From 4dab241ff674833bcc3460a679ace3b7828fd405 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81ngel=20Barrera=20S=C3=A1nchez?= <angel@sighup.io>
Date: Thu, 14 Nov 2019 17:00:11 +0100
Subject: [PATCH] Change daemonset definition to be more secure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Ángel Barrera Sánchez <angel@sighup.io>
---
 extras/example-serviceaccounts.yml  | 34 +++++++++++++++++++++++++----
 extras/example-with-kubeconfig.yaml | 32 +++++++++++++++++++--------
 2 files changed, 53 insertions(+), 13 deletions(-)

diff --git a/extras/example-serviceaccounts.yml b/extras/example-serviceaccounts.yml
index 7ff2bb2..9958262 100644
--- a/extras/example-serviceaccounts.yml
+++ b/extras/example-serviceaccounts.yml
@@ -25,13 +25,17 @@ spec:
         app: goldpinger
     spec:
       serviceAccount: "goldpinger-serviceaccount"
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 2000
       containers:
         - name: goldpinger
           env:
             - name: HOST
               value: "0.0.0.0"
             - name: PORT
-              value: "80"
+              value: "8080"
             # injecting real hostname will make for easier to understand graphs/metrics
             - name: HOSTNAME
               valueFrom:
@@ -42,10 +46,32 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: status.podIP
-          image: "docker.io/bloomberg/goldpinger:1.4.0"
+          image: "docker.io/bloomberg/goldpinger:2.0.0"
+          imagePullPolicy: Always
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+          resources:
+            limits:
+              memory: 80Mi
+            requests:
+              cpu: 1m
+              memory: 40Mi
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               name: http
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 20
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 20
+            periodSeconds: 5
 ---
 apiVersion: v1
 kind: Service
@@ -57,7 +83,7 @@ metadata:
 spec:
   type: NodePort
   ports:
-    - port: 80
+    - port: 8080
       nodePort: 30080
       name: http
   selector:
diff --git a/extras/example-with-kubeconfig.yaml b/extras/example-with-kubeconfig.yaml
index 8404f14..04b9135 100644
--- a/extras/example-with-kubeconfig.yaml
+++ b/extras/example-with-kubeconfig.yaml
@@ -5,20 +5,24 @@ metadata:
   name: goldpinger
   labels:
     app: goldpinger
-    version: "1.5.0"
+    version: "2.0.0"
 spec:
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
       app: goldpinger
-      version: "1.5.0"
+      version: "2.0.0"
   template:
     metadata:
       labels:
         app: goldpinger
-        version: "1.5.0"
+        version: "2.0.0"
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 2000
       # if you'd like to use a secret to inject a kubeconfig, you can do it like this
       volumes:
       - name: kubeconfig
@@ -30,7 +34,7 @@ spec:
             - name: HOST
               value: "0.0.0.0"
             - name: PORT
-              value: "80"
+              value: "8080"
             # kubeconfig needs to match the location of what's injected in the secret
             # if not specified goldpinger will default to using in-cluster config
             - name: KUBECONFIG
@@ -48,20 +52,30 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: status.podIP
-          image: "docker.io/bloomberg/goldpinger:1.5.0"
+          image: "docker.io/bloomberg/goldpinger:2.0.0"
+          imagePullPolicy: Always
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+          resources:
+            limits:
+              memory: 80Mi
+            requests:
+              cpu: 1m
+              memory: 40Mi
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               name: http
           readinessProbe:
             httpGet:
               path: /healthz
-              port: 80
+              port: 8080
             initialDelaySeconds: 20
             periodSeconds: 5
           livenessProbe:
             httpGet:
               path: /healthz
-              port: 80
+              port: 8080
             initialDelaySeconds: 20
             periodSeconds: 5
           volumeMounts:
@@ -78,7 +92,7 @@ metadata:
 spec:
   type: NodePort
   ports:
-    - port: 80
+    - port: 8080
       nodePort: 30080
       name: http
   selector: