +# Allow hostPath for docker / process metrics +volumes: +{{ toYaml .Values.agents.podSecurity.volumes | indent 2 }} +# Use the `spc_t` selinux type to access the +# docker/cri socket + proc and cgroup stats +seLinuxContext: +{{ toYaml .Values.datadog.securityContext | indent 2 }} +# system-probe requires some specific seccomp and capabilities +seccompProfiles: +{{ toYaml .Values.agents.podSecurity.seccompProfiles | indent 2 }} +allowedCapabilities: +{{ toYaml .Values.agents.podSecurity.capabilites | indent 2 }} +# +# The rest is copied from restricted SCC +# +allowHostDirVolumePlugin: true +allowHostIPC: false +allowPrivilegedContainer: {{ .Values.agents.podSecurity.privileged }} +allowedFlexVolumes: [] +defaultAddCapabilities: [] +fsGroup: + type: MustRunAs +readOnlyRootFilesystem: false +runAsUser: + type: RunAsAny +supplementalGroups: + type: RunAsAny +# If your environment restricts user access to the Docker socket or journald (for logging) +# create or use an existing group that has access and add the GID to +# the lines below (also remove the previous line, `type: RunAsAny`) +# type: MustRunAs +# ranges: +# - min: +# - max: +requiredDropCapabilities: [] +{{- end }} diff --git a/stable/datadog/values.yaml b/stable/datadog/values.yaml index 66204bc2c5..1e94849983 100644 --- a/stable/datadog/values.yaml +++ b/stable/datadog/values.yaml @@ -47,12 +47,13 @@ datadog: ## You can modify the security context used to run the containers by ## modifying the label type below: # - securityContext: {} - # seLinuxOptions: - # user: system_u - # role: system_r - # type: spc_t - # level: s0 + securityContext: + rule: MustRunAs + seLinuxOptions: + user: "system_u" + role: "system_r" + type: "spc_t" + level: "s0" ## @param clusterName - string - optional ## Set a unique cluster name to allow scoping hosts and Cluster Checks easily @@ -172,30 +173,30 @@ datadog: ## WARNING: Make sure that hosts using this are properly firewalled otherwise ## metrics and traces are accepted from any host able to connect to this host. # - useHostPort: # true + useHostPort: false ## @param useHostPID - boolean - optional ## Run the agent in the host's PID namespace. This is required for Dogstatsd origin ## detection to work. See https://docs.datadoghq.com/developers/dogstatsd/unix_socket/ # - useHostPID: # true + useHostPID: false ## @param nonLocalTraffic - boolean - optional - default: false ## Enable this to make each node accept non-local statsd traffic. ## ref: https://github.com/DataDog/docker-dd-agent#environment-variables # - nonLocalTraffic: # false + nonLocalTraffic: false ## @param collectEvents - boolean - optional - default: false ## Enables this to start event collection from the kubernetes API ## ref: https://docs.datadoghq.com/agent/kubernetes/event_collection/ # - collectEvents: # false + collectEvents: false ## @param leaderElection - boolean - optional - default: false ## Enables leader election mechanism for event collection. # - leaderElection: # false + leaderElection: false ## @param leaderLeaseDuration - integer - optional - default: 60 ## Set the lease time for leader election in second. @@ -216,7 +217,7 @@ datadog: ## Enable this to allow log collection for all containers. ## ref: https://docs.datadoghq.com/agent/basic_agent_usage/kubernetes/#log-collection-setup # - containerCollectAll: # false + containerCollectAll: false ## @param containerUseFiles - boolean - optional - default: true ## Collect logs from files in /var/log/pods instead of using container runtime API. @@ -665,6 +666,66 @@ agents: # serviceAccountName: default + ## @param podSecurity - object - optional + ## Provide Daemonset PodSecurityPolicy configuration + podSecurity: + + ## @param podSecurityPolicy - object - required + ## Provide Daemonset PodSecurityPolicy configuration + podSecurityPolicy: + + ## @param created - boolean - optional + ## If true, create a PodSecurityPolicy resource for Agent pods + # + create: false + + ## @param securityContextConstraints - object - required + ## Provide Daemonset securityContextConstraints configuration + securityContextConstraints: + + ## @param created - boolean - optional + ## If true, create a SecurityContextConstraints resource for Agent pods + # + create: false + + ## @param privileged - boolean - optional + ## If true, Allow to run privileged containers + # + privileged: false + + ## @param capabilites - list - optional + ## Allowed capabilites + # + capabilites: + - SYS_ADMIN + - SYS_RESOURCE + - SYS_PTRACE + - NET_ADMIN + - IPC_LOCK + + ## @param volumes - list - optional + ## Allowed volumes types + # + volumes: + - configMap + - downwardAPI + - emptyDir + - hostPath + - secret + + ## @param seccompProfiles - list - optional + ## Allowed seccomp profiles + # + seccompProfiles: + - "runtime/default" + - "localhost/system-probe" + + ## @param apparmorProfiles - list - optional + ## Allowed apparmor profiles + # + apparmorProfiles: + - "runtime/default" + containers: agent: ## @param env - list - required @@ -840,7 +901,7 @@ agents: ## WARNING: Make sure that hosts using this are properly firewalled otherwise ## metrics and traces are accepted from any host able to connect to this host. # - useHostNetwork: # true + useHostNetwork: false ## @param dnsConfig - list of objects - optional ## specify dns configuration options for datadog cluster agent containers e.g ndots