From 02929cfc449f6dc77efe758278bc2333c2857640 Mon Sep 17 00:00:00 2001 From: "KHIYANI, RAHUL (rk0850)" Date: Mon, 29 Jun 2020 17:28:33 -0500 Subject: [PATCH] Implement helm-toolkit snippet to shipyard pods/containers This updates the shipyard chart to include the pod security context on the pod template. This also adds the container security context to set readOnlyRootFilesystem flag to true Change-Id: I2ffe17fc7d42aa5544e606f3a354496a64005640 --- .../templates/job-shipyard-db-auxiliary.yaml | 2 ++ .../templates/job-shipyard-db-init.yaml | 2 ++ .../templates/job-shipyard-db-sync.yaml | 2 ++ .../templates/tests/test-shipyard-api.yaml | 2 ++ charts/shipyard/values.yaml | 28 +++++++++++++++++++ 5 files changed, 36 insertions(+) diff --git a/charts/shipyard/templates/job-shipyard-db-auxiliary.yaml b/charts/shipyard/templates/job-shipyard-db-auxiliary.yaml index 32845f6d..99f7cf8b 100644 --- a/charts/shipyard/templates/job-shipyard-db-auxiliary.yaml +++ b/charts/shipyard/templates/job-shipyard-db-auxiliary.yaml @@ -36,6 +36,7 @@ spec: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ dict "envAll" $envAll "podName" "shipyard-db-auxiliary" "containerNames" (list "init" "shipyard-db-auxiliary") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: +{{ dict "envAll" $envAll "application" "db_auxiliary" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} restartPolicy: OnFailure nodeSelector: @@ -47,6 +48,7 @@ spec: image: {{ .Values.images.tags.shipyard_db_auxiliary | quote }} imagePullPolicy: {{ .Values.images.pull_policy | quote }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.shipyard_db_auxiliary | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "db_auxiliary" "container" "shipyard_db_auxiliary" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: DB_HOST valueFrom: diff --git a/charts/shipyard/templates/job-shipyard-db-init.yaml b/charts/shipyard/templates/job-shipyard-db-init.yaml index 1e31edf8..3f8b43bb 100644 --- a/charts/shipyard/templates/job-shipyard-db-init.yaml +++ b/charts/shipyard/templates/job-shipyard-db-init.yaml @@ -36,6 +36,7 @@ spec: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ dict "envAll" $envAll "podName" "shipyard-db-init" "containerNames" (list "init" "shipyard-db-init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: +{{ dict "envAll" $envAll "application" "db_init" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} restartPolicy: OnFailure nodeSelector: @@ -47,6 +48,7 @@ spec: image: {{ .Values.images.tags.shipyard_db_init | quote }} imagePullPolicy: {{ .Values.images.pull_policy | quote }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.shipyard_db_init | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "db_init" "container" "shipyard_db_init" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: DB_HOST valueFrom: diff --git a/charts/shipyard/templates/job-shipyard-db-sync.yaml b/charts/shipyard/templates/job-shipyard-db-sync.yaml index af88bada..025e6b82 100644 --- a/charts/shipyard/templates/job-shipyard-db-sync.yaml +++ b/charts/shipyard/templates/job-shipyard-db-sync.yaml @@ -36,6 +36,7 @@ spec: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ dict "envAll" $envAll "podName" "shipyard-db-sync" "containerNames" (list "init" "shipyard-db-sync") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: +{{ dict "envAll" $envAll "application" "db_sync" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} restartPolicy: OnFailure nodeSelector: @@ -47,6 +48,7 @@ spec: image: {{ .Values.images.tags.shipyard_db_sync }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.shipyard_db_sync | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "db_sync" "container" "shipyard_db_sync" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: SHIPYARD_CONFIG_FILE value: /etc/shipyard/shipyard.conf diff --git a/charts/shipyard/templates/tests/test-shipyard-api.yaml b/charts/shipyard/templates/tests/test-shipyard-api.yaml index 84e3ed9d..b2ddc039 100644 --- a/charts/shipyard/templates/tests/test-shipyard-api.yaml +++ b/charts/shipyard/templates/tests/test-shipyard-api.yaml @@ -30,6 +30,7 @@ metadata: labels: {{ tuple $envAll "shipyard" "api-test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }} spec: +{{ dict "envAll" $envAll "application" "api_test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }} restartPolicy: Never nodeSelector: {{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }} @@ -41,6 +42,7 @@ spec: image: {{ .Values.images.tags.shipyard }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple . .Values.pod.resources.test.shipyard | include "helm-toolkit.snippets.kubernetes_resources" | indent 6 }} +{{ dict "envAll" $envAll "application" "api_test" "container" "shipyard_api_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }} command: ["/bin/bash", "-c", "curl -v -X GET --fail ${SHIPYARD_URL}/api/v1.0/health; exit $?"] ... {{- end }} diff --git a/charts/shipyard/values.yaml b/charts/shipyard/values.yaml index 61d1336c..7cec01b2 100644 --- a/charts/shipyard/values.yaml +++ b/charts/shipyard/values.yaml @@ -783,6 +783,34 @@ pod: airflow_logrotate: readOnlyRootFilesystem: true allowPrivilegeEscalation: false + db_auxiliary: + pod: + runAsUser: 1000 + container: + shipyard_db_auxiliary: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + db_init: + pod: + runAsUser: 1000 + container: + shipyard_db_init: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + db_sync: + pod: + runAsUser: 1000 + container: + shipyard_db_sync: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + api_test: + pod: + runAsUser: 1000 + container: + shipyard_api_test: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false mounts: airflow_scheduler: # TODO: This is only used if the standalone scheduler is enabled.