Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

set securityContext for http-add-on chart #561

Merged
merged 8 commits into from
Dec 3, 2023
Merged

set securityContext for http-add-on chart #561

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
21c5782
set securityContext for http-add-on chart
eumel8 Nov 6, 2023
c45fc73
revert version
eumel8 Nov 7, 2023
d3a0bfd
add keda is default
eumel8 Nov 7, 2023
993f904
fix values doc
eumel8 Nov 7, 2023
52110a6
generate helm-docs
eumel8 Nov 7, 2023
899ae15
comment runtime user
eumel8 Nov 28, 2023
78aa449
helm-docs
eumel8 Nov 28, 2023
26d6655
Merge branch 'main' into fix/add-ons-http
tomkerkhove Dec 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions http-add-on/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,9 @@ their default values.
| `images.operator` | string | `"ghcr.io/kedacore/http-add-on-operator"` | Image name for the operator image component |
| `images.scaler` | string | `"ghcr.io/kedacore/http-add-on-scaler"` | Image name for the scaler image component |
| `images.tag` | string | `""` | Image tag for the http add on. This tag is applied to the images listed in `images.operator`, `images.interceptor`, and `images.scaler`. Optional, given app version of Helm chart is used by default |
| `podSecurityContext` | object | [See below](#KEDA-is-secure-by-default) | [Pod security context] for all pods |
| `rbac.aggregateToDefaultRoles` | bool | `false` | Install aggregate roles for edit and view |
| `securityContext` | object | [See below](#KEDA-is-secure-by-default) | [Security context] for all containers |

### Operator

Expand Down Expand Up @@ -171,5 +173,71 @@ be provided while installing the chart. For example,
helm install http-add-on kedacore/keda-add-ons-http --namespace keda -f values.yaml
```

## KEDA is secure by default

Our default configuration strives to be as secure as possible. Because of that, KEDA will run as non-root and be secure-by-default. You can define global securityContext for all components or switch to granular mode and define securityContext for operator, kuberbacproxy, scaler, and interceptor:
```yaml
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
# runAsUser: 1000
# runAsGroup: 1000
# operator:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# kuberbacproxy:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# scaler:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# interceptor:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
podSecurityContext:
fsGroup: 1000
supplementalGroups:
- 1000
# operator:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
# scaler:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
# interceptor:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
```

----------------------------------------------
Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs)
66 changes: 66 additions & 0 deletions http-add-on/README.md.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,5 +135,71 @@ be provided while installing the chart. For example,
helm install http-add-on kedacore/keda-add-ons-http --namespace keda -f values.yaml
```

## KEDA is secure by default

Our default configuration strives to be as secure as possible. Because of that, KEDA will run as non-root and be secure-by-default. You can define global securityContext for all components or switch to granular mode and define securityContext for operator, kuberbacproxy, scaler, and interceptor:
```yaml
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
# runAsUser: 1000
# runAsGroup: 1000
# operator:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# kuberbacproxy:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# scaler:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# interceptor:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
podSecurityContext:
fsGroup: 1000
supplementalGroups:
- 1000
# operator:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
# scaler:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
# interceptor:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
```

----------------------------------------------
Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs)
14 changes: 14 additions & 0 deletions http-add-on/templates/interceptor/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,13 @@ spec:
imagePullSecrets:
{{- toYaml .Values.interceptor.imagePullSecrets | nindent 8 }}
serviceAccountName: {{ .Chart.Name }}-interceptor
{{- if .Values.podSecurityContext.interceptor }}
securityContext:
{{- toYaml .Values.podSecurityContext.interceptor | nindent 8 }}
{{- else }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- end }}
containers:
- args:
image: "{{ .Values.images.interceptor }}:{{ .Values.images.tag | default .Chart.AppVersion }}"
Expand Down Expand Up @@ -60,6 +67,13 @@ spec:
name: inter-proxy
resources:
{{- toYaml .Values.interceptor.resources | nindent 10 }}
{{- if .Values.securityContext.interceptor }}
securityContext:
{{- toYaml .Values.securityContext.interceptor | nindent 10 }}
{{- else }}
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- end }}
terminationGracePeriodSeconds: 10
nodeSelector:
kubernetes.io/os: linux
Expand Down
23 changes: 22 additions & 1 deletion http-add-on/templates/operator/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,21 +21,35 @@ spec:
imagePullSecrets:
{{- toYaml .Values.operator.imagePullSecrets | nindent 8 }}
serviceAccountName: {{ .Chart.Name }}
{{- if .Values.podSecurityContext.operator }}
securityContext:
{{- toYaml .Values.podSecurityContext.operator | nindent 8 }}
{{- else }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- end }}
containers:
- args:
- --secure-listen-address=0.0.0.0:{{ .Values.operator.port | default 8443 }}
- --upstream=http://127.0.0.1:8080/
- --logtostderr=true
- --v=10
image: "{{ .Values.images.kubeRbacProxy.name }}:{{ .Values.images.kubeRbacProxy.tag }}"
name: kube-rbac-proxy
resources:
limits:
cpu: 300m
memory: 200Mi
requests:
cpu: 10m
memory: 20Mi
name: kube-rbac-proxy
{{- if .Values.securityContext.kuberbacproxy }}
securityContext:
{{- toYaml .Values.securityContext.kuberbacproxy | nindent 10 }}
{{- else }}
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- end }}
- args:
- --metrics-bind-address=127.0.0.1:8080
- --leader-elect
Expand Down Expand Up @@ -66,6 +80,13 @@ spec:
port: probes
resources:
{{- toYaml .Values.operator.resources | nindent 10 }}
{{- if .Values.securityContext.operator }}
securityContext:
{{- toYaml .Values.securityContext.operator | nindent 10 }}
{{- else }}
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- end }}
terminationGracePeriodSeconds: 10
nodeSelector:
kubernetes.io/os: linux
Expand Down
14 changes: 14 additions & 0 deletions http-add-on/templates/scaler/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,13 @@ spec:
imagePullSecrets:
{{- toYaml .Values.scaler.imagePullSecrets | nindent 8 }}
serviceAccountName: {{ .Chart.Name }}-external-scaler
{{- if .Values.podSecurityContext.scaler }}
securityContext:
{{- toYaml .Values.podSecurityContext.scaler | nindent 8 }}
{{- else }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- end }}
containers:
- args:
image: "{{ .Values.images.scaler }}:{{ .Values.images.tag | default .Chart.AppVersion }}"
Expand Down Expand Up @@ -48,6 +55,13 @@ spec:
value: "{{ .Values.scaler.streamInterval }}"
resources:
{{- toYaml .Values.scaler.resources | nindent 10 }}
{{- if .Values.securityContext.scaler }}
securityContext:
{{- toYaml .Values.securityContext.scaler | nindent 10 }}
{{- else }}
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
{{- end }}
terminationGracePeriodSeconds: 10
nodeSelector:
kubernetes.io/os: linux
Expand Down
66 changes: 66 additions & 0 deletions http-add-on/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,3 +158,69 @@ images:
rbac:
# -- Install aggregate roles for edit and view
aggregateToDefaultRoles: false

# -- [Security context] for all containers
# @default -- [See below](#KEDA-is-secure-by-default)
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
# runAsUser: 1000
# runAsGroup: 1000
# operator:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# kuberbacproxy:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# scaler:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault
# interceptor:
# capabilities:
# drop:
# - ALL
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# seccompProfile:
# type: RuntimeDefault

# -- [Pod security context] for all pods
eumel8 marked this conversation as resolved.
Show resolved Hide resolved
# @default -- [See below](#KEDA-is-secure-by-default)
podSecurityContext:
fsGroup: 1000
supplementalGroups:
- 1000
# operator:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
# scaler:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
# interceptor:
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# fsGroup: 1000
Loading