From 20f9df01c2dbcab6224af6b09ae031c5f8937b3b Mon Sep 17 00:00:00 2001 From: stefanprodan Date: Fri, 5 Jul 2019 16:47:41 +0300 Subject: [PATCH 1/3] Add pod security policy to Helm chart - disable privileged, hostIPC, hostNetwork and hostPID - add psp flag to chart readme --- charts/flagger/README.md | 1 + charts/flagger/templates/psp.yaml | 66 +++++++++++++++++++++++++++++++ charts/flagger/values.yaml | 2 + 3 files changed, 69 insertions(+) create mode 100644 charts/flagger/templates/psp.yaml diff --git a/charts/flagger/README.md b/charts/flagger/README.md index 9a2492d6..b5edc50d 100644 --- a/charts/flagger/README.md +++ b/charts/flagger/README.md @@ -53,6 +53,7 @@ Parameter | Description | Default `slack.channel` | Slack channel | None `slack.user` | Slack username | `flagger` `rbac.create` | if `true`, create and use RBAC resources | `true` +`rbac.pspEnabled` | If `true`, create and use a restricted pod security policy | `false` `crd.create` | if `true`, create Flagger's CRDs | `true` `resources.requests/cpu` | pod CPU request | `10m` `resources.requests/memory` | pod memory request | `32Mi` diff --git a/charts/flagger/templates/psp.yaml b/charts/flagger/templates/psp.yaml new file mode 100644 index 00000000..6a103739 --- /dev/null +++ b/charts/flagger/templates/psp.yaml @@ -0,0 +1,66 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "flagger.fullname" . }} + labels: + helm.sh/chart: {{ template "flagger.chart" . }} + app.kubernetes.io/name: {{ template "flagger.name" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' +spec: + privileged: false + hostIPC: false + hostNetwork: false + hostPID: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + allowedCapabilities: + - '*' + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - '*' +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "flagger.fullname" . }}-psp + labels: + helm.sh/chart: {{ template "flagger.chart" . }} + app.kubernetes.io/name: {{ template "flagger.name" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +rules: + - apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "flagger.fullname" . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "flagger.fullname" . }}-psp + labels: + helm.sh/chart: {{ template "flagger.chart" . }} + app.kubernetes.io/name: {{ template "flagger.name" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "flagger.fullname" . }}-psp +subjects: + - kind: ServiceAccount + name: {{ template "flagger.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/flagger/values.yaml b/charts/flagger/values.yaml index 8a55da93..1b6e90dd 100644 --- a/charts/flagger/values.yaml +++ b/charts/flagger/values.yaml @@ -28,6 +28,8 @@ serviceAccount: rbac: # rbac.create: `true` if rbac resources should be created create: true + # rbac.pspEnabled: `true` if PodSecurityPolicy resources should be created + pspEnabled: false crd: # crd.create: `true` if custom resource definitions should be created From f0add9a67c924df4800f8135e24ab05127c55ebf Mon Sep 17 00:00:00 2001 From: stefanprodan Date: Fri, 5 Jul 2019 17:10:05 +0300 Subject: [PATCH 2/3] Use a role binding for the PSP rbac --- charts/flagger/templates/psp.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/flagger/templates/psp.yaml b/charts/flagger/templates/psp.yaml index 6a103739..516c9738 100644 --- a/charts/flagger/templates/psp.yaml +++ b/charts/flagger/templates/psp.yaml @@ -47,7 +47,7 @@ rules: - {{ template "flagger.fullname" . }} --- apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding +kind: RoleBinding metadata: name: {{ template "flagger.fullname" . }}-psp labels: From 48fac4e87633b85499048fa4363867e544a2d03e Mon Sep 17 00:00:00 2001 From: stefanprodan Date: Sat, 6 Jul 2019 10:38:17 +0300 Subject: [PATCH 3/3] Disable privilege escalation --- charts/flagger/templates/psp.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/flagger/templates/psp.yaml b/charts/flagger/templates/psp.yaml index 516c9738..8e314591 100644 --- a/charts/flagger/templates/psp.yaml +++ b/charts/flagger/templates/psp.yaml @@ -16,7 +16,7 @@ spec: hostNetwork: false hostPID: false readOnlyRootFilesystem: false - allowPrivilegeEscalation: true + allowPrivilegeEscalation: false allowedCapabilities: - '*' fsGroup: