Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(helm): security contexts for ebpf cleanup hook #6235

Merged
merged 8 commits into from
Mar 8, 2023
+31 −6
Merged

fix(helm): security contexts for ebpf cleanup hook #6235

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
bb44db0
fix(helm): security contexts for ebpf cleanup hook
bartsmykla Mar 8, 2023
d9a9df4
fix(ci): format files
github-actions[bot] Mar 8, 2023
6ab7784
chore: be explicit inside security contexts
bartsmykla Mar 8, 2023
b3e3001
chore(deps): bump coredns from 1.10.0 to 1.10.1 (#6227)
michaelbeaumont Mar 8, 2023
e2396b2
chore: make format results
bartsmykla Mar 8, 2023
648aa0a
Merge remote-tracking branch 'upstream/master' into fix/security-cont…
bartsmykla Mar 8, 2023
dede69f
chore: add more explicit comment about ebpfCleanup
bartsmykla Mar 8, 2023
b6ecffe
chore: update golden files
bartsmykla Mar 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions deployments/charts/kuma/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,9 @@ A Helm chart for the Kuma Control Plane
| hooks.tolerations | list | `[]` | Tolerations for the HELM hooks |
| hooks.podSecurityContext | object | `{"runAsNonRoot":true}` | Security context at the pod level for crd/webhook/ns |
| hooks.containerSecurityContext | object | `{"readOnlyRootFilesystem":true}` | Security context at the container level for crd/webhook/ns |
| hooks.ebpfCleanup | object | `{"containerSecurityContext":{"readOnlyRootFilesystem":false},"podSecurityContext":{"runAsNonRoot":false}}` | ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs |
| hooks.ebpfCleanup.podSecurityContext | object | `{"runAsNonRoot":false}` | Security context at the pod level for crd/webhook/cleanup-ebpf |
| hooks.ebpfCleanup.containerSecurityContext | object | `{"readOnlyRootFilesystem":false}` | Security context at the container level for crd/webhook/cleanup-ebpf |
| experimental.gatewayAPI | bool | `false` | If true, it installs experimental Gateway API support |
| experimental.ebpf.enabled | bool | `false` | If true, ebpf will be used instead of using iptables to install/configure transparent proxy |
| experimental.ebpf.instanceIPEnvVarName | string | `"INSTANCE_IP"` | Name of the environmental variable which will contain the IP address of a pod |
Expand Down
12 changes: 6 additions & 6 deletions deployments/charts/kuma/templates/post-delete-cleanup-ebpf-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,14 +37,14 @@ rules:
resources:
- pods
verbs:
- watch
- watch
- delete
- deletecollection
- apiGroups: ["batch"]
resources:
- jobs
verbs:
- watch
- watch
- create
- delete
- deletecollection
Expand Down Expand Up @@ -97,16 +97,16 @@ spec:
{{ toYaml . | nindent 8 }}
{{- end }}
restartPolicy: OnFailure
{{- if .Values.hooks.podSecurityContext }}
{{- if .Values.hooks.ebpfCleanup.podSecurityContext }}
securityContext:
{{ toYaml .Values.hooks.podSecurityContext | trim | nindent 8 }}
{{ toYaml .Values.hooks.ebpfCleanup.podSecurityContext | trim | nindent 8 }}
{{- end }}
containers:
- name: post-delete-job
image: {{ include "kuma.formatImage" (dict "image" .Values.dataPlane.initImage "root" $) | quote }}
{{- if .Values.hooks.containerSecurityContext }}
{{- if .Values.hooks.ebpfCleanup.containerSecurityContext }}
securityContext:
{{ toYaml .Values.hooks.containerSecurityContext | trim | nindent 12 }}
{{ toYaml .Values.hooks.ebpfCleanup.containerSecurityContext | trim | nindent 12 }}
{{- end }}
resources:
requests:
Expand Down
9 changes: 9 additions & 0 deletions deployments/charts/kuma/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -664,6 +664,15 @@ hooks:
containerSecurityContext:
readOnlyRootFilesystem: true

# -- ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs
ebpfCleanup:
# -- Security context at the pod level for crd/webhook/cleanup-ebpf
bartsmykla marked this conversation as resolved.
Show resolved Hide resolved
podSecurityContext:
runAsNonRoot: false
# -- Security context at the container level for crd/webhook/cleanup-ebpf
containerSecurityContext:
readOnlyRootFilesystem: false

experimental:
# -- If true, it installs experimental Gateway API support
gatewayAPI: false
Expand Down