security: run as unprivileged

kubeovn · Jul 17, 2023 · ebc7730 · ebc7730
1 parent b40c35b
commit ebc7730
Show file tree

Hide file tree

Showing 13 changed files with 97 additions and 33 deletions.
diff --git a/charts/templates/central-deploy.yaml b/charts/templates/central-deploy.yaml
@@ -46,8 +46,12 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command: ["/kube-ovn/start-db.sh"]
           securityContext:
+            runAsUser: 0
+            privileged: false
             capabilities:
-              add: ["SYS_NICE"]
+              add:
+                - NET_BIND_SERVICE
+                - SYS_NICE
           env:
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"

diff --git a/charts/templates/controller-deploy.yaml b/charts/templates/controller-deploy.yaml
@@ -107,6 +107,12 @@ spec:
           - --pod-default-fip-type={{- .Values.networking.POD_DEFAULT_FIP_TYPE }}
           - --enable-metrics={{- .Values.networking.ENABLE_METRICS }}
           - --node-local-dns-ip={{- .Values.networking.NODE_LOCAL_DNS_IP }}
+          securityContext:
+            runAsUser: 0
+            privileged: false
+            capabilities:
+              add:
+                - NET_BIND_SERVICE
           env:
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"

diff --git a/charts/templates/ovncni-ds.yaml b/charts/templates/ovncni-ds.yaml
@@ -117,7 +117,7 @@ spec:
             name: cni-conf
           - mountPath: /run/openvswitch
             name: host-run-ovs
-            mountPropagation: Bidirectional
+            mountPropagation: HostToContainer
           - mountPath: /run/ovn
             name: host-run-ovn
           - mountPath: /host/var/run/dbus

diff --git a/charts/templates/ovsovn-ds.yaml b/charts/templates/ovsovn-ds.yaml
@@ -48,7 +48,13 @@ spec:
           {{- end }}
           securityContext:
             runAsUser: 0
-            privileged: true
+            privileged: false
+            capabilities:
+              add:
+                - NET_ADMIN
+                - NET_BIND_SERVICE
+                - SYS_MODULE
+                - SYS_NICE
           env:
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"

diff --git a/dist/images/install.sh b/dist/images/install.sh
@@ -3200,8 +3200,12 @@ spec:
           imagePullPolicy: $IMAGE_PULL_POLICY
           command: ["/kube-ovn/start-db.sh"]
           securityContext:
+            runAsUser: 0
+            privileged: false
             capabilities:
-              add: ["SYS_NICE"]
+              add:
+                - NET_BIND_SERVICE
+                - SYS_NICE
           env:
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
@@ -3513,7 +3517,13 @@ spec:
           command: ["/kube-ovn/start-ovs.sh"]
           securityContext:
             runAsUser: 0
-            privileged: true
+            privileged: false
+            capabilities:
+              add:
+                - NET_ADMIN
+                - NET_BIND_SERVICE
+                - SYS_MODULE
+                - SYS_NICE
           env:
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
@@ -3905,6 +3915,12 @@ spec:
           - --keep-vm-ip=$ENABLE_KEEP_VM_IP
           - --pod-default-fip-type=$POD_DEFAULT_FIP_TYPE
           - --node-local-dns-ip=$NODE_LOCAL_DNS_IP
+          securityContext:
+            runAsUser: 0
+            privileged: false
+            capabilities:
+              add:
+                - NET_BIND_SERVICE
           env:
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
@@ -4076,15 +4092,15 @@ spec:
             name: cni-conf
           - mountPath: /run/openvswitch
             name: host-run-ovs
-            mountPropagation: Bidirectional
+            mountPropagation: HostToContainer
           - mountPath: /run/ovn
             name: host-run-ovn
           - mountPath: /host/var/run/dbus
             name: host-dbus
             mountPropagation: HostToContainer
           - mountPath: /var/run/netns
             name: host-ns
-            mountPropagation: Bidirectional
+            mountPropagation: HostToContainer
           - mountPath: /var/log/kube-ovn
             name: kube-ovn-log
           - mountPath: /var/log/openvswitch

diff --git a/yamls/kube-ovn-dual-stack.yaml b/yamls/kube-ovn-dual-stack.yaml
@@ -40,7 +40,7 @@ spec:
       hostNetwork: true
       containers:
         - name: kube-ovn-controller
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           args:
             - /kube-ovn/start-controller.sh
@@ -72,6 +72,12 @@ spec:
             - --keep-vm-ip=true
             - --pod-default-fip-type=
             - --node-local-dns-ip=
+          securityContext:
+            runAsUser: 0
+            privileged: false
+            capabilities:
+              add:
+                - NET_BIND_SERVICE
           env:
             - name: ENABLE_SSL
               value: "false"
@@ -169,7 +175,7 @@ spec:
       hostPID: true
       initContainers:
         - name: install-cni
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/install-cni.sh"]
           securityContext:
@@ -182,7 +188,7 @@ spec:
               name: local-bin
       containers:
         - name: cni-server
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command:
             - bash
@@ -357,7 +363,7 @@ spec:
       hostPID: true
       containers:
         - name: pinger
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           command:
             - /kube-ovn/kube-ovn-pinger
           args:
@@ -488,7 +494,7 @@ spec:
       hostNetwork: true
       containers:
         - name: kube-ovn-monitor
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-ovn-monitor.sh"]
           args:

diff --git a/yamls/kube-ovn-ipv6.yaml b/yamls/kube-ovn-ipv6.yaml
@@ -40,7 +40,7 @@ spec:
       hostNetwork: true
       containers:
         - name: kube-ovn-controller
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           args:
             - /kube-ovn/start-controller.sh
@@ -72,6 +72,12 @@ spec:
             - --keep-vm-ip=true
             - --pod-default-fip-type=
             - --node-local-dns-ip=
+          securityContext:
+            runAsUser: 0
+            privileged: false
+            capabilities:
+              add:
+                - NET_BIND_SERVICE
           env:
             - name: ENABLE_SSL
               value: "false"
@@ -169,7 +175,7 @@ spec:
       hostPID: true
       initContainers:
         - name: install-cni
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/install-cni.sh"]
           securityContext:
@@ -182,7 +188,7 @@ spec:
               name: local-bin
       containers:
         - name: cni-server
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command:
             - bash
@@ -357,7 +363,7 @@ spec:
       hostPID: true
       containers:
         - name: pinger
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           command:
             - /kube-ovn/kube-ovn-pinger
           args:
@@ -488,7 +494,7 @@ spec:
       hostNetwork: true
       containers:
         - name: kube-ovn-monitor
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-ovn-monitor.sh"]
           args:

diff --git a/yamls/kube-ovn.yaml b/yamls/kube-ovn.yaml
@@ -40,7 +40,7 @@ spec:
       hostNetwork: true
       containers:
         - name: kube-ovn-controller
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           args:
             - /kube-ovn/start-controller.sh
@@ -72,6 +72,12 @@ spec:
             - --keep-vm-ip=true
             - --pod-default-fip-type=
             - --node-local-dns-ip=
+          securityContext:
+            runAsUser: 0
+            privileged: false
+            capabilities:
+              add:
+                - NET_BIND_SERVICE
           env:
             - name: ENABLE_SSL
               value: "false"
@@ -171,7 +177,7 @@ spec:
       hostPID: true
       initContainers:
         - name: install-cni
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/install-cni.sh"]
           securityContext:
@@ -184,7 +190,7 @@ spec:
               name: local-bin
       containers:
         - name: cni-server
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command:
             - bash
@@ -359,7 +365,7 @@ spec:
       hostPID: true
       containers:
         - name: pinger
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           command:
             - /kube-ovn/kube-ovn-pinger
           args:
@@ -490,7 +496,7 @@ spec:
       hostNetwork: true
       containers:
         - name: kube-ovn-monitor
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-ovn-monitor.sh"]
           args:

diff --git a/yamls/ovn-dpdk.yaml b/yamls/ovn-dpdk.yaml
@@ -204,7 +204,7 @@ spec:
       hostNetwork: true
       containers:
         - name: ovn-central
-          image: "kubeovn/kube-ovn:v1.10.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-db.sh"]
           securityContext:
@@ -333,7 +333,7 @@ spec:
       hostPID: true
       containers:
         - name: openvswitch
-          image: "kubeovn/kube-ovn-dpdk:$DPDK_VERSION"
+          image: "docker.io/kubeovn/kube-ovn-dpdk:$DPDK_VERSION"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-ovs-dpdk.sh"]
           securityContext:

diff --git a/yamls/ovn-ha.yaml b/yamls/ovn-ha.yaml
@@ -93,12 +93,16 @@ spec:
       hostNetwork: true
       containers:
         - name: ovn-central
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-db.sh"]
           securityContext:
+            runAsUser: 0
+            privileged: false
             capabilities:
-              add: ["SYS_NICE"]
+              add:
+                - NET_BIND_SERVICE
+                - SYS_NICE
           env:
             - name: NODE_IPS
               value: 172.17.0.2,172.17.0.3,172.17.0.4
@@ -236,12 +240,18 @@ spec:
       hostPID: true
       containers:
         - name: openvswitch
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-ovs.sh"]
           securityContext:
             runAsUser: 0
-            privileged: true
+            privileged: false
+            capabilities:
+              add:
+                - NET_ADMIN
+                - NET_BIND_SERVICE
+                - SYS_MODULE
+                - SYS_NICE
           env:
             - name: ENABLE_SSL
               value: "false"

diff --git a/yamls/ovn.yaml b/yamls/ovn.yaml
@@ -93,12 +93,16 @@ spec:
       hostNetwork: true
       containers:
         - name: ovn-central
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-db.sh"]
           securityContext:
+            runAsUser: 0
+            privileged: false
             capabilities:
-              add: ["SYS_NICE"]
+              add:
+                - NET_BIND_SERVICE
+                - SYS_NICE
           env:
             - name: ENABLE_SSL
               value: "false"
@@ -236,7 +240,7 @@ spec:
       hostPID: true
       containers:
         - name: openvswitch
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command: ["/kube-ovn/start-ovs.sh"]
           securityContext:

diff --git a/yamls/speaker.yaml b/yamls/speaker.yaml
@@ -29,7 +29,7 @@ spec:
       hostNetwork: true
       containers:
         - name: kube-ovn-speaker
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command:
             - /kube-ovn/kube-ovn-speaker

diff --git a/yamls/webhook.yaml b/yamls/webhook.yaml
@@ -33,7 +33,7 @@ spec:
       hostNetwork: true
       containers:
         - name: kube-ovn-webhook
-          image: "kubeovn/kube-ovn:v1.12.0"
+          image: "docker.io/kubeovn/kube-ovn:v1.12.0"
           imagePullPolicy: IfNotPresent
           command:
             - /kube-ovn/kube-ovn-webhook