mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 08:37:31 +09:00
Aleksei Sviridkin
aed0162711
The vm-disk pvc-resize, cozystack-api, seaweedfs and vm-instance update hooks (whose alpine/k8s image this PR refreshes) ran as root with no securityContext. Add a pod-level runAsNonRoot + runAsUser 65534 + seccompProfile RuntimeDefault and a container-level allowPrivilegeEscalation: false + capabilities drop ALL, mirroring the dashboard adopt hook. kubectl needs no root, so this is behavior-neutral. Each hook is lookup-gated; pin the securityContext in a per-chart helm-unittest that mocks the gating object (DaemonSet / PVC / Service) via kubernetesProvider so the guard renders without a cluster. vm-disk and vm-instance had no Makefile test target, so add 'test: helm unittest .' to both so CI runs the new suites. Scope note: other kubectl hooks on clastix/kubectl (mariadb, keycloak, kubernetes, tenant) are untouched here — they are not part of this alpine/k8s refresh and belong to a separate hardening pass. Also fix the vm-disk resize hook's backoffLimit: it was nested under the pod spec (silently ignored, leaving the Job at the default 6 retries) instead of Job.spec. Move it to Job.spec and pin it in the test. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
suite: cozystack-api post-upgrade hook runs non-root
|
|
|
|
# The hook only renders when the legacy cozystack-api DaemonSet still exists
|
|
# (lookup-gated), so mock that DaemonSet to drive the render, then pin the
|
|
# non-root securityContext so it cannot regress to running kubectl as root.
|
|
release:
|
|
name: cozystack-api
|
|
namespace: cozy-system
|
|
templates:
|
|
- templates/hook.yaml
|
|
kubernetesProvider:
|
|
scheme:
|
|
"apps/v1/DaemonSet":
|
|
gvr:
|
|
group: "apps"
|
|
version: "v1"
|
|
resource: "daemonsets"
|
|
namespaced: true
|
|
objects:
|
|
- kind: DaemonSet
|
|
apiVersion: apps/v1
|
|
metadata:
|
|
name: cozystack-api
|
|
namespace: cozy-system
|
|
tests:
|
|
- it: post-upgrade hook Job runs under a restrictive non-root securityContext
|
|
documentSelector:
|
|
path: kind
|
|
value: Job
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsNonRoot
|
|
value: true
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsUser
|
|
value: 65534
|
|
- equal:
|
|
path: spec.template.spec.securityContext.seccompProfile.type
|
|
value: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
|
|
value: false
|
|
- contains:
|
|
path: spec.template.spec.containers[0].securityContext.capabilities.drop
|
|
content: ALL
|