Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: use safe securityContext as default #267

Merged
merged 5 commits into from
Apr 29, 2022
Merged

feat: use safe securityContext as default #267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
36b5c1b
use safe values for securityContext as default
JorTurFer Apr 26, 2022
5e97b36
partial doc update
JorTurFer Apr 26, 2022
53e886f
fix typo in securityContexts
JorTurFer Apr 26, 2022
63a812c
update docs
JorTurFer Apr 26, 2022
c6b36a7
apply feedback
Apr 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 38 additions & 6 deletions keda/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,12 +89,12 @@ their default values.
| `logging.operator.format` | Logging format for KEDA Operator. Allowed values are 'console' & 'json'. | `console` |
| `logging.operator.timeFormat` | Logging time format for KEDA Operator. Allowed values are 'epoch', 'millis', 'nano', or 'iso8601'. | `epoch` |
| `logging.metricServer.level` | Logging level for Metrics Server.Policy to use to pull Docker images. Allowed values are '0' for info, '4' for debug, or an integer value greater than 0, specified as string | `0` |
| `securityContext` | Security context for all containers ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)) | `{}` |
| `securityContext.operator` | Security context of the operator container ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)) | `` |
| `securityContext.metricServer` | Security context of the metricServer container ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)) | `` |
| `podSecurityContext` | Pod security context for all pods ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)) | `{}` |
| `podSecurityContext.operator` | Pod security context of the KEDA operator pod ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)) | `` |
| `podSecurityContext.metricServer` | Pod security context of the KEDA metrics apiserver pod ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)) | `` |
| `securityContext` | Security context for all containers ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)) | [See below](#KEDA-is-secure-by-default) |
| `securityContext.operator` | Security context of the operator container ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)) | [See below](#KEDA-is-secure-by-default) |
| `securityContext.metricServer` | Security context of the metricServer container ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)) | [See below](#KEDA-is-secure-by-default) |
| `podSecurityContext` | Pod security context for all pods ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)) | [See below](#KEDA-is-secure-by-default) |
| `podSecurityContext.operator` | Pod security context of the KEDA operator pod ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)) | [See below](#KEDA-is-secure-by-default) |
| `podSecurityContext.metricServer` | Pod security context of the KEDA metrics apiserver pod ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)) | [See below](#KEDA-is-secure-by-default) |
| `resources` | Manage resource request & limits of all KEDA workloads ([docs](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)) | `{}` |
| `resources.operator` | Manage resource request & limits of KEDA operator pod ([docs](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)) | `` |
| `resources.metricServer` | Manage resource request & limits of KEDA metrics apiserver pod ([docs](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)) | `` |
Expand Down Expand Up @@ -152,3 +152,35 @@ be provided while installing the chart. For example,
```console
helm install keda kedacore/keda --namespace keda -f values.yaml
```

## KEDA is secure by default

Our default configuration strives to be as secure as possible. Because of that, KEDA will run as non-root and be secure-by-default:
```yaml
podSecurityContext:
operator:
capabilities:
drop:
- ALL
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
metricServer:
capabilities:
drop:
- ALL
allowPrivilegeEscalation: false
## Metrics server needs to write the self-signed cert so it's not possible set this
# readOnlyRootFilesystem: true
tomkerkhove marked this conversation as resolved.
Show resolved Hide resolved

securityContext:
operator:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
metricServer:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
```
12 changes: 6 additions & 6 deletions keda/templates/12-keda-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,18 +40,18 @@ spec:
{{- end }}
serviceAccountName: {{ .Values.serviceAccount.name }}
securityContext:
{{- if .Values.podSecurityContext.operator }}
{{- toYaml .Values.podSecurityContext.operator | nindent 8 }}
{{- if .Values.securityContext.operator }}
{{- toYaml .Values.securityContext.operator | nindent 8 }}
{{- else }}
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- toYaml .Values.securityContext | nindent 8 }}
{{- end }}
containers:
- name: {{ .Values.operator.name }}
securityContext:
{{- if .Values.securityContext.operator }}
{{- toYaml .Values.securityContext.operator | nindent 12 }}
{{- if .Values.podSecurityContext.operator }}
{{- toYaml .Values.podSecurityContext.operator | nindent 12 }}
{{- else }}
{{- toYaml .Values.securityContext | nindent 12 }}
{{- toYaml .Values.podSecurityContext | nindent 12 }}
Comment on lines +43 to +54
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @JorTurFer , I wonder why do you flip the logical meaning of securityContext and podSecurityContext Helm values?

Previously securityContext was mapped to container.securityContext, and podSecurityContext was mapped to pod-level securityContext. So the naming seemed to be correct.

Now it's flipped vice versa. Would it cause any backward compatibility issues for users that were previously passing custom securityContext and podSecurityContext values to KEDA Helm chart?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lol, you are right!
I confused them 🤦 till now I have been thinking in podSecurityContext as containerSecurityContext...
are you willing to contribute solving this?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd be glad to help but I don't think I can do it quickly. I still have PR for #261 on my to-do list but never have time :)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't worry, I will do it tomorrow with the chart release :)
Nice catch!!

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @JorTurFer !

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#274

{{- end }}
image: "{{ .Values.image.keda.repository }}:{{ .Values.image.keda.tag | default .Chart.AppVersion }}"
command:
Expand Down
12 changes: 6 additions & 6 deletions keda/templates/22-metrics-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,18 +43,18 @@ spec:
{{- end }}
serviceAccountName: {{ .Values.serviceAccount.name }}
securityContext:
{{- if .Values.podSecurityContext.metricServer }}
{{- toYaml .Values.podSecurityContext.metricServer | nindent 8 }}
{{- if .Values.securityContext.metricServer }}
{{- toYaml .Values.securityContext.metricServer | nindent 8 }}
{{- else }}
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- toYaml .Values.securityContext | nindent 8 }}
{{- end }}
containers:
- name: {{ .Values.operator.name }}-metrics-apiserver
securityContext:
{{- if .Values.securityContext.metricServer }}
{{- toYaml .Values.securityContext.metricServer | nindent 12 }}
{{- if .Values.podSecurityContext.metricServer }}
{{- toYaml .Values.podSecurityContext.metricServer | nindent 12 }}
{{- else }}
{{- toYaml .Values.securityContext | nindent 12 }}
{{- toYaml .Values.podSecurityContext | nindent 12 }}
{{- end }}
image: "{{ .Values.image.metricsApiServer.repository }}:{{ .Values.image.metricsApiServer.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
Expand Down
44 changes: 23 additions & 21 deletions keda/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,29 +106,31 @@ logging:
level: 0

podSecurityContext:
{}
# operator:
# fsGroup: 2000
# metricServer:
# fsGroup: 2000
operator:
capabilities:
drop:
- ALL
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
metricServer:
capabilities:
drop:
- ALL
allowPrivilegeEscalation: false
## Metrics server needs to write the self-signed cert so it's not possible set this
# readOnlyRootFilesystem: true

securityContext:
{}
# operator:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
# metricServer:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# runAsNonRoot: true
# runAsUser: 1000
operator:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
metricServer:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000

service:
type: ClusterIP
Expand Down