core: define empty securityContext for pods to fix CIS 5.7.3

Resolves CIS benchmark rule 5.7.3, Pods part. SecurityContext
should be explicitly defined in pod level of Pod spec section.
It is sufficient to specify empty securityContext to satisfy
CIS 5.7.3 rule.

5.7.3 Apply Security Context to Your Pods and Containers

When designing your containers and pods, make sure
that you configure the security context for your pods,
containers, and volumes.

Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
(cherry picked from commit 516eab4d8a)

pkg/operator/ceph/cluster/cleanup.go

@@ -161,6 +161,7 @@ func (c *ClusterController) cleanUpJobTemplateSpec(cluster *cephv1.CephCluster,
 			Volumes:            volumes,
 			RestartPolicy:      v1.RestartPolicyOnFailure,
 			PriorityClassName:  cephv1.GetCleanupPriorityClassName(cluster.Spec.PriorityClassNames),
+			SecurityContext:    &v1.PodSecurityContext{},
 			ServiceAccountName: k8sutil.DefaultServiceAccount,
 		},
 	}

pkg/operator/ceph/cluster/mgr/spec.go

@@ -61,6 +61,7 @@ func (c *Cluster) makeDeployment(mgrConfig *mgrConfig) (*apps.Deployment, error)
 			Containers: []v1.Container{
 				c.makeMgrDaemonContainer(mgrConfig),
 			},
+			SecurityContext:    &v1.PodSecurityContext{},
 			ServiceAccountName: serviceAccountName,
 			RestartPolicy:      v1.RestartPolicyAlways,
 			Volumes:            volumes,

pkg/operator/ceph/cluster/mon/spec.go

@@ -189,6 +189,7 @@ func (c *Cluster) makeMonPod(monConfig *monConfig, canary bool) (*corev1.Pod, er
 		Volumes:            controller.DaemonVolumesBase(monConfig.DataPathMap, keyringStoreName, c.spec.DataDirHostPath),
 		HostNetwork:        monConfig.UseHostNetwork,
 		PriorityClassName:  cephv1.GetMonPriorityClassName(c.spec.PriorityClassNames),
+		SecurityContext:    &corev1.PodSecurityContext{},
 		ServiceAccountName: k8sutil.DefaultServiceAccount,
 	}
 

pkg/operator/ceph/cluster/nodedaemon/crash.go

@@ -121,6 +121,7 @@ func (r *ReconcileNode) createOrUpdateCephCrash(node corev1.Node, tolerations []
 				HostNetwork:        cephCluster.Spec.Network.IsHost(),
 				Volumes:            volumes,
 				PriorityClassName:  cephv1.GetCrashCollectorPriorityClassName(cephCluster.Spec.PriorityClassNames),
+				SecurityContext:    &corev1.PodSecurityContext{},
 				ServiceAccountName: k8sutil.DefaultServiceAccount,
 			},
 		}

pkg/operator/ceph/cluster/nodedaemon/exporter.go

@@ -143,6 +143,7 @@ func (r *ReconcileNode) createOrUpdateCephExporter(node corev1.Node, tolerations
 				Volumes:                       volumes,
 				PriorityClassName:             cephv1.GetCephExporterPriorityClassName(cephCluster.Spec.PriorityClassNames),
 				TerminationGracePeriodSeconds: &terminationGracePeriodSeconds,
+				SecurityContext:               &corev1.PodSecurityContext{},
 				ServiceAccountName:            k8sutil.DefaultServiceAccount,
 			},
 		}

pkg/operator/ceph/cluster/nodedaemon/pruner.go

@@ -110,6 +110,7 @@ func (r *ReconcileNode) createOrUpdateCephCron(cephCluster cephv1.CephCluster, c
 			RestartPolicy:      corev1.RestartPolicyNever,
 			HostNetwork:        cephCluster.Spec.Network.IsHost(),
 			Volumes:            volumes,
+			SecurityContext:    &corev1.PodSecurityContext{},
 			ServiceAccountName: k8sutil.DefaultServiceAccount,
 		},
 	}

pkg/operator/ceph/cluster/osd/key_rotation.go

@@ -161,6 +161,7 @@ func (c *Cluster) getKeyRotationPodTemplateSpec(osdProps osdProperties, osd OSDI
 			HostNetwork:       c.spec.Network.IsHost(),
 			PriorityClassName: cephv1.GetOSDPriorityClassName(c.spec.PriorityClassNames),
 			SchedulerName:     osdProps.schedulerName,
+			SecurityContext:   &v1.PodSecurityContext{},
 		},
 	}
 	if c.spec.Network.IsHost() {

pkg/operator/ceph/cluster/osd/provision_spec.go

@@ -157,6 +157,7 @@ func (c *Cluster) provisionPodTemplateSpec(osdProps osdProperties, restart v1.Re
 		HostNetwork:       c.spec.Network.IsHost(),
 		PriorityClassName: cephv1.GetOSDPriorityClassName(c.spec.PriorityClassNames),
 		SchedulerName:     osdProps.schedulerName,
+		SecurityContext:   &v1.PodSecurityContext{},
 	}
 	if c.spec.Network.IsHost() {
 		podSpec.DNSPolicy = v1.DNSClusterFirstWithHostNet

pkg/operator/ceph/cluster/osd/spec.go

@@ -651,8 +651,9 @@ func (c *Cluster) makeDeployment(osdProps osdProperties, osd OSDInfo, provisionC
 					WorkingDir:      opconfig.VarLogCephDir,
 				},
 			},
-			Volumes:       volumes,
-			SchedulerName: osdProps.schedulerName,
+			Volumes:         volumes,
+			SecurityContext: &v1.PodSecurityContext{},
+			SchedulerName:   osdProps.schedulerName,
 		},
 	}
 

pkg/operator/ceph/cluster/rbd/spec.go

@@ -43,6 +43,7 @@ func (r *ReconcileCephRBDMirror) makeDeployment(daemonConfig *daemonConfig, rbdM
 			Volumes:            controller.DaemonVolumes(daemonConfig.DataPathMap, daemonConfig.ResourceName, r.cephClusterSpec.DataDirHostPath),
 			HostNetwork:        r.cephClusterSpec.Network.IsHost(),
 			PriorityClassName:  rbdMirror.Spec.PriorityClassName,
+			SecurityContext:    &v1.PodSecurityContext{},
 			ServiceAccountName: k8sutil.DefaultServiceAccount,
 		},
 	}

pkg/operator/ceph/controller/cleanup.go

@@ -129,6 +129,7 @@ func (c *ResourceCleanup) jobTemplateSpec() v1.PodTemplateSpec {
 			Volumes:            volumes,
 			RestartPolicy:      v1.RestartPolicyOnFailure,
 			PriorityClassName:  cephv1.GetCleanupPriorityClassName(c.cluster.Spec.PriorityClassNames),
+			SecurityContext:    &v1.PodSecurityContext{},
 			ServiceAccountName: k8sutil.DefaultServiceAccount,
 		},
 	}

pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml

@@ -29,6 +29,7 @@ spec:
     spec:
       # HostPID is needed to expose the correct process ID network namespace and not the process namespace
       hostPID: true
+      securityContext: {}
       serviceAccountName: rook-csi-cephfs-plugin-sa
       {{ if .PluginPriorityClassName }}
       priorityClassName: {{ .PluginPriorityClassName }}

pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml

@@ -17,6 +17,7 @@ spec:
         {{ $key }}: "{{ $value }}"
         {{ end }}
     spec:
+      securityContext: {}
       serviceAccountName: rook-csi-cephfs-provisioner-sa
       {{ if .ProvisionerPriorityClassName }}
       priorityClassName: {{ .ProvisionerPriorityClassName }}

pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml

@@ -22,6 +22,7 @@ spec:
         {{ $key }}: "{{ $value }}"
         {{ end }}
     spec:
+      securityContext: {}
       serviceAccountName: rook-csi-cephfs-plugin-sa
       hostNetwork: {{ .EnableCSIHostNetwork }}
       {{ if .PluginPriorityClassName }}

pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml

@@ -29,6 +29,7 @@ spec:
     spec:
       # HostPID is needed to expose the correct process ID network namespace and not the process namespace
       hostPID: true
+      securityContext: {}
       serviceAccountName: rook-csi-nfs-plugin-sa
       {{ if .PluginPriorityClassName }}
       priorityClassName: {{ .PluginPriorityClassName }}

pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml

@@ -16,6 +16,7 @@ spec:
         {{ $key }}: "{{ $value }}"
         {{ end }}
     spec:
+      securityContext: {}
       serviceAccountName: rook-csi-nfs-provisioner-sa
       {{ if .ProvisionerPriorityClassName }}
       priorityClassName: {{ .ProvisionerPriorityClassName }}

pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml

@@ -17,6 +17,7 @@ spec:
         {{ $key }}: "{{ $value }}"
         {{ end }}
     spec:
+      securityContext: {}
       serviceAccountName: rook-csi-nfs-plugin-sa
       hostNetwork: {{ .EnableCSIHostNetwork }}
       {{ if .PluginPriorityClassName }}

pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml

@@ -29,6 +29,7 @@ spec:
     spec:
       # HostPID is needed to expose the correct process ID network namespace and not the process namespace
       hostPID: true
+      securityContext: {}
       serviceAccountName: rook-csi-rbd-plugin-sa
       {{ if .PluginPriorityClassName }}
       priorityClassName: {{ .PluginPriorityClassName }}

pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml

@@ -17,6 +17,7 @@ spec:
         {{ $key }}: "{{ $value }}"
         {{ end }}
     spec:
+      securityContext: {}
       serviceAccountName: rook-csi-rbd-provisioner-sa
       {{ if .ProvisionerPriorityClassName }}
       priorityClassName: {{ .ProvisionerPriorityClassName }}

pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml

@@ -22,6 +22,7 @@ spec:
         {{ $key }}: "{{ $value }}"
         {{ end }}
     spec:
+      securityContext: {}
       serviceAccountName: rook-csi-rbd-plugin-sa
       {{ if .PluginPriorityClassName }}
       priorityClassName: {{ .PluginPriorityClassName }}

pkg/operator/ceph/file/mds/spec.go

@@ -65,6 +65,7 @@ func (c *Cluster) makeDeployment(mdsConfig *mdsConfig, fsNamespacedname types.Na
 			Volumes:            controller.DaemonVolumes(mdsConfig.DataPathMap, mdsConfig.ResourceName, c.clusterSpec.DataDirHostPath),
 			HostNetwork:        c.clusterSpec.Network.IsHost(),
 			PriorityClassName:  c.fs.Spec.MetadataServer.PriorityClassName,
+			SecurityContext:    &v1.PodSecurityContext{},
 			ServiceAccountName: k8sutil.DefaultServiceAccount,
 		},
 	}

pkg/operator/ceph/file/mirror/spec.go

@@ -46,6 +46,7 @@ func (r *ReconcileFilesystemMirror) makeDeployment(daemonConfig *daemonConfig, f
 			Volumes:            controller.DaemonVolumes(daemonConfig.DataPathMap, daemonConfig.ResourceName, r.cephClusterSpec.DataDirHostPath),
 			HostNetwork:        r.cephClusterSpec.Network.IsHost(),
 			PriorityClassName:  fsMirror.Spec.PriorityClassName,
+			SecurityContext:    &v1.PodSecurityContext{},
 			ServiceAccountName: k8sutil.DefaultServiceAccount,
 		},
 	}

pkg/operator/ceph/nfs/spec.go

@@ -149,6 +149,7 @@ func (r *ReconcileCephNFS) makeDeployment(nfs *cephv1.CephNFS, cfg daemonConfig)
 		// connecting to the krb server. give all ganesha servers the same hostname so they can all
 		// use the same krb credentials to auth
 		Hostname:           fmt.Sprintf("%s-%s", nfs.Namespace, nfs.Name),
+		SecurityContext:    &v1.PodSecurityContext{},
 		ServiceAccountName: k8sutil.DefaultServiceAccount,
 	}
 	// Replace default unreachable node toleration

pkg/operator/ceph/object/cosi/spec.go

@@ -87,6 +87,7 @@ func createCOSIPodSpec(cephCOSIDriver *cephv1.CephCOSIDriver) (corev1.PodTemplat
 			cosiDriverContainer,
 			cosiSideCarContainer,
 		},
+		SecurityContext:    &corev1.PodSecurityContext{},
 		ServiceAccountName: DefaultServiceAccountName,
 		Volumes: []corev1.Volume{
 			{Name: cosiSocketVolumeName, VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}}},

pkg/operator/ceph/object/spec.go

@@ -152,6 +152,7 @@ func (c *clusterConfig) makeRGWPodSpec(rgwConfig *rgwConfig) (v1.PodTemplateSpec
 		),
 		HostNetwork:        hostNetwork,
 		PriorityClassName:  c.store.Spec.Gateway.PriorityClassName,
+		SecurityContext:    &v1.PodSecurityContext{},
 		ServiceAccountName: serviceAccountName,
 	}
 

pkg/operator/discover/discover.go

@@ -175,6 +175,7 @@ func (d *Discover) createDiscoverDaemonSet(ctx context.Context, namespace, disco
 					},
 					HostNetwork:       false,
 					PriorityClassName: k8sutil.GetValue(data, discoverDaemonsetPriorityClassNameEnv, ""),
+					SecurityContext:   &v1.PodSecurityContext{},
 				},
 			},
 		},

pkg/operator/k8sutil/cmdreporter/cmdreporter.go

@@ -301,6 +301,7 @@ func (cr *cmdReporterCfg) initJobSpec() (*batch.Job, error) {
 			*cmdReporterContainer,
 		},
 		RestartPolicy:      v1.RestartPolicyOnFailure,
+		SecurityContext:    &v1.PodSecurityContext{},
 		ServiceAccountName: k8sutil.DefaultServiceAccount,
 	}
 	copyBinsVol, _ := copyBinariesVolAndMount()