Apply more restrictive SecurityContext to components #2433

hjiawei · 2023-01-28T08:04:02Z

Description

This changeset add more restrictive SecurityContext to Calico opensource
and enterprise components. Least privilege principle is applied to this
change.

Data plane components are mostly running as root user and application
layer compoennts are running as non-root users. Capabilities and
SeccompProfile are also filled with sensible defaults in
SecurityContexts.

For PR author

Tests for change.
If changing pkg/apis/, run make gen-files
If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

Milestone set according to targeted release.
Appropriate labels:
- kind/bug if this is a bugfix.
- kind/enhancement if this is a a new feature.
- enterprise if this PR applies to Calico Enterprise only.

hjiawei · 2023-01-28T08:20:56Z

pkg/render/egressgateway/egressgateway.go

@@ -169,17 +172,23 @@ func (c *component) egwBuildAnnotations() map[string]string {
 }

 func (c *component) egwInitContainer() *corev1.Container {
+	sc := securitycontext.NewRootContext(true)


Pending validation from @sridhartigera. As the init container is running as root and privileged, can we remove the NET_ADMIN?

rene-dekker

lgtm

anthonytwh · 2023-02-02T21:00:17Z

pkg/render/logstorage.go

+	sc.Capabilities.Add = []corev1.Capability{
+		"SETGID",
+		"SETUID",
+		"SYS_CHROOT",
+	}


Does the ES entrypoint script work without SETGID and SETUID?

Not really. I believe chroot needs them.

This changeset add more restrictive SecurityContext to Calico opensource and enterprise components. Least privilege principle is applied to this change. Data plane components are mostly running as root user and application layer compoennts are running as non-root users. `Capabilities` and `SeccompProfile` are also filled with sensible defaults in `SecurityContext`s.

hjiawei · 2023-02-03T03:59:38Z

I have tested a standard Calico Enterprise install on the following platforms:

gcp-kubeadmin
gcp-mke
gcp-rancher
gcp-rke2 (cis not enabled)
aws-eks
aws-openshift
azr-aks

This changeset add and update PodSecurityPolicy for open source and enterprise components to match the recent work for SecurityContext in [1]. To summarize the changes: * Update Elasticsearch and Fluentd capabilities in PodSecurityPolicy to match SecurityContext. * Add missing PSPs for all enterprise components. Enterprise components like packetcapture, esgateway, l7-log-collector, etc. are able to be deployed without creating PodSecurityPolicy manually. * Manage Prometheus operator ClusterRole and ClusterRoleBinding in operator. * use `UsePSP` as the only flag to determine whether we need to render PSPs or not. [1] tigera#2433

This changeset add and update PodSecurityPolicy for open source and enterprise components to match the recent work for SecurityContext in [1]. To summarize the changes: * Update Elasticsearch and Fluentd capabilities in PodSecurityPolicy to match SecurityContext. * Add missing PSPs for all enterprise components. Enterprise components like packetcapture, esgateway, l7-log-collector, etc. are able to be deployed without creating PodSecurityPolicy manually. * Manage Prometheus operator ClusterRole and ClusterRoleBinding in operator. * use `UsePSP` as the only flag to determine whether we need to render PodSecurityPolicy or not. [1] tigera#2433

This changeset add and update `PodSecurityPolicy` for open source and enterprise components to match the recent work for SecurityContext in [1]. This is also required for all components to work in a CIS hardened RKE2 cluster. To summarize the changes: * Update Elasticsearch and Fluentd capabilities in `PodSecurityPolicy` to match `SecurityContext`. * Add missing `PodSecurityPolicy` for all enterprise components. Enterprise components like packetcapture, esgateway, l7-log-collector, etc. are able to be deployed without creating `PodSecurityPolicy` manually. * Manage Prometheus operator `ClusterRole` and `ClusterRoleBinding` in operator. * use `UsePSP` as the only flag to determine whether we need to render `PodSecurityPolicy` or not. [1] tigera#2433

This changeset add and update `PodSecurityPolicy` for open source and enterprise components to match the recent work for SecurityContext in [1]. This is also required for all components to work in a CIS hardened RKE2 cluster. To summarize the changes: * Update Elasticsearch and Fluentd capabilities in `PodSecurityPolicy` to match `SecurityContext`. * Add missing `PodSecurityPolicy` for all enterprise components. Enterprise components like packetcapture, esgateway, l7-log-collector, etc. are able to be deployed without creating `PodSecurityPolicy` manually. * Manage Prometheus operator `ClusterRole` and `ClusterRoleBinding` in operator. * use `UsePSP` as the only flag to determine whether we need to render `PodSecurityPolicy` or not. [1] #2433

When PSP Pod Admission Controller is enabled in a cluster before v1.25, add the PSP PolicyRule for anomaly detection detectors. This is missed in tigera#2433.

When PSP Pod Admission Controller is enabled in a cluster before v1.25, add the PSP PolicyRule for anomaly detection detectors. This is missed in #2433.

marvin-tigera added this to the v1.30.0 milestone Jan 28, 2023

marvin-tigera added docs-pr-required release-note-required labels Jan 28, 2023

hjiawei commented Jan 28, 2023

View reviewed changes

hjiawei force-pushed the cis-perm-tune branch 9 times, most recently from 02c0944 to d60302a Compare January 31, 2023 05:04

hjiawei marked this pull request as ready for review January 31, 2023 07:33

hjiawei requested a review from a team as a code owner January 31, 2023 07:33

hjiawei force-pushed the cis-perm-tune branch 5 times, most recently from 0cbf7b7 to c53be0f Compare February 1, 2023 22:28

rene-dekker approved these changes Feb 2, 2023

View reviewed changes

hjiawei force-pushed the cis-perm-tune branch from c53be0f to 340fae0 Compare February 2, 2023 02:02

anthonytwh reviewed Feb 2, 2023

View reviewed changes

hjiawei force-pushed the cis-perm-tune branch from 340fae0 to 225298b Compare February 3, 2023 02:36

rene-dekker merged commit b3e846d into tigera:master Feb 3, 2023

hjiawei mentioned this pull request Feb 6, 2023

[release-v1.29] Apply more restrictive SecurityContext to components #2455

Merged

5 tasks

hjiawei deleted the cis-perm-tune branch February 9, 2023 18:52

hjiawei mentioned this pull request Feb 24, 2023

Add and update PodSecurityPolicy to match SecurityContext #2504

Merged

5 tasks

hjiawei mentioned this pull request Mar 2, 2023

[release-v1.29] Add and update PodSecurityPolicy to match SecurityContext #2514

Merged

5 tasks

hjiawei mentioned this pull request Mar 16, 2023

Add PSP PolicyRule for anomaly detection detectors #2555

Merged

5 tasks

hjiawei mentioned this pull request Mar 16, 2023

[release-v1.29] Add PSP PolicyRule for anomaly detection detectors #2556

Merged

5 tasks

hjiawei mentioned this pull request Mar 27, 2023

Set seccomp profile to RuntimeDefault for calico-kube-controllers and calico-typha projectcalico/calico#6524

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Apply more restrictive SecurityContext to components #2433

Apply more restrictive SecurityContext to components #2433

hjiawei commented Jan 28, 2023

hjiawei Jan 28, 2023 •

edited

Loading

rene-dekker left a comment

anthonytwh Feb 2, 2023

hjiawei Feb 2, 2023

hjiawei commented Feb 3, 2023

Apply more restrictive SecurityContext to components #2433

Apply more restrictive SecurityContext to components #2433

Conversation

hjiawei commented Jan 28, 2023

Description

For PR author

For PR reviewers

hjiawei Jan 28, 2023 • edited Loading

Choose a reason for hiding this comment

rene-dekker left a comment

Choose a reason for hiding this comment

anthonytwh Feb 2, 2023

Choose a reason for hiding this comment

hjiawei Feb 2, 2023

Choose a reason for hiding this comment

hjiawei commented Feb 3, 2023

hjiawei Jan 28, 2023 •

edited

Loading