mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-29 16:17:20 +09:00
Aleksei Sviridkin
aed0162711
The vm-disk pvc-resize, cozystack-api, seaweedfs and vm-instance update hooks (whose alpine/k8s image this PR refreshes) ran as root with no securityContext. Add a pod-level runAsNonRoot + runAsUser 65534 + seccompProfile RuntimeDefault and a container-level allowPrivilegeEscalation: false + capabilities drop ALL, mirroring the dashboard adopt hook. kubectl needs no root, so this is behavior-neutral. Each hook is lookup-gated; pin the securityContext in a per-chart helm-unittest that mocks the gating object (DaemonSet / PVC / Service) via kubernetesProvider so the guard renders without a cluster. vm-disk and vm-instance had no Makefile test target, so add 'test: helm unittest .' to both so CI runs the new suites. Scope note: other kubectl hooks on clastix/kubectl (mariadb, keycloak, kubernetes, tenant) are untouched here — they are not part of this alpine/k8s refresh and belong to a separate hardening pass. Also fix the vm-disk resize hook's backoffLimit: it was nested under the pod spec (silently ignored, leaving the Job at the default 6 retries) instead of Job.spec. Move it to Job.spec and pin it in the test. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
53 lines
1.5 KiB
YAML
53 lines
1.5 KiB
YAML
suite: vm-instance update-hook runs non-root
|
|
|
|
# The update hook only renders when an existing VM/Service needs reconciling
|
|
# (lookup-gated). Mock a Service whose type differs from the desired one
|
|
# (existing LoadBalancer vs desired ClusterIP) to drive the render, then pin
|
|
# the non-root securityContext. Scope to the hook template so the chart's
|
|
# instanceType lookups elsewhere don't need a live cluster.
|
|
release:
|
|
name: test-vm
|
|
namespace: tenant-test
|
|
templates:
|
|
- templates/vm-update-hook.yaml
|
|
set:
|
|
fullnameOverride: test-vm
|
|
external: false
|
|
kubernetesProvider:
|
|
scheme:
|
|
"v1/Service":
|
|
gvr:
|
|
group: ""
|
|
version: "v1"
|
|
resource: "services"
|
|
namespaced: true
|
|
objects:
|
|
- kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: test-vm
|
|
namespace: tenant-test
|
|
spec:
|
|
type: LoadBalancer
|
|
tests:
|
|
- it: update-hook Job runs under a restrictive non-root securityContext
|
|
documentSelector:
|
|
path: kind
|
|
value: Job
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsNonRoot
|
|
value: true
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsUser
|
|
value: 65534
|
|
- equal:
|
|
path: spec.template.spec.securityContext.seccompProfile.type
|
|
value: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
|
|
value: false
|
|
- contains:
|
|
path: spec.template.spec.containers[0].securityContext.capabilities.drop
|
|
content: ALL
|