mirror of
https://github.com/kyverno/kyverno.git
synced 2025-04-18 02:06:52 +00:00
Merge pull request #1208 from kyverno/1207_add_security_context
1207 add security context
This commit is contained in:
Jim Bugwadia
GitHub
commit
51bfc494e0
10 changed files with 112 additions and 21 deletions
charts/kyverno/templates
definitions
pkg
scripts
|
|
@ -41,6 +41,15 @@ spec:
|
|||
- name: kyverno-pre
|
||||
image: {{ .Values.initImage.repository }}:{{ default .Chart.AppVersion (default .Values.image.tag .Values.initImage.tag) }}
|
||||
imagePullPolicy: {{ default .Values.image.pullPolicy .Values.initImage.pullPolicy }}
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
containers:
|
||||
- name: kyverno
|
||||
image: {{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
|
||||
|
|
@ -51,8 +60,17 @@ spec:
|
|||
{{- with .Values.resources }}
|
||||
resources: {{ tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
ports:
|
||||
- containerPort: 443
|
||||
- containerPort: 9443
|
||||
name: https
|
||||
protocol: TCP
|
||||
env:
|
||||
|
|
|
|||
|
|
@ -1043,7 +1043,7 @@ metadata:
|
|||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 443
|
||||
targetPort: https
|
||||
selector:
|
||||
app: kyverno
|
||||
---
|
||||
|
|
@ -1091,7 +1091,9 @@ spec:
|
|||
timeoutSeconds: 5
|
||||
name: kyverno
|
||||
ports:
|
||||
- containerPort: 443
|
||||
- containerPort: 9443
|
||||
name: https
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 4
|
||||
httpGet:
|
||||
|
|
@ -1108,8 +1110,28 @@ spec:
|
|||
requests:
|
||||
cpu: 100m
|
||||
memory: 50Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
initContainers:
|
||||
- image: nirmata/kyvernopre:v1.2.0
|
||||
imagePullPolicy: Always
|
||||
name: kyverno-pre
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
serviceAccountName: kyverno-service-account
|
||||
|
|
|
|||
|
|
@ -1043,6 +1043,6 @@ metadata:
|
|||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 443
|
||||
targetPort: https
|
||||
selector:
|
||||
app: kyverno
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ metadata:
|
|||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 443
|
||||
targetPort: https
|
||||
selector:
|
||||
app: kyverno
|
||||
---
|
||||
|
|
|
|||
|
|
@ -17,13 +17,24 @@ spec:
|
|||
app: kyverno
|
||||
spec:
|
||||
serviceAccountName: kyverno-service-account
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
initContainers:
|
||||
- name: kyverno-pre
|
||||
image: nirmata/kyvernopre:v1.1.9
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
containers:
|
||||
- name: kyverno
|
||||
image: nirmata/kyverno:v1.1.9
|
||||
image: nirmata/kyverno:latest
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
- "--filterK8Resources=[Event,*,*][*,kube-system,*][*,kube-public,*][*,kube-node-lease,*][Node,*,*][APIService,*,*][TokenReview,*,*][SubjectAccessReview,*,*][*,kyverno,*][Binding,*,*][ReplicaSet,*,*]"
|
||||
|
|
@ -33,7 +44,9 @@ spec:
|
|||
# - "--profile"
|
||||
- "-v=2"
|
||||
ports:
|
||||
- containerPort: 443
|
||||
- containerPort: 9443
|
||||
name: https
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: INIT_CONFIG
|
||||
value: init-config
|
||||
|
|
@ -43,6 +56,15 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: KYVERNO_SVC
|
||||
value: kyverno-svc
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
resources:
|
||||
requests:
|
||||
memory: "50Mi"
|
||||
|
|
@ -52,7 +74,7 @@ spec:
|
|||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health/liveness
|
||||
port: 443
|
||||
port: 9443
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
|
|
@ -62,11 +84,10 @@ spec:
|
|||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health/readiness
|
||||
port: 443
|
||||
port: 9443
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 4
|
||||
successThreshold: 1
|
||||
|
||||
|
|
|
|||
|
|
@ -1043,7 +1043,7 @@ metadata:
|
|||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 443
|
||||
targetPort: https
|
||||
selector:
|
||||
app: kyverno
|
||||
---
|
||||
|
|
@ -1091,7 +1091,9 @@ spec:
|
|||
timeoutSeconds: 5
|
||||
name: kyverno
|
||||
ports:
|
||||
- containerPort: 443
|
||||
- containerPort: 9443
|
||||
name: https
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 4
|
||||
httpGet:
|
||||
|
|
@ -1108,8 +1110,28 @@ spec:
|
|||
requests:
|
||||
cpu: 100m
|
||||
memory: 50Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
initContainers:
|
||||
- image: nirmata/kyvernopre:v1.2.0
|
||||
imagePullPolicy: Always
|
||||
name: kyverno-pre
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
serviceAccountName: kyverno-service-account
|
||||
|
|
|
|||
|
|
@ -5,8 +5,12 @@ import (
|
|||
"strconv"
|
||||
)
|
||||
|
||||
// convertToString converts value to string
|
||||
func convertToString(value interface{}) (string, error) {
|
||||
// convertNumberToString converts value to string
|
||||
func convertNumberToString(value interface{}) (string, error) {
|
||||
if value == nil {
|
||||
return "0", nil
|
||||
}
|
||||
|
||||
switch typed := value.(type) {
|
||||
case string:
|
||||
return string(typed), nil
|
||||
|
|
@ -17,7 +21,7 @@ func convertToString(value interface{}) (string, error) {
|
|||
case int:
|
||||
return strconv.Itoa(typed), nil
|
||||
default:
|
||||
return "", fmt.Errorf("Could not convert %T to string", value)
|
||||
return "", fmt.Errorf("could not convert %v to string", typed)
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -224,7 +224,7 @@ func validateString(log logr.Logger, value interface{}, pattern string, operator
|
|||
// validateNumberWithStr compares quantity if pattern type is quantity
|
||||
// or a wildcard match to pattern string
|
||||
func validateNumberWithStr(log logr.Logger, value interface{}, pattern string, operator operator.Operator) bool {
|
||||
typedValue, err := convertToString(value)
|
||||
typedValue, err := convertNumberToString(value)
|
||||
if err != nil {
|
||||
log.Error(err, "failed to convert to string")
|
||||
return false
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ import (
|
|||
|
||||
// WebhookServer contains configured TLS server with MutationWebhook.
|
||||
type WebhookServer struct {
|
||||
server http.Server
|
||||
server *http.Server
|
||||
client *client.Client
|
||||
kyvernoClient *kyvernoclient.Clientset
|
||||
|
||||
|
|
@ -209,8 +209,8 @@ func NewWebhookServer(
|
|||
w.WriteHeader(http.StatusOK)
|
||||
})
|
||||
|
||||
ws.server = http.Server{
|
||||
Addr: ":443", // Listen on port for HTTPS requests
|
||||
ws.server = &http.Server{
|
||||
Addr: ":9443", // Listen on port for HTTPS requests
|
||||
TLSConfig: &tlsConfig,
|
||||
Handler: mux,
|
||||
ReadTimeout: 15 * time.Second,
|
||||
|
|
@ -507,12 +507,12 @@ func (ws *WebhookServer) RunAsync(stopCh <-chan struct{}) {
|
|||
logger.Info("failed to sync informer cache")
|
||||
}
|
||||
|
||||
go func(ws *WebhookServer) {
|
||||
go func () {
|
||||
logger.V(3).Info("started serving requests", "addr", ws.server.Addr)
|
||||
if err := ws.server.ListenAndServeTLS("", ""); err != http.ErrServerClosed {
|
||||
logger.Error(err, "failed to listen to requests")
|
||||
}
|
||||
}(ws)
|
||||
}()
|
||||
logger.Info("starting")
|
||||
|
||||
// verifies if the admission control is enabled and active
|
||||
|
|
|
|||
|
|
@ -20,6 +20,10 @@ monitor_timeout() {
|
|||
local -r wait_pid="$1"
|
||||
sleep "${timeout}"
|
||||
echo "Timeout ${timeout} exceeded" >&2
|
||||
kubectl --namespace "${namespace}" get pods
|
||||
docker images | grep "kyverno"
|
||||
kubectl --namespace "${namespace}" describe deployment "${deployment}" -o yaml
|
||||
kubectl --namespace "${namespace}" logs -l app=kyverno
|
||||
kill "${wait_pid}"
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue