Add security context to Agones containers #3856

peterzhongyi · 2024-06-05T15:47:04Z

Added runAsNonRoot(true) and allowPrivilegeEscalation(false) into the containers field of controller, extensions, ping, and allocator.

Left out sidecar because it is generated by the controller and require another set of changes.

Towards #3848

zmerlynn · 2024-06-05T17:36:09Z

This LGTM but I'd like to see it pass CI before I approve

agones-bot · 2024-06-05T18:45:33Z

Build Failed 😱

Build Id: c6935f4c-7aec-47aa-b350-1783009d55e9

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

agones-bot · 2024-06-06T01:27:13Z

Build Succeeded 👏

Build Id: 65712bed-b83c-4aa0-b0df-9c1324359379

The following development artifacts have been built, and will exist for the next 30 days:

A preview of the website (the last 30 builds are retained):

https://969863e-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/3856/head:pr_3856 && git checkout pr_3856
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.registry=us-docker.pkg.dev/agones-images/ci --set agones.image.tag=1.41.0-dev-969863e-amd64

peterzhongyi · 2024-06-06T14:34:51Z

I added UIDs because the pods won't start if I don't provide them (Error is Error: container has runAsNonRoot and image has non-numeric user (appuser), cannot verify user is non-root)

https://stackoverflow.com/questions/49720308/kubernetes-podsecuritypolicy-set-to-runasnonroot-container-has-runasnonroot-and for reference

markmandel · 2024-06-07T15:57:10Z

install/helm/agones/templates/service/allocation.yaml

@@ -229,6 +229,10 @@ spec:
      - name: agones-allocator
        image: "{{ .Values.agones.image.registry }}/{{ .Values.agones.image.allocator.name}}:{{ default .Values.agones.image.tag .Values.agones.image.allocator.tag }}"
        imagePullPolicy: {{ .Values.agones.image.allocator.pullPolicy }}
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 1003


Curious why this is a different userid on each container? I would have thought they would be the same?

Also, do we need to specify the uid at all? That seems brittle. or will it work with just runAsNonRoot ?

Ahh I thought each pod needs to have an unique ID across the cluster (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#:~:text=Every%20Kubernetes%20object%20also%20has,are%20each%20named%20myapp%2D1234%20.) but apparently it is referring to some other UID because I tried setting the runAsUser 1000 for all 4 binaries and they can turn up just fine.

Yes we need to specify the UID otherwise the pods can't turn up, and the error message would be Error: container has runAsNonRoot and image has non-numeric user (appuser), cannot verify user is non-root

https://stackoverflow.com/questions/49720308/kubernetes-podsecuritypolicy-set-to-runasnonroot-container-has-runasnonroot-and for reference. Actually I also added a comment on the pr to explain this:)

I don't think we should pick a uid out of the blue. I was hoping this would just work with runAsNonRoot since the image specifies a username, but that appears to be wrong, as you discovered.

If we have to specify an arbitrary uid, I think it should be configurable by helm, in case someone has a weird identity setup. I'd just default it to e.g. 1000.

We talked offline, I think it's ok just to see if anyone really needs this to be configurable. LGTM!

agones-bot · 2024-06-10T15:55:18Z

Build Succeeded 👏

Build Id: d5c3bfaa-8b8a-4ff8-8d7f-74935d6d1752

The following development artifacts have been built, and will exist for the next 30 days:

A preview of the website (the last 30 builds are retained):

https://3cc787a-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/3856/head:pr_3856 && git checkout pr_3856
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.registry=us-docker.pkg.dev/agones-images/ci --set agones.image.tag=1.41.0-dev-3cc787a-amd64

agones-bot · 2024-06-10T18:51:29Z

Build Failed 😱

Build Id: 8264d9ca-2b1d-4fcd-b974-78f72231123e

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

agones-bot · 2024-06-10T20:03:23Z

Build Succeeded 👏

Build Id: cf7d21eb-6607-49cf-8ff3-6d6d92dc76c6

The following development artifacts have been built, and will exist for the next 30 days:

A preview of the website (the last 30 builds are retained):

https://8089a39-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/3856/head:pr_3856 && git checkout pr_3856
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.registry=us-docker.pkg.dev/agones-images/ci --set agones.image.tag=1.42.0-dev-8089a39-amd64

agones-bot · 2024-06-10T21:07:16Z

Build Succeeded 👏

Build Id: 57410224-9f6d-469e-b482-aaed1ec61303

The following development artifacts have been built, and will exist for the next 30 days:

A preview of the website (the last 30 builds are retained):

https://8089a39-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/3856/head:pr_3856 && git checkout pr_3856
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.registry=us-docker.pkg.dev/agones-images/ci --set agones.image.tag=1.42.0-dev-8089a39-amd64

github-actions bot added kind/other size/S labels Jun 5, 2024

Add security context

969863e

peterzhongyi force-pushed the sec branch from 80b657d to 969863e Compare June 6, 2024 00:25

markmandel reviewed Jun 7, 2024

View reviewed changes

mend

3cc787a

zmerlynn approved these changes Jun 10, 2024

View reviewed changes

Merge branch 'main' into sec

8089a39

markmandel approved these changes Jun 10, 2024

View reviewed changes

markmandel merged commit 69dd30f into googleforgames:main Jun 10, 2024
4 checks passed

peterzhongyi mentioned this pull request Jun 13, 2024

Add Security Context to game server sidecar #3869

Merged

kamaljeeti added kind/feature New features for Agones and removed kind/other labels Jul 15, 2024

peterzhongyi mentioned this pull request Oct 1, 2024

Request to become approver of Agone repo #4007

Closed

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add security context to Agones containers #3856

Add security context to Agones containers #3856

peterzhongyi commented Jun 5, 2024 •

edited by zmerlynn

Loading

zmerlynn commented Jun 5, 2024

agones-bot commented Jun 5, 2024

agones-bot commented Jun 6, 2024

peterzhongyi commented Jun 6, 2024

markmandel Jun 7, 2024

markmandel Jun 7, 2024

peterzhongyi Jun 10, 2024

zmerlynn Jun 10, 2024

zmerlynn Jun 10, 2024

agones-bot commented Jun 10, 2024

agones-bot commented Jun 10, 2024

agones-bot commented Jun 10, 2024

agones-bot commented Jun 10, 2024

Add security context to Agones containers #3856

Add security context to Agones containers #3856

Conversation

peterzhongyi commented Jun 5, 2024 • edited by zmerlynn Loading

zmerlynn commented Jun 5, 2024

agones-bot commented Jun 5, 2024

agones-bot commented Jun 6, 2024

peterzhongyi commented Jun 6, 2024

markmandel Jun 7, 2024

Choose a reason for hiding this comment

markmandel Jun 7, 2024

Choose a reason for hiding this comment

peterzhongyi Jun 10, 2024

Choose a reason for hiding this comment

zmerlynn Jun 10, 2024

Choose a reason for hiding this comment

zmerlynn Jun 10, 2024

Choose a reason for hiding this comment

agones-bot commented Jun 10, 2024

agones-bot commented Jun 10, 2024

agones-bot commented Jun 10, 2024

agones-bot commented Jun 10, 2024

peterzhongyi commented Jun 5, 2024 •

edited by zmerlynn

Loading