deploy: Add explicit PodSecurityPolicy and Role

parca-dev · Oct 1, 2021 · 83b1987 · 83b1987
1 parent e289fa4
commit 83b1987
Show file tree

Hide file tree

Showing 5 changed files with 160 additions and 2 deletions.
diff --git a/deploy/lib/parca/parca.libsonnet b/deploy/lib/parca/parca.libsonnet
@@ -80,6 +80,99 @@ function(params) {
     },
   },
 
+  podSecurityPolicy: {
+    apiVersion: 'policy/v1beta1',
+    kind: 'PodSecurityPolicy',
+    metadata: {
+      name: prc.config.name,
+    },
+    spec: {
+      allowPrivilegeEscalation: false,
+      fsGroup: {
+        ranges: [
+          {
+            max: 65535,
+            min: 1,
+          },
+        ],
+        rule: 'MustRunAs',
+      },
+      requiredDropCapabilities: [
+        'ALL',
+      ],
+      runAsUser: {
+        rule: 'MustRunAsNonRoot',
+      },
+      seLinux: {
+        rule: 'RunAsAny',
+      },
+      supplementalGroups: {
+        ranges: [
+          {
+            max: 65535,
+            min: 1,
+          },
+        ],
+        rule: 'MustRunAs',
+      },
+      volumes: [
+        'configMap',
+        'emptyDir',
+        'projected',
+        'secret',
+        'downwardAPI',
+        'persistentVolumeClaim',
+      ],
+    },
+  },
+
+  role: {
+    apiVersion: 'rbac.authorization.k8s.io/v1',
+    kind: 'Role',
+    metadata: {
+      name: prc.config.name,
+      namespace: prc.config.namespace,
+      labels: prc.config.commonLabels,
+    },
+    rules: [
+      {
+        apiGroups: [
+          'policy',
+        ],
+        resourceNames: [
+          prc.config.name,
+        ],
+        resources: [
+          'podsecuritypolicies',
+        ],
+        verbs: [
+          'use',
+        ],
+      },
+    ],
+  },
+
+  roleBinding: {
+    apiVersion: 'rbac.authorization.k8s.io/v1',
+    kind: 'RoleBinding',
+    metadata: {
+      name: prc.config.name,
+      namespace: prc.config.namespace,
+      labels: prc.config.commonLabels,
+    },
+    roleRef: {
+      apiGroup: 'rbac.authorization.k8s.io',
+      kind: 'Role',
+      name: prc.role.metadata.name,
+    },
+    subjects: [
+      {
+        kind: 'ServiceAccount',
+        name: prc.serviceAccount.metadata.name,
+      },
+    ],
+  },
+
   configmap: {
     apiVersion: 'v1',
     kind: 'ConfigMap',
@@ -161,7 +254,7 @@ function(params) {
               configMap: { name: prc.config.configmapName },
             }],
             nodeSelector: {
-              'beta.kubernetes.io/os': 'linux',
+              'kubernetes.io/os': 'linux',
             },
           },
         },

diff --git a/deploy/tilt/parca-server-deployment.yaml b/deploy/tilt/parca-server-deployment.yaml
@@ -54,7 +54,7 @@ spec:
         - mountPath: /var/parca
           name: parca-config
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
         runAsUser: 65534

diff --git a/deploy/tilt/parca-server-podSecurityPolicy.yaml b/deploy/tilt/parca-server-podSecurityPolicy.yaml
@@ -0,0 +1,29 @@
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: parca
+spec:
+  allowPrivilegeEscalation: false
+  fsGroup:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  requiredDropCapabilities:
+  - ALL
+  runAsUser:
+    rule: MustRunAsNonRoot
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  volumes:
+  - configMap
+  - emptyDir
+  - projected
+  - secret
+  - downwardAPI
+  - persistentVolumeClaim
diff --git a/deploy/tilt/parca-server-role.yaml b/deploy/tilt/parca-server-role.yaml
@@ -0,0 +1,19 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/component: observability
+    app.kubernetes.io/instance: parca
+    app.kubernetes.io/name: parca
+    app.kubernetes.io/version: dev
+  name: parca
+  namespace: parca
+rules:
+- apiGroups:
+  - policy
+  resourceNames:
+  - parca
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
diff --git a/deploy/tilt/parca-server-roleBinding.yaml b/deploy/tilt/parca-server-roleBinding.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: observability
+    app.kubernetes.io/instance: parca
+    app.kubernetes.io/name: parca
+    app.kubernetes.io/version: dev
+  name: parca
+  namespace: parca
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: parca
+subjects:
+- kind: ServiceAccount
+  name: parca