mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 02:57:27 +09:00
Aleksei Sviridkin
aed0162711
The vm-disk pvc-resize, cozystack-api, seaweedfs and vm-instance update hooks (whose alpine/k8s image this PR refreshes) ran as root with no securityContext. Add a pod-level runAsNonRoot + runAsUser 65534 + seccompProfile RuntimeDefault and a container-level allowPrivilegeEscalation: false + capabilities drop ALL, mirroring the dashboard adopt hook. kubectl needs no root, so this is behavior-neutral. Each hook is lookup-gated; pin the securityContext in a per-chart helm-unittest that mocks the gating object (DaemonSet / PVC / Service) via kubernetesProvider so the guard renders without a cluster. vm-disk and vm-instance had no Makefile test target, so add 'test: helm unittest .' to both so CI runs the new suites. Scope note: other kubectl hooks on clastix/kubectl (mariadb, keycloak, kubernetes, tenant) are untouched here — they are not part of this alpine/k8s refresh and belong to a separate hardening pass. Also fix the vm-disk resize hook's backoffLimit: it was nested under the pod spec (silently ignored, leaving the Job at the default 6 retries) instead of Job.spec. Move it to Job.spec and pin it in the test. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
65 lines
1.9 KiB
YAML
65 lines
1.9 KiB
YAML
suite: vm-disk pvc-resize hook runs non-root
|
|
|
|
# The resize hook only renders when an existing PVC is being grown
|
|
# (lookup-gated on the PVC + a larger .Values.storage), so mock a smaller PVC
|
|
# and request a larger size to drive the render, then pin the non-root
|
|
# securityContext. Scope to the hook template so the chart's tenant-identifier
|
|
# lookups elsewhere don't need a live cluster.
|
|
release:
|
|
name: test-vm-disk
|
|
namespace: tenant-test
|
|
templates:
|
|
- templates/pvc-resize-hook.yaml
|
|
set:
|
|
storage: 2Gi
|
|
kubernetesProvider:
|
|
scheme:
|
|
"v1/PersistentVolumeClaim":
|
|
gvr:
|
|
group: ""
|
|
version: "v1"
|
|
resource: "persistentvolumeclaims"
|
|
namespaced: true
|
|
objects:
|
|
- kind: PersistentVolumeClaim
|
|
apiVersion: v1
|
|
metadata:
|
|
name: test-vm-disk
|
|
namespace: tenant-test
|
|
spec:
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
tests:
|
|
- it: pvc-resize hook Job runs under a restrictive non-root securityContext
|
|
documentSelector:
|
|
path: kind
|
|
value: Job
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsNonRoot
|
|
value: true
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsUser
|
|
value: 65534
|
|
- equal:
|
|
path: spec.template.spec.securityContext.seccompProfile.type
|
|
value: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
|
|
value: false
|
|
- contains:
|
|
path: spec.template.spec.containers[0].securityContext.capabilities.drop
|
|
content: ALL
|
|
|
|
- it: backoffLimit is set at Job.spec, not silently dropped under the pod spec
|
|
documentSelector:
|
|
path: kind
|
|
value: Job
|
|
asserts:
|
|
- equal:
|
|
path: spec.backoffLimit
|
|
value: 1
|
|
- notExists:
|
|
path: spec.template.spec.backoffLimit
|