Helm: securityContext / containerSecurityContext not fully propagated ?

Question

Helm: securityContext / containerSecurityContext not fully propagated ?

udf2457 opened this issue 2 years ago · comments

Given the following custom values.yaml:

reloader:
  reloadStrategy: annotations
  readOnlyRootFileSystem: true
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop: [ALL]

I would expect Reloader to install without issue in a Restricted PSS environment (https://kubernetes.io/docs/concepts/security/pod-security-standards/).

However, instead, running helm install stakater-reloader -f path/to/my/stakater-reloader/values.yaml stakater/reloader

I am greeted with:

W0319 12:17:55.847256 5976 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "stakater-reloader-reloader" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "stakater-reloader-reloader" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "stakater-reloader-reloader" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

This therefore implies that the securityContext and containerSecurityContext are not fully propagated in the Helm chart ?

Unfortunatley I'm stll a bit of a Helm noob and so don't have the skills to troubelshoot and provide a PR but hopefully it should be a fairly simple fix ?

Karl Johan Grahn · Answer 1 · Wed Mar 29 2023 16:02:58 GMT+0800 (China Standard Time)

@faizanahmad055 tested it on Minikube and OpenShift but was not able to reproduce it

udf2457 · Answer 2 · Wed Mar 29 2023 16:05:45 GMT+0800 (China Standard Time)

@karl-johan-grahn Was your environment setup to enforce ?

My environment is k3s, with security setup as per the docs (https://docs.k3s.io/security/hardening-guide), in particular the PSA:

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1beta1
    kind: PodSecurityConfiguration
    defaults:
      enforce: "restricted"
      enforce-version: "latest"
      audit: "restricted"
      audit-version: "latest"
      warn: "restricted"
      warn-version: "latest"
    exemptions:
      usernames: []
      runtimeClasses: []
      namespaces: [kube-system, cis-operator-system]

Karl Johan Grahn · Answer 3 · Wed May 24 2023 16:28:42 GMT+0800 (China Standard Time)

@udf2457 We would like to reproduce it, can you provide template with values file that you use?

PatrickSpies · Answer 4 · Thu Jun 01 2023 17:55:29 GMT+0800 (China Standard Time)

You are missing the deployment-key for your values, it should be:

reloader:
  reloadStrategy: annotations
  readOnlyRootFileSystem: true
  deployment: # << currently missing
    securityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    containerSecurityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: [ALL]

Mohith Kalyan P · Answer 5 · Thu Aug 31 2023 20:59:17 GMT+0800 (China Standard Time)

Is this working for below setting ?

capabilities: drop: [ALL]

What are the capabilities that are needed to run this image ?

Divyam · Answer 6 · Thu Oct 05 2023 21:54:46 GMT+0800 (China Standard Time)

I had the same issue i raised an MR with the fix #540

PatrickSpies · Answer 7 · Fri Oct 06 2023 14:57:29 GMT+0800 (China Standard Time)

I had the same issue i raised an MR with the fix #540

There is no need to add default-settings for containerSecurityContext, just use the correct keys within your values..

Is this working for below setting ?

capabilities: drop: [ALL]

Yes, this is templated properly