TRIVIAL add possibility to disable privilege escalation (#132)

TRIVIAL add possibility to disable privilege escalation
wandera · Feb 18, 2025 · e07191c · e07191c
1 parent ae7f1de
commit e07191c
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 7 deletions.
diff --git a/pkg/inject/hook.go b/pkg/inject/hook.go
@@ -61,13 +61,18 @@ type InitContainerResources struct {
 	Limits   InitContainerResourcesList `yaml:"limits"`
 }
 
+type InitContainerSecurityContext struct {
+	AllowPrivilegeEscalation *bool `yaml:"allowPrivilegeEscalation,omitempty"`
+}
+
 // WebhookConfig struct representing webhook configuration values.
 type WebhookConfig struct {
-	AnnotationPrefix string                 `yaml:"annotation-prefix,omitempty"`
-	Policy           InjectionPolicy        `yaml:"policy,omitempty"`
-	ContainerImage   string                 `yaml:"container-image,omitempty"`
-	Default          WebhookConfigDefaults  `yaml:"default,omitempty"`
-	Resources        InitContainerResources `yaml:"resources,omitempty"`
+	AnnotationPrefix string                       `yaml:"annotation-prefix,omitempty"`
+	Policy           InjectionPolicy              `yaml:"policy,omitempty"`
+	ContainerImage   string                       `yaml:"container-image,omitempty"`
+	Default          WebhookConfigDefaults        `yaml:"default,omitempty"`
+	Resources        InitContainerResources       `yaml:"resources,omitempty"`
+	SecurityContext  InitContainerSecurityContext `yaml:"securityContext,omitempty"`
 }
 
 // Webhook implements a mutating webhook for automatic config injection.

diff --git a/pkg/inject/hook_test.go b/pkg/inject/hook_test.go
@@ -21,6 +21,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
 )
 
 var (
@@ -264,6 +265,9 @@ func createWebhook(t testing.TB) (*Webhook, func()) {
 				Memory: resource.NewScaledQuantity(50, resource.Mega).String(),
 			},
 		},
+		SecurityContext: InitContainerSecurityContext{
+			AllowPrivilegeEscalation: ptr.To(false),
+		},
 	}
 
 	configBytes, err := yaml.Marshal(config)
@@ -363,7 +367,8 @@ func TestRunAndServe(t *testing.T) {
 				"image":"wanderadock/scccmd",
 				"args":["get","values","--source","http://config-service.default.svc:8080","--application","c1","--profile","default","--label","master","--destination","config.yaml"],
 				"resources":{"limits":{"cpu":"50m","memory":"50M"},"requests":{"cpu":"10m","memory":"10M"}},
-				"volumeMounts":[{"name":"config-volume","mountPath":"/config"}]
+				"volumeMounts":[{"name":"config-volume","mountPath":"/config"}],
+				"securityContext":{"allowPrivilegeEscalation":false}
 			}
 		},
 		{
@@ -464,7 +469,7 @@ func TestRunAndServe(t *testing.T) {
 					t.Fatal(err.Error())
 				}
 			}
-			testutil.AssertString(t, "got bad patch", wantPatch.String(), wantPatch.String())
+			testutil.AssertString(t, "got bad patch", wantPatch.String(), gotPatch.String())
 		})
 	}
 }

diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
@@ -107,6 +107,9 @@ func injectionData(spec *v1.PodSpec, metadata *metav1.ObjectMeta, config *Webhoo
 						"memory": resource.MustParse(config.Resources.Limits.Memory),
 					},
 				},
+				SecurityContext: &corev1.SecurityContext{
+					AllowPrivilegeEscalation: config.SecurityContext.AllowPrivilegeEscalation,
+				},
 			},
 		},
 		VolumeMounts: []corev1.VolumeMount{volumeMount},