Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(shield): [SMAGENT-8138] add full securityContext to host-shield chart #2114

Merged
merged 4 commits into from
Jan 17, 2025
Merged

feat(shield): [SMAGENT-8138] add full securityContext to host-shield chart #2114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6ac5bfd
feat(shield): [SMAGENT-8138] add full securityContext to host-shield …
iurly Jan 15, 2025
d204b2e
Merge branch 'main' into SMAGENT-8138-shield-full-securitycontext
iurly Jan 16, 2025
6c9d175
Merge remote-tracking branch 'origin/main' into SMAGENT-8138-shield-f…
iurly Jan 17, 2025
62225f2
bump chart version
iurly Jan 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/shield/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,5 @@ maintainers:
- name: mavimo
email: [email protected]
type: application
version: 0.6.2
version: 0.6.3
appVersion: "1.0.0"
4 changes: 4 additions & 0 deletions charts/shield/templates/host/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,8 +156,12 @@ true
privileged: true
runAsNonRoot: false
runAsUser: 0
runAsGroup: 0
readOnlyRootFilesystem: false
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
{{- else }}
allowPrivilegeEscalation: false
seccompProfile:
Expand Down
4 changes: 4 additions & 0 deletions charts/shield/templates/host/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,13 @@ spec:
securityContext:
privileged: true
runAsNonRoot: false
runAsGroup: 0
runAsUser: 0
readOnlyRootFilesystem: false
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
resources:
{{- (include "host.kmodule_resources" .) | nindent 12 }}
env:
Expand Down
35 changes: 35 additions & 0 deletions charts/shield/tests/host/security_context_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,10 @@ tests:
readOnlyRootFilesystem: false
runAsNonRoot: false
runAsUser: 0
runAsGroup: 0
capabilities:
drop:
- ALL

- it: Ensure the securityContext for a non-privileged agent contains the keys defined
set:
Expand Down Expand Up @@ -126,3 +130,34 @@ tests:
- SYS_TIME
- SYS_TTY_CONFIG
- WAKE_ALARM
- it: Ensure the securityContext contains the mandatory keys
asserts:
- isSubset:
path: spec.template.spec['initContainers','containers'][:].securityContext.capabilities
content:
drop:
- ALL
- exists:
path: spec.template.spec.initContainers[:].securityContext.runAsNonRoot
- exists:
path: spec.template.spec.containers[:].securityContext.runAsNonRoot
- exists:
path: spec.template.spec.initContainers[:].securityContext.runAsUser
- exists:
path: spec.template.spec.containers[:].securityContext.runAsUser
- exists:
path: spec.template.spec.initContainers[:].securityContext.runAsGroup
- exists:
path: spec.template.spec.containers[:].securityContext.runAsGroup
- exists:
path: spec.template.spec.initContainers[:].securityContext.privileged
- exists:
path: spec.template.spec.containers[:].securityContext.privileged
- exists:
path: spec.template.spec.initContainers[:].securityContext.allowPrivilegeEscalation
- exists:
path: spec.template.spec.containers[:].securityContext.allowPrivilegeEscalation
- exists:
path: spec.template.spec.initContainers[:].securityContext.readOnlyRootFilesystem
- exists:
path: spec.template.spec.containers[:].securityContext.readOnlyRootFilesystem
Loading