Set seccomp profile to RuntimeDefault for calico-kube-controllers and calico-typha #6524

dimityrmirchev · 2022-08-10T09:03:21Z

Description

We can enhance the securityContext of calico-node, calico-kube-controllers, calico-typha by explicitly adding a "RuntimeDefault" seccomp profile.

      securityContext:
        seccompProfile:
          type: RuntimeDefault

By default Kubernetes runs the pods with profile "Unconfined". Privileged containers always run with Unconfined profile (reference). Having said that this change will only affect calico-kube-controllers and calico-typha since all the containers in calico-node are ran as privileged. The specifying of the seccomp profile there acts as a guardrails against:

Adding a new container and running it as Unconfined
Removing privileged: true from a container definition and still running as Unconfined

Related issues/PRs

Todos

Tests
Documentation
Release note

Release Note

The calico-node, calico-kube-controllers and calico-typha pods now run with `securityContext.seccompProfile.type=RuntimeDefault`.

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

docs-pr-required: This change requires a change to the documentation that has not been completed yet.
docs-completed: This change has all necessary documentation completed.
docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

release-note-required: This PR has user-facing changes. Most PRs should have this label.
release-note-not-required: This PR has no user-facing changes.

Other optional labels:

cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

… calico-typha

CLAassistant · 2022-08-10T09:03:26Z

All committers have signed the CLA.

caseydavenport · 2022-08-16T14:47:56Z

/sem-approve

caseydavenport · 2022-08-16T14:48:11Z

@coutinhop could you own reviewing this guy?

dimityrmirchev · 2022-12-12T20:51:02Z

Friendly ping @caseydavenport @coutinhop

mgleung

Hey @dimityrmirchev sorry for the delay for the review. I think this would be really good for us to have, but I'm not sure if adding this to all of the node daemonsets would work if they run as privileged. Have you tested these changes?

Also, we generate a lot of the manifests from our helm charts so a faster change might be to make the changes to those and then re-generate the manifests.

mgleung · 2023-03-14T03:59:48Z

charts/calico/templates/calico-node.yaml

@@ -38,6 +38,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: {{include "nodeName" . }}
+      securityContext:


My understanding was that this won't make a difference for calico-node since it needs to run as privileged (though it doesn't seem to have the privileged flag set here for some reason). Does this make sense to have here?

mgleung · 2023-03-14T04:00:02Z

manifests/calico-bpf.yaml

@@ -4381,6 +4381,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: calico-node
+      securityContext:


same as above

mgleung · 2023-03-14T04:00:30Z

manifests/calico-etcd.yaml

@@ -258,6 +258,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: calico-node
+      securityContext:


same as above

mgleung · 2023-03-14T04:00:48Z

manifests/calico-policy-only.yaml

@@ -4378,6 +4378,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: calico-node
+      securityContext:


same as above

mgleung · 2023-03-14T04:01:11Z

manifests/calico-typha.yaml

@@ -4412,6 +4412,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: calico-node
+      securityContext:


same as above

mgleung · 2023-03-14T04:01:52Z

manifests/calico.yaml

@@ -4376,6 +4376,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: calico-node
+      securityContext:


same as above

mgleung · 2023-03-14T04:04:10Z

manifests/canal-etcd.yaml

@@ -337,6 +337,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: canal-node
+      securityContext:


same as above

mgleung · 2023-03-14T04:04:53Z

manifests/canal.yaml

@@ -4400,6 +4400,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: canal
+      securityContext:


same as above

mgleung · 2023-03-14T04:05:53Z

manifests/flannel-migration/calico.yaml

@@ -4378,6 +4378,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: calico-node
+      securityContext:


same as above

mgleung · 2023-03-14T04:06:05Z

node/tests/k8st/infra/calico-kdd.yaml

@@ -398,6 +398,9 @@ spec:
        - effect: NoExecute
          operator: Exists
      serviceAccountName: calico-node
+      securityContext:


same as above

dimityrmirchev · 2023-03-27T08:34:07Z

Hi @mgleung and thanks for reviewing this PR!

I think this would be really good for us to have, but I'm not sure if adding this to all of the node daemonsets would work if they run as privileged.

Setting RuntimeDefault seccomp profile for calico-node will not actually change anything since the containers run as privileged (they will still have the Unconfined profile). The specifying of the seccomp profile for calico-node acts as guardrails against:

Adding a new container and running it as Unconfined
Removing privileged: true from a container definition and still running as Unconfined

Have you tested these changes?

I created a kind cluster with disabled CNI, then applied the regenerated ./manifests/calico.yaml and ./manifests/calico-typha.yaml. The calico pods started successfully and I did not observe any errors.

Also, we generate a lot of the manifests from our helm charts so a faster change might be to make the changes to those and then re-generate the manifests.

Yes, this is what I did in order to change the files located in the manifests folder.

hjiawei · 2023-03-27T16:18:51Z

Setting RuntimeDefault to SeccompProfile should be fine as Tigera Operator had a similar change recently in tigera/operator#2433.

caseydavenport · 2024-06-18T17:12:02Z

/sem-approve

caseydavenport · 2024-06-18T22:23:26Z

/sem-approve

Set seccomp profile to RuntimeDefault for calico-kube-controllers and…

35aaf76

… calico-typha

dimityrmirchev requested a review from a team as a code owner August 10, 2022 09:03

marvin-tigera added this to the Calico v3.25.0 milestone Aug 10, 2022

marvin-tigera added docs-pr-required Change is not yet documented release-note-required Change has user-facing impact (no matter how small) labels Aug 10, 2022

dimityrmirchev mentioned this pull request Aug 10, 2022

Default seccomp profile for calico components gardener/gardener-extension-networking-calico#204

Merged

caseydavenport requested a review from coutinhop August 16, 2022 14:48

mgleung modified the milestones: Calico v3.25.0, Calico v3.26.0 Jan 5, 2023

mgleung added the docs-not-required Docs not required for this change label Mar 14, 2023

marvin-tigera removed the docs-pr-required Change is not yet documented label Mar 14, 2023

mgleung suggested changes Mar 14, 2023

View reviewed changes

mgleung modified the milestones: Calico v3.26.0, Calico v3.27.0 Apr 20, 2023

mgleung modified the milestones: Calico v3.27.0, Calico v3.28.0 Nov 15, 2023

radTuti modified the milestones: Calico v3.28.0, Calico v3.28.1 May 3, 2024

caseydavenport added the merge-when-ready label Jun 18, 2024

caseydavenport closed this Jun 18, 2024

marvin-tigera removed release-note-required Change has user-facing impact (no matter how small) docs-not-required Docs not required for this change merge-when-ready labels Jun 18, 2024

caseydavenport reopened this Jun 18, 2024

marvin-tigera added release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Jun 18, 2024

caseydavenport added the docs-not-required Docs not required for this change label Jun 18, 2024

marvin-tigera removed the docs-pr-required Change is not yet documented label Jun 18, 2024

caseydavenport merged commit e11585c into projectcalico:master Jun 21, 2024
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set seccomp profile to RuntimeDefault for calico-kube-controllers and calico-typha #6524

Set seccomp profile to RuntimeDefault for calico-kube-controllers and calico-typha #6524

dimityrmirchev commented Aug 10, 2022

CLAassistant commented Aug 10, 2022 •

edited

Loading

caseydavenport commented Aug 16, 2022

caseydavenport commented Aug 16, 2022

dimityrmirchev commented Dec 12, 2022

mgleung left a comment

mgleung Mar 14, 2023

mgleung Mar 14, 2023

mgleung Mar 14, 2023

mgleung Mar 14, 2023

mgleung Mar 14, 2023

mgleung Mar 14, 2023

mgleung Mar 14, 2023

mgleung Mar 14, 2023

mgleung Mar 14, 2023

mgleung Mar 14, 2023

dimityrmirchev commented Mar 27, 2023

hjiawei commented Mar 27, 2023

caseydavenport commented Jun 18, 2024

caseydavenport commented Jun 18, 2024

Set seccomp profile to RuntimeDefault for calico-kube-controllers and calico-typha #6524

Set seccomp profile to RuntimeDefault for calico-kube-controllers and calico-typha #6524

Conversation

dimityrmirchev commented Aug 10, 2022

Description

Related issues/PRs

Todos

Release Note

Reminder for the reviewer

CLAassistant commented Aug 10, 2022 • edited Loading

caseydavenport commented Aug 16, 2022

caseydavenport commented Aug 16, 2022

dimityrmirchev commented Dec 12, 2022

mgleung left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dimityrmirchev commented Mar 27, 2023

hjiawei commented Mar 27, 2023

caseydavenport commented Jun 18, 2024

caseydavenport commented Jun 18, 2024

CLAassistant commented Aug 10, 2022 •

edited

Loading