Skip to content

Commit 6e31f0b

Browse files
jk464cognifloyd
jk464
and
cognifloyd
committed
Run containers as non-root w/o escalation privs
Co-authored-by: Jacob Floyd <[email protected]>
1 parent 80f80b4 commit 6e31f0b

File tree

6 files changed

+74
-20
lines changed

6 files changed

+74
-20
lines changed

‎templates/_helpers.tpl

+18
Original file line numberDiff line numberDiff line change
@@ -422,3 +422,21 @@ Create the custom env list for each deployment
422422
value: {{ $value | quote }}
423423
{{- end }}
424424
{{- end -}}
425+
426+
{{/*
427+
Define st2web ports
428+
*/}}
429+
{{- define "stackstorm-ha.st2web.http_port" -}}
430+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
431+
8080
432+
{{- else -}}
433+
80
434+
{{- end -}}
435+
{{- end -}}
436+
{{- define "stackstorm-ha.st2web.https_port" -}}
437+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
438+
8443
439+
{{- else -}}
440+
443
441+
{{- end -}}
442+
{{- end -}}

‎templates/deployments.yaml

+10-4
Original file line numberDiff line numberDiff line change
@@ -439,13 +439,15 @@ spec:
439439
securityContext: {{- toYaml . | nindent 10 }}
440440
{{- end }}
441441
ports:
442-
- containerPort: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary 443 80 }}
442+
{{- $https_port := include "stackstorm-ha.st2web.https_port" . }}
443+
{{- $http_port := include "stackstorm-ha.st2web.http_port" . }}
444+
- containerPort: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary $https_port $http_port }}
443445
# Probe to check if app is running. Failure will lead to a pod restart.
444446
livenessProbe:
445447
httpGet:
446448
scheme: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary "HTTPS" "HTTP" }}
447449
path: /
448-
port: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary 443 80 }}
450+
port: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary $https_port $http_port }}
449451
initialDelaySeconds: 1
450452
# Probe to check if app is ready to serve traffic. Failure will lead to temp stop serving traffic.
451453
# TODO: Failing to add readinessProbe, since st2 requires authorization (401) and we don't have `/healthz` endpoints yet (https://github.com/StackStorm/st2/issues/4020)
@@ -1644,13 +1646,17 @@ spec:
16441646
{{- end }}
16451647
volumeMounts:
16461648
- name: st2client-config-vol
1649+
{{- if eq .Values.st2.system_user.user "root" }}
16471650
mountPath: /root/.st2/
1651+
{{- else }}
1652+
mountPath: /home/{{ .Values.st2.system_user.user }}/.st2/
1653+
{{- end }}
16481654
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
16491655
command:
16501656
- 'sh'
16511657
- '-ec'
16521658
- |
1653-
cat <<EOT > /root/.st2/config
1659+
cat <<EOT > /home/stanley/.st2/config
16541660
{{- tpl .Values.st2client.st2clientConfig . | nindent 12 }}
16551661
EOT
16561662
containers:
@@ -1683,7 +1689,7 @@ spec:
16831689
{{- end }}
16841690
{{- include "stackstorm-ha.overrides-config-mounts" . | nindent 8 }}
16851691
- name: st2client-config-vol
1686-
mountPath: /root/.st2/
1692+
mountPath: /home/stanley/.st2/
16871693
- name: st2-ssh-key-vol
16881694
mountPath: {{ tpl .Values.st2.system_user.ssh_key_file . | dir | dir }}/.ssh-key-vol/
16891695
{{- if ne "disable" (default "" .Values.st2.datastore_crypto_key) }}

‎templates/jobs.yaml

+9-9
Original file line numberDiff line numberDiff line change
@@ -164,13 +164,13 @@ spec:
164164
{{- end }}
165165
volumeMounts:
166166
- name: st2client-config-vol
167-
mountPath: /root/.st2/
167+
mountPath: /home/stanley/.st2/
168168
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
169169
command:
170170
- 'sh'
171171
- '-ec'
172172
- |
173-
cat <<EOT > /root/.st2/config
173+
cat <<EOT > /home/stanley/.st2/config
174174
{{- tpl .Values.jobs.st2clientConfig . | nindent 12 }}
175175
EOT
176176
containers:
@@ -197,7 +197,7 @@ spec:
197197
{{- end }}
198198
volumeMounts:
199199
- name: st2client-config-vol
200-
mountPath: /root/.st2/
200+
mountPath: /home/stanley/.st2/
201201
- name: st2-apikeys-vol
202202
mountPath: /etc/st2/apikeys.yaml
203203
subPath: apikeys.yaml
@@ -290,13 +290,13 @@ spec:
290290
{{- end }}
291291
volumeMounts:
292292
- name: st2client-config-vol
293-
mountPath: /root/.st2/
293+
mountPath: /home/stanley/.st2/
294294
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
295295
command:
296296
- 'sh'
297297
- '-ec'
298298
- |
299-
cat <<EOT > /root/.st2/config
299+
cat <<EOT > /home/stanley/.st2/config
300300
{{- tpl .Values.jobs.st2clientConfig . | nindent 12 }}
301301
EOT
302302
containers:
@@ -325,7 +325,7 @@ spec:
325325
volumeMounts:
326326
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
327327
- name: st2client-config-vol
328-
mountPath: /root/.st2/
328+
mountPath: /home/stanley/.st2/
329329
- name: st2-kv-vol
330330
mountPath: /etc/st2/st2kv.yaml
331331
subPath: st2kv.yaml
@@ -660,13 +660,13 @@ spec:
660660
{{- end }}
661661
volumeMounts:
662662
- name: st2client-config-vol
663-
mountPath: /root/.st2/
663+
mountPath: /home/stanley/.st2/
664664
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
665665
command:
666666
- 'sh'
667667
- '-ec'
668668
- |
669-
cat <<EOT > /root/.st2/config
669+
cat <<EOT > /home/stanley/.st2/config
670670
{{- tpl $.Values.jobs.st2clientConfig $ | nindent 12 }}
671671
EOT
672672
containers:
@@ -692,7 +692,7 @@ spec:
692692
{{- end }}
693693
volumeMounts:
694694
- name: st2client-config-vol
695-
mountPath: /root/.st2/
695+
mountPath: /home/stanley/.st2/
696696
{{- include "stackstorm-ha.overrides-config-mounts" $ | nindent 8 }}
697697
{{- include "stackstorm-ha.st2-config-volume-mounts" $ | nindent 8 }}
698698
{{- include "stackstorm-ha.packs-volume-mounts-for-register-job" $ | nindent 8 }}

‎templates/services.yaml

+3-1
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,10 @@ spec:
9999
{{- end }}
100100
{{- end }}
101101
ports:
102+
{{- $https_port := include "stackstorm-ha.st2web.https_port" . }}
103+
{{- $http_port := include "stackstorm-ha.st2web.http_port" . }}
102104
- protocol: TCP
103-
port: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary 443 80 }}
105+
port: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary $https_port $http_port }}
104106

105107
{{ if .Values.st2chatops.enabled -}}
106108
---

‎tests/unit/ingress_test.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ tests:
6464
servicePort: 80
6565
- path: /fancy-sensor
6666
serviceName: fancy-sensor
67-
servicePort: 8080
67+
servicePort: {{ template ".stackstorm-ha.st2web.http_port" . }}
6868
tls: []
6969
st2web:
7070
service:
@@ -105,4 +105,4 @@ tests:
105105
service:
106106
name: fancy-sensor
107107
port:
108-
number: 8080
108+
number: {{ template ".stackstorm-ha.st2web.http_port" . }}

‎values.yaml

+32-4
Original file line numberDiff line numberDiff line change
@@ -300,8 +300,11 @@ st2:
300300
## Default SecurityContext for pods and containers.
301301
## Overrides available for st2web, st2actionrunner, st2sensorcontainer, st2client pods, and custom packs images.
302302
##
303-
podSecurityContext: {}
304-
securityContext: {}
303+
podSecurityContext:
304+
runAsNonRoot: true
305+
securityContext:
306+
runAsUser: 1000
307+
allowPrivilegeEscalation: false
305308

306309
##
307310
## StackStorm HA Ingress
@@ -377,7 +380,10 @@ st2web:
377380
attach: false
378381
# override the default .podSecurityContext or .securityContext here
379382
podSecurityContext: {}
380-
securityContext: {} # NB: nginx requires some capabilities, drop ALL will cause issues.
383+
securityContext: # NB: nginx requires some capabilities, drop ALL will cause issues.
384+
runAsUser: 999 # run as nginx user
385+
runAsGroup: 999 # run as nginx group
386+
allowPrivilegeEscalation: false
381387
# mount extra volumes on the st2web pod(s) (primarily useful for k8s-provisioned secrets)
382388
## Note that Helm templating is supported in 'mount' and 'volume'
383389
extra_volumes: []
@@ -1050,6 +1056,15 @@ mongodb:
10501056
arbiter:
10511057
enabled: false
10521058
resources: {}
1059+
podSecurityContext:
1060+
enabled: true
1061+
fsGroup: 1001
1062+
sysctls: []
1063+
containerSecurityContext:
1064+
enabled: true
1065+
runAsUser: 1001
1066+
runAsNonRoot: true
1067+
allowPrivilegeEscalation: false
10531068

10541069
##
10551070
## RabbitMQ configuration (3rd party chart dependency)
@@ -1097,7 +1112,12 @@ rabbitmq:
10971112
# As RabbitMQ enabled prometheus operator monitoring by default, disable it for non-prometheus users
10981113
metrics:
10991114
enabled: false
1100-
1115+
podSecurityContext:
1116+
fsGroup: 1001
1117+
runAsUser: 1001
1118+
runAsNonRoot: true
1119+
containerSecurityContext:
1120+
allowPrivilegeEscalation: false
11011121
##
11021122
## Redis HA configuration (3rd party chart dependency)
11031123
##
@@ -1133,6 +1153,14 @@ redis:
11331153
usePassword: false
11341154
metrics:
11351155
enabled: false
1156+
securityContext:
1157+
enabled: true
1158+
fsGroup: 1001
1159+
runAsNonRoot: true
1160+
containerSecurityContext:
1161+
enabled: true
1162+
runAsUser: 1001
1163+
allowPrivilegeEscalation: false
11361164

11371165
##
11381166
## Settings to be applied to all stackstorm-ha pods

0 commit comments

Comments
 (0)