From 65e72c142a842bd855387b2e3b42a746b5e9458d Mon Sep 17 00:00:00 2001 From: Sanskar Jaiswal Date: Thu, 20 Jan 2022 06:36:31 +0000 Subject: [PATCH] drop capabilities, enable seccomp and enforce runAsNonRoot Further restricts the SecurityContext that the controller runs under, by enabling the default seccomp profile and dropping all linux capabilities. This was set at container-level to ensure backwards compatibility with use cases in which sidecars are injected into the source-controller pod without setting less restrictive settings. Add a uid and gid for the container to enforce runAsNonRoot and ensure the use of non root users. BREAKING CHANGES: 1) The use of new seccomp API requires Kubernetes 1.19. 2) the controller container is now executed under 65534:65534 (userid:groupid). This change may break deployments that hard-coded the user name 'controller' in their PodSecurityPolicy. Signed-off-by: Sanskar Jaiswal Co-authored-by: Paulo Gomes --- Dockerfile | 4 +--- config/manager/deployment.yaml | 5 +++++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index e827aec6d..9dc5c48c9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -43,8 +43,6 @@ COPY --from=builder /workspace/notification-controller /usr/local/bin/ # https://github.com/gliderlabs/docker-alpine/issues/367#issuecomment-354316460 RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf -RUN addgroup -S controller && adduser -S controller -G controller - -USER controller +USER 65534:65534 ENTRYPOINT [ "/sbin/tini", "--", "notification-controller" ] diff --git a/config/manager/deployment.yaml b/config/manager/deployment.yaml index 83129f8b5..2cbbf0009 100644 --- a/config/manager/deployment.yaml +++ b/config/manager/deployment.yaml @@ -25,6 +25,11 @@ spec: securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: [ "ALL" ] + seccompProfile: + type: RuntimeDefault ports: - containerPort: 9090 name: http