feat: make privilege levels selectable in values file

flanksource · May 19, 2023 · 9e40f82 · 9e40f82
1 parent 7768741
commit 9e40f82
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 18 deletions.
diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl
@@ -50,3 +50,20 @@ app.kubernetes.io/name: {{ include "canary-checker.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 control-plane: canary-checker
 {{- end }}
+
+{{/*
+Container Security Context
+*/}}
+{{- define "canary-checker.containerSecurityContext" -}}
+allowPrivilegeEscalation: {{- if -eq (.Values.privilegeMode | toLower) "privileged"}}true{{- else }}false{{-end}}
+{{- if has (.Values.privilegeMode | toLower) ( list "privileged" "root" ) }}
+runAsUser: 0
+runAsGroup: 0
+fsGroup: 0
+{{- if -eq (.Values.privilegeMode | toLower) "privileged"}}
+capabilities:
+  add:
+    - CAP_NET_RAW
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
@@ -6,21 +6,18 @@ kind: Deployment
 {{- end }}
 metadata:
   name: {{ include "canary-checker.name" . }}
-  labels:
-    {{- include "canary-checker.labels" . | nindent 4 }}
+  labels: {{- include "canary-checker.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.replicas }}
   selector:
-    matchLabels:
-      {{- include "canary-checker.selectorLabels" . | nindent 6 }}
+    matchLabels: {{- include "canary-checker.selectorLabels" . | nindent 6 }}
   {{- if eq .Values.db.external.enabled false }}
   {{- if eq .Values.db.embedded.persist true }}
   serviceName: {{ include "canary-checker.fullname" . }}
   volumeClaimTemplates:
     - metadata:
         name: canarychecker-database
-        labels:
-          {{- include "canary-checker.labels" . | nindent 10 }}
+        labels: {{- include "canary-checker.labels" . | nindent 10 }}
       spec:
         storageClassName: {{ .Values.db.embedded.storageClass }}
         accessModes: ["ReadWriteOnce"]
@@ -31,8 +28,7 @@ spec:
   {{- end }}
   template:
     metadata:
-      labels:
-        {{- include "canary-checker.selectorLabels" . | nindent 8 }}
+      labels: {{- include "canary-checker.selectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: {{ include "canary-checker.fullname" . }}-sa
       volumes:
@@ -52,15 +48,9 @@ spec:
               - path: "labels"
                 fieldRef:
                   fieldPath: metadata.labels
-      securityContext:
-        fsGroup: 1000
       containers:
         - name: {{ include "canary-checker.name" . }}
-          securityContext:
-            allowPrivilegeEscalation: true
-            capabilities:
-              add:
-                - CAP_NET_RAW
+          securityContext: {{- include "canary-checker.containerSecurityContext" . | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: "{{ .Values.image.pullPolicy }}"
           env:
@@ -105,8 +95,7 @@ spec:
             - "8080"
             - --disable-postgrest={{ .Values.disablePostgrest }}
             - --db-migrations={{ .Values.db.runMigrations }}
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
+          resources: {{- toYaml .Values.resources | nindent 12 }}
           livenessProbe:
             httpGet:
               path: /health
@@ -116,5 +105,5 @@ spec:
               path: /health
               port: 8080
       {{- with .Values.extra }}
-      {{- toYaml . | nindent 6 }}
+      {{- toYaml . | indent 6 }}
       {{- end }}
diff --git a/chart/values.yaml b/chart/values.yaml
@@ -20,6 +20,12 @@ disablePostgrest: false
 debug: false
 logLevel: "-v"
 
+## Options: unprivileged | root | privileged
+## unprivileged: runs as noot root user, cannot escalate permissions
+## root: runs as root user, cannot escalate permissions.  Required to run ping checks
+## privileged: runs as root user, may escalate CAP_NET_RAW.  Required to run docker and container checks
+privilegeMode: unprivileged
+
 db:
   runMigrations: false
   embedded: