Skip to content

Commit 0ee877b

Browse files
ubergesundheitGacko
authored and
dkostyrev
committed
Chart: Explicitly set runAsGroup. (kubernetes#11679)
* Chart: Explicitly set `runAsGroup`. Set a default value for the runAsGroup in container securityContexts of the controller and default backend. Also set the runAsGroup for opentelemetry and webhook Job container securityContexts. Signed-off-by: Gerald Pape <[email protected]> * Apply suggestions from code review Co-authored-by: Marco Ebert <[email protected]> --------- Signed-off-by: Gerald Pape <[email protected]> Co-authored-by: Marco Ebert <[email protected]>
1 parent c95916f commit 0ee877b

File tree

6 files changed

+44
-4
lines changed

6 files changed

+44
-4
lines changed

‎charts/ingress-nginx/README.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
242242
| controller.admissionWebhooks.certificate | string | `"/usr/local/certificates/cert"` | |
243243
| controller.admissionWebhooks.createSecretJob.name | string | `"create"` | |
244244
| controller.admissionWebhooks.createSecretJob.resources | object | `{}` | |
245-
| controller.admissionWebhooks.createSecretJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for secret creation containers |
245+
| controller.admissionWebhooks.createSecretJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for secret creation containers |
246246
| controller.admissionWebhooks.enabled | bool | `true` | |
247247
| controller.admissionWebhooks.existingPsp | string | `""` | Use an existing PSP instead of creating one |
248248
| controller.admissionWebhooks.extraEnvs | list | `[]` | Additional environment variables to set |
@@ -273,7 +273,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
273273
| controller.admissionWebhooks.patch.tolerations | list | `[]` | |
274274
| controller.admissionWebhooks.patchWebhookJob.name | string | `"patch"` | |
275275
| controller.admissionWebhooks.patchWebhookJob.resources | object | `{}` | |
276-
| controller.admissionWebhooks.patchWebhookJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for webhook patch containers |
276+
| controller.admissionWebhooks.patchWebhookJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for webhook patch containers |
277277
| controller.admissionWebhooks.port | int | `8443` | |
278278
| controller.admissionWebhooks.service.annotations | object | `{}` | |
279279
| controller.admissionWebhooks.service.externalIPs | list | `[]` | |
@@ -331,8 +331,9 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
331331
| controller.image.pullPolicy | string | `"IfNotPresent"` | |
332332
| controller.image.readOnlyRootFilesystem | bool | `false` | |
333333
| controller.image.registry | string | `"registry.k8s.io"` | |
334+
| controller.image.runAsGroup | int | `82` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) |
334335
| controller.image.runAsNonRoot | bool | `true` | |
335-
| controller.image.runAsUser | int | `101` | |
336+
| controller.image.runAsUser | int | `101` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) |
336337
| controller.image.seccompProfile.type | string | `"RuntimeDefault"` | |
337338
| controller.image.tag | string | `"v1.11.1"` | |
338339
| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
@@ -396,6 +397,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
396397
| controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | |
397398
| controller.opentelemetry.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | |
398399
| controller.opentelemetry.containerSecurityContext.readOnlyRootFilesystem | bool | `true` | |
400+
| controller.opentelemetry.containerSecurityContext.runAsGroup | int | `65532` | |
399401
| controller.opentelemetry.containerSecurityContext.runAsNonRoot | bool | `true` | |
400402
| controller.opentelemetry.containerSecurityContext.runAsUser | int | `65532` | The image's default user, inherited from its base image `cgr.dev/chainguard/static`. |
401403
| controller.opentelemetry.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
@@ -505,6 +507,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
505507
| defaultBackend.image.pullPolicy | string | `"IfNotPresent"` | |
506508
| defaultBackend.image.readOnlyRootFilesystem | bool | `true` | |
507509
| defaultBackend.image.registry | string | `"registry.k8s.io"` | |
510+
| defaultBackend.image.runAsGroup | int | `65534` | |
508511
| defaultBackend.image.runAsNonRoot | bool | `true` | |
509512
| defaultBackend.image.runAsUser | int | `65534` | |
510513
| defaultBackend.image.seccompProfile.type | string | `"RuntimeDefault"` | |

‎charts/ingress-nginx/templates/_helpers.tpl

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ Controller container security context.
4747
{{- else -}}
4848
runAsNonRoot: {{ .Values.controller.image.runAsNonRoot }}
4949
runAsUser: {{ .Values.controller.image.runAsUser }}
50+
runAsGroup: {{ .Values.controller.image.runAsGroup }}
5051
allowPrivilegeEscalation: {{ or .Values.controller.image.allowPrivilegeEscalation .Values.controller.image.chroot }}
5152
{{- if .Values.controller.image.seccompProfile }}
5253
seccompProfile: {{ toYaml .Values.controller.image.seccompProfile | nindent 2 }}
@@ -222,6 +223,7 @@ Default backend container security context.
222223
{{- else -}}
223224
runAsNonRoot: {{ .Values.defaultBackend.image.runAsNonRoot }}
224225
runAsUser: {{ .Values.defaultBackend.image.runAsUser }}
226+
runAsGroup: {{ .Values.defaultBackend.image.runAsGroup }}
225227
allowPrivilegeEscalation: {{ .Values.defaultBackend.image.allowPrivilegeEscalation }}
226228
{{- if .Values.defaultBackend.image.seccompProfile }}
227229
seccompProfile: {{ toYaml .Values.defaultBackend.image.seccompProfile | nindent 2 }}

‎charts/ingress-nginx/tests/controller-daemonset_test.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,3 +138,12 @@ tests:
138138
values:
139139
- controller
140140
topologyKey: kubernetes.io/hostname
141+
142+
- it: should create a DaemonSet with `runAsGroup` if `controller.image.runAsGroup` is set
143+
set:
144+
controller.kind: DaemonSet
145+
controller.image.runAsGroup: 1000
146+
asserts:
147+
- equal:
148+
path: spec.template.spec.containers[0].securityContext.runAsGroup
149+
value: 1000

‎charts/ingress-nginx/tests/controller-deployment_test.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,3 +160,11 @@ tests:
160160
values:
161161
- controller
162162
topologyKey: kubernetes.io/hostname
163+
164+
- it: should create a Deployment with `runAsGroup` if `controller.image.runAsGroup` is set
165+
set:
166+
controller.image.runAsGroup: 1000
167+
asserts:
168+
- equal:
169+
path: spec.template.spec.containers[0].securityContext.runAsGroup
170+
value: 1000

‎charts/ingress-nginx/tests/default-backend-deployment_test.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,3 +135,12 @@ tests:
135135
values:
136136
- default-backend
137137
topologyKey: kubernetes.io/hostname
138+
139+
- it: should create a Deployment with `runAsGroup` if `defaultBackend.image.runAsGroup` is set
140+
set:
141+
defaultBackend.enabled: true
142+
defaultBackend.image.runAsGroup: 1000
143+
asserts:
144+
- equal:
145+
path: spec.template.spec.containers[0].securityContext.runAsGroup
146+
value: 1000

‎charts/ingress-nginx/values.yaml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,12 @@ controller:
3131
digestChroot: sha256:7cabe4bd7558bfdf5b707976d7be56fd15ffece735d7c90fc238b6eda290fd8d
3232
pullPolicy: IfNotPresent
3333
runAsNonRoot: true
34-
# www-data -> uid 101
34+
# -- This value must not be changed using the official image.
35+
# uid=101(www-data) gid=82(www-data) groups=82(www-data)
3536
runAsUser: 101
37+
# -- This value must not be changed using the official image.
38+
# uid=101(www-data) gid=82(www-data) groups=82(www-data)
39+
runAsGroup: 82
3640
allowPrivilegeEscalation: false
3741
seccompProfile:
3842
type: RuntimeDefault
@@ -688,6 +692,7 @@ controller:
688692
# containerSecurityContext:
689693
# runAsNonRoot: true
690694
# runAsUser: <user-id>
695+
# runAsGroup: <group-id>
691696
# allowPrivilegeEscalation: false
692697
# seccompProfile:
693698
# type: RuntimeDefault
@@ -717,6 +722,7 @@ controller:
717722
runAsNonRoot: true
718723
# -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.
719724
runAsUser: 65532
725+
runAsGroup: 65532
720726
allowPrivilegeEscalation: false
721727
seccompProfile:
722728
type: RuntimeDefault
@@ -768,6 +774,7 @@ controller:
768774
securityContext:
769775
runAsNonRoot: true
770776
runAsUser: 65532
777+
runAsGroup: 65532
771778
allowPrivilegeEscalation: false
772779
seccompProfile:
773780
type: RuntimeDefault
@@ -788,6 +795,7 @@ controller:
788795
securityContext:
789796
runAsNonRoot: true
790797
runAsUser: 65532
798+
runAsGroup: 65532
791799
allowPrivilegeEscalation: false
792800
seccompProfile:
793801
type: RuntimeDefault
@@ -963,6 +971,7 @@ defaultBackend:
963971
runAsNonRoot: true
964972
# nobody user -> uid 65534
965973
runAsUser: 65534
974+
runAsGroup: 65534
966975
allowPrivilegeEscalation: false
967976
seccompProfile:
968977
type: RuntimeDefault

0 commit comments

Comments
 (0)