From 7be3e4f41053a844d07cea6e16c3ca86a2761f31 Mon Sep 17 00:00:00 2001 From: Yatish Sharma Date: Thu, 9 Jun 2022 16:25:09 +0530 Subject: [PATCH] [issue-2401] Added pod security context for Fission Components (#2449) Following component has been updated with securityContext - 1. buildermgr 2. controller 3. executor 4. kubewatcher 5. router 6. timer 7. storagesvc * Removed the security context from fetcher as per the offline discussion --- .../templates/buildermgr/deployment.yaml | 3 + .../templates/controller/deployment.yaml | 3 + .../templates/executor/deployment.yaml | 3 + .../templates/kubewatcher/deployment.yaml | 3 + .../templates/router/deployment.yaml | 3 + .../templates/storagesvc/deployment.yaml | 3 + .../templates/timer/deployment.yaml | 3 + charts/fission-all/values.yaml | 84 +++++++++++++++++++ skaffold.yaml | 6 ++ 9 files changed, 111 insertions(+) diff --git a/charts/fission-all/templates/buildermgr/deployment.yaml b/charts/fission-all/templates/buildermgr/deployment.yaml index aa28bcd4..79b12a23 100644 --- a/charts/fission-all/templates/buildermgr/deployment.yaml +++ b/charts/fission-all/templates/buildermgr/deployment.yaml @@ -19,6 +19,9 @@ spec: prometheus.io/path: "/metrics" prometheus.io/port: "8080" spec: + {{- if .Values.buildermgr.securityContext.enabled }} + securityContext: {{- omit .Values.buildermgr.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} containers: - name: buildermgr image: {{ include "fission-bundleImage" . | quote }} diff --git a/charts/fission-all/templates/controller/deployment.yaml b/charts/fission-all/templates/controller/deployment.yaml index cbb98b60..0ea273d7 100644 --- a/charts/fission-all/templates/controller/deployment.yaml +++ b/charts/fission-all/templates/controller/deployment.yaml @@ -22,6 +22,9 @@ spec: prometheus.io/path: "/metrics" prometheus.io/port: "8080" spec: + {{- if .Values.controller.securityContext.enabled }} + securityContext: {{- omit .Values.controller.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} containers: - name: controller image: {{ include "fission-bundleImage" . | quote }} diff --git a/charts/fission-all/templates/executor/deployment.yaml b/charts/fission-all/templates/executor/deployment.yaml index 1ac3cae6..7a1d67ee 100644 --- a/charts/fission-all/templates/executor/deployment.yaml +++ b/charts/fission-all/templates/executor/deployment.yaml @@ -19,6 +19,9 @@ spec: prometheus.io/path: "/metrics" prometheus.io/port: "8080" spec: + {{- if .Values.executor.securityContext.enabled }} + securityContext: {{- omit .Values.executor.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} containers: - name: executor image: {{ include "fission-bundleImage" . | quote }} diff --git a/charts/fission-all/templates/kubewatcher/deployment.yaml b/charts/fission-all/templates/kubewatcher/deployment.yaml index 02c9b376..9018ad04 100644 --- a/charts/fission-all/templates/kubewatcher/deployment.yaml +++ b/charts/fission-all/templates/kubewatcher/deployment.yaml @@ -15,6 +15,9 @@ spec: labels: svc: kubewatcher spec: + {{- if .Values.kubewatcher.securityContext.enabled }} + securityContext: {{- omit .Values.kubewatcher.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} containers: - name: kubewatcher image: {{ include "fission-bundleImage" . | quote }} diff --git a/charts/fission-all/templates/router/deployment.yaml b/charts/fission-all/templates/router/deployment.yaml index 93904e05..ab5dff60 100644 --- a/charts/fission-all/templates/router/deployment.yaml +++ b/charts/fission-all/templates/router/deployment.yaml @@ -28,6 +28,9 @@ spec: prometheus.io/path: "/metrics" prometheus.io/port: "8080" spec: + {{- if .Values.router.securityContext.enabled }} + securityContext: {{- omit .Values.router.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} containers: - name: router image: {{ include "fission-bundleImage" . | quote }} diff --git a/charts/fission-all/templates/storagesvc/deployment.yaml b/charts/fission-all/templates/storagesvc/deployment.yaml index e66e1033..d46f5e78 100644 --- a/charts/fission-all/templates/storagesvc/deployment.yaml +++ b/charts/fission-all/templates/storagesvc/deployment.yaml @@ -22,6 +22,9 @@ spec: prometheus.io/path: "/metrics" prometheus.io/port: "8080" spec: + {{- if .Values.storagesvc.securityContext.enabled }} + securityContext: {{- omit .Values.storagesvc.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} containers: - name: storagesvc image: {{ include "fission-bundleImage" . | quote }} diff --git a/charts/fission-all/templates/timer/deployment.yaml b/charts/fission-all/templates/timer/deployment.yaml index 9904771f..ee016ead 100644 --- a/charts/fission-all/templates/timer/deployment.yaml +++ b/charts/fission-all/templates/timer/deployment.yaml @@ -15,6 +15,9 @@ spec: labels: svc: timer spec: + {{- if .Values.timer.securityContext.enabled }} + securityContext: {{- omit .Values.timer.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} containers: - name: timer image: {{ include "fission-bundleImage" . | quote }} diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml index ecce7c6e..0106384b 100644 --- a/charts/fission-all/values.yaml +++ b/charts/fission-all/values.yaml @@ -143,6 +143,18 @@ executor: ## resources: {} + ## Security Context + ## It holds pod-level and container level security configuration. + ## This is an experimental section, please verify before enabling in production. + ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 + securityContext: + enabled: false + ## Mark it false, if you want to stop the non root user validation + runAsNonRoot: true + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + ## router is responsible for routing function calls to the appropriate function. ## router: @@ -248,6 +260,18 @@ router: ## resources: {} + ## Security Context + ## It holds pod-level and container level security configuration. + ## This is an experimental section, please verify before enabling in production. + ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 + securityContext: + enabled: false + ## Mark it false, if you want to stop the non root user validation + runAsNonRoot: true + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + ## The builder manager watches the package & environments CRD changes and manages the builds of function source code. ## buildermgr: @@ -262,6 +286,18 @@ buildermgr: ## resources: {} + ## Security Context + ## It holds pod-level and container level security configuration. + ## This is an experimental section, please verify before enabling in production. + ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 + securityContext: + enabled: false + ## Mark it false, if you want to stop the non root user validation + runAsNonRoot: true + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + ## controller is the component that the client talks to. ## It contains CRUD APIs for functions, triggers, environments, Kubernetes event watches, etc. and proxy APIs to internal 3rd-party services. ## @@ -277,6 +313,18 @@ controller: ## resources: {} + ## Security Context + ## It holds pod-level and container level security configuration. + ## This is an experimental section, please verify before enabling in production. + ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 + securityContext: + enabled: false + ## Mark it false, if you want to stop the non root user validation + runAsNonRoot: true + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + ## kubewatcher watches the Kubernetes API and invokes functions associated with watches, sending the watch event to the function. ## kubewatcher: @@ -291,6 +339,18 @@ kubewatcher: ## resources: {} + ## Security Context + ## It holds pod-level and container level security configuration. + ## This is an experimental section, please verify before enabling in production. + ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 + securityContext: + enabled: false + ## Mark it false, if you want to stop the non root user validation + runAsNonRoot: true + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + ## The storage service is the home for all archives of packages with sizes larger than 256KB. ## storagesvc: @@ -305,6 +365,18 @@ storagesvc: ## resources: {} + ## Security Context + ## It holds pod-level and container level security configuration. + ## This is an experimental section, please verify before enabling in production. + ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 + securityContext: + enabled: false + ## Mark it false, if you want to stop the non root user validation + runAsNonRoot: true + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + ## The timer works like kubernetes CronJob but instead of creating a pod to do the task ## It sends a request to router to invoke the function. ## @@ -320,6 +392,18 @@ timer: ## resources: {} + ## Security Context + ## It holds pod-level and container level security configuration. + ## This is an experimental section, please verify before enabling in production. + ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 + securityContext: + enabled: false + ## Mark it false, if you want to stop the non root user validation + runAsNonRoot: true + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + ## Kafka: enable and configure the details ## kafka: diff --git a/skaffold.yaml b/skaffold.yaml index 3aec6abe..4923706e 100644 --- a/skaffold.yaml +++ b/skaffold.yaml @@ -56,6 +56,12 @@ deploy: # Use /var/log directory for kind logs export terminationMessagePath: /var/log/termination-log terminationMessagePolicy: FallbackToLogsOnError + executor.securityContext.enabled: true + router.securityContext.enabled: true + buildermgr.securityContext.enabled: true + controller.securityContext.enabled: true + kubewatcher.securityContext.enabled: true + storagesvc.securityContext.enabled: true wait: true flags: install: