From 86f810a6a7dec4a57d4dfa2ea65c7b1b9ef51e2b Mon Sep 17 00:00:00 2001 From: Peter Razumovsky Date: Tue, 8 Oct 2024 16:56:58 +0400 Subject: [PATCH] core: define empty securityContext for pods to fix CIS 5.7.3 Resolves CIS benchmark rule 5.7.3, Pods part. SecurityContext should be explicitly defined in pod level of Pod spec section. It is sufficient to specify empty securityContext to satisfy CIS 5.7.3 rule. 5.7.3 Apply Security Context to Your Pods and Containers When designing your containers and pods, make sure that you configure the security context for your pods, containers, and volumes. Signed-off-by: Peter Razumovsky (cherry picked from commit 516eab4d8a2cd8d46431aa4d2f8cc2dbe9694aed) --- pkg/operator/ceph/cluster/cleanup.go | 1 + pkg/operator/ceph/cluster/mgr/spec.go | 1 + pkg/operator/ceph/cluster/mon/spec.go | 1 + pkg/operator/ceph/cluster/nodedaemon/crash.go | 1 + pkg/operator/ceph/cluster/nodedaemon/exporter.go | 1 + pkg/operator/ceph/cluster/nodedaemon/pruner.go | 1 + pkg/operator/ceph/cluster/osd/key_rotation.go | 1 + pkg/operator/ceph/cluster/osd/provision_spec.go | 1 + pkg/operator/ceph/cluster/osd/spec.go | 5 +++-- pkg/operator/ceph/cluster/rbd/spec.go | 1 + pkg/operator/ceph/controller/cleanup.go | 1 + .../ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml | 1 + .../template/cephfs/csi-cephfsplugin-provisioner-dep.yaml | 1 + pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml | 1 + pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml | 1 + .../ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml | 1 + pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml | 1 + pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml | 1 + .../ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml | 1 + pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml | 1 + pkg/operator/ceph/file/mds/spec.go | 1 + pkg/operator/ceph/file/mirror/spec.go | 1 + pkg/operator/ceph/nfs/spec.go | 1 + pkg/operator/ceph/object/cosi/spec.go | 1 + pkg/operator/ceph/object/spec.go | 1 + pkg/operator/discover/discover.go | 1 + pkg/operator/k8sutil/cmdreporter/cmdreporter.go | 1 + 27 files changed, 29 insertions(+), 2 deletions(-) diff --git a/pkg/operator/ceph/cluster/cleanup.go b/pkg/operator/ceph/cluster/cleanup.go index 92b293359..b96f6bff9 100644 --- a/pkg/operator/ceph/cluster/cleanup.go +++ b/pkg/operator/ceph/cluster/cleanup.go @@ -161,6 +161,7 @@ func (c *ClusterController) cleanUpJobTemplateSpec(cluster *cephv1.CephCluster, Volumes: volumes, RestartPolicy: v1.RestartPolicyOnFailure, PriorityClassName: cephv1.GetCleanupPriorityClassName(cluster.Spec.PriorityClassNames), + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/cluster/mgr/spec.go b/pkg/operator/ceph/cluster/mgr/spec.go index 01cfb5f2b..be2ea0347 100644 --- a/pkg/operator/ceph/cluster/mgr/spec.go +++ b/pkg/operator/ceph/cluster/mgr/spec.go @@ -61,6 +61,7 @@ func (c *Cluster) makeDeployment(mgrConfig *mgrConfig) (*apps.Deployment, error) Containers: []v1.Container{ c.makeMgrDaemonContainer(mgrConfig), }, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: serviceAccountName, RestartPolicy: v1.RestartPolicyAlways, Volumes: volumes, diff --git a/pkg/operator/ceph/cluster/mon/spec.go b/pkg/operator/ceph/cluster/mon/spec.go index 9d79ace7b..aea546dac 100644 --- a/pkg/operator/ceph/cluster/mon/spec.go +++ b/pkg/operator/ceph/cluster/mon/spec.go @@ -189,6 +189,7 @@ func (c *Cluster) makeMonPod(monConfig *monConfig, canary bool) (*corev1.Pod, er Volumes: controller.DaemonVolumesBase(monConfig.DataPathMap, keyringStoreName, c.spec.DataDirHostPath), HostNetwork: monConfig.UseHostNetwork, PriorityClassName: cephv1.GetMonPriorityClassName(c.spec.PriorityClassNames), + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, } diff --git a/pkg/operator/ceph/cluster/nodedaemon/crash.go b/pkg/operator/ceph/cluster/nodedaemon/crash.go index 87ed94fb7..9f3eb43bc 100644 --- a/pkg/operator/ceph/cluster/nodedaemon/crash.go +++ b/pkg/operator/ceph/cluster/nodedaemon/crash.go @@ -121,6 +121,7 @@ func (r *ReconcileNode) createOrUpdateCephCrash(node corev1.Node, tolerations [] HostNetwork: cephCluster.Spec.Network.IsHost(), Volumes: volumes, PriorityClassName: cephv1.GetCrashCollectorPriorityClassName(cephCluster.Spec.PriorityClassNames), + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/cluster/nodedaemon/exporter.go b/pkg/operator/ceph/cluster/nodedaemon/exporter.go index a92834ccb..52beea0ad 100644 --- a/pkg/operator/ceph/cluster/nodedaemon/exporter.go +++ b/pkg/operator/ceph/cluster/nodedaemon/exporter.go @@ -143,6 +143,7 @@ func (r *ReconcileNode) createOrUpdateCephExporter(node corev1.Node, tolerations Volumes: volumes, PriorityClassName: cephv1.GetCephExporterPriorityClassName(cephCluster.Spec.PriorityClassNames), TerminationGracePeriodSeconds: &terminationGracePeriodSeconds, + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/cluster/nodedaemon/pruner.go b/pkg/operator/ceph/cluster/nodedaemon/pruner.go index bb8e3966b..1f6951690 100644 --- a/pkg/operator/ceph/cluster/nodedaemon/pruner.go +++ b/pkg/operator/ceph/cluster/nodedaemon/pruner.go @@ -110,6 +110,7 @@ func (r *ReconcileNode) createOrUpdateCephCron(cephCluster cephv1.CephCluster, c RestartPolicy: corev1.RestartPolicyNever, HostNetwork: cephCluster.Spec.Network.IsHost(), Volumes: volumes, + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/cluster/osd/key_rotation.go b/pkg/operator/ceph/cluster/osd/key_rotation.go index b1af021af..0905b71d9 100644 --- a/pkg/operator/ceph/cluster/osd/key_rotation.go +++ b/pkg/operator/ceph/cluster/osd/key_rotation.go @@ -161,6 +161,7 @@ func (c *Cluster) getKeyRotationPodTemplateSpec(osdProps osdProperties, osd OSDI HostNetwork: c.spec.Network.IsHost(), PriorityClassName: cephv1.GetOSDPriorityClassName(c.spec.PriorityClassNames), SchedulerName: osdProps.schedulerName, + SecurityContext: &v1.PodSecurityContext{}, }, } if c.spec.Network.IsHost() { diff --git a/pkg/operator/ceph/cluster/osd/provision_spec.go b/pkg/operator/ceph/cluster/osd/provision_spec.go index 9e3673dfb..209861c5d 100644 --- a/pkg/operator/ceph/cluster/osd/provision_spec.go +++ b/pkg/operator/ceph/cluster/osd/provision_spec.go @@ -157,6 +157,7 @@ func (c *Cluster) provisionPodTemplateSpec(osdProps osdProperties, restart v1.Re HostNetwork: c.spec.Network.IsHost(), PriorityClassName: cephv1.GetOSDPriorityClassName(c.spec.PriorityClassNames), SchedulerName: osdProps.schedulerName, + SecurityContext: &v1.PodSecurityContext{}, } if c.spec.Network.IsHost() { podSpec.DNSPolicy = v1.DNSClusterFirstWithHostNet diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go index 74ac41de2..98d927564 100644 --- a/pkg/operator/ceph/cluster/osd/spec.go +++ b/pkg/operator/ceph/cluster/osd/spec.go @@ -651,8 +651,9 @@ func (c *Cluster) makeDeployment(osdProps osdProperties, osd OSDInfo, provisionC WorkingDir: opconfig.VarLogCephDir, }, }, - Volumes: volumes, - SchedulerName: osdProps.schedulerName, + Volumes: volumes, + SecurityContext: &v1.PodSecurityContext{}, + SchedulerName: osdProps.schedulerName, }, } diff --git a/pkg/operator/ceph/cluster/rbd/spec.go b/pkg/operator/ceph/cluster/rbd/spec.go index 2b846eae8..217bdf1e2 100644 --- a/pkg/operator/ceph/cluster/rbd/spec.go +++ b/pkg/operator/ceph/cluster/rbd/spec.go @@ -43,6 +43,7 @@ func (r *ReconcileCephRBDMirror) makeDeployment(daemonConfig *daemonConfig, rbdM Volumes: controller.DaemonVolumes(daemonConfig.DataPathMap, daemonConfig.ResourceName, r.cephClusterSpec.DataDirHostPath), HostNetwork: r.cephClusterSpec.Network.IsHost(), PriorityClassName: rbdMirror.Spec.PriorityClassName, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/controller/cleanup.go b/pkg/operator/ceph/controller/cleanup.go index 99a4a60ef..739cce905 100644 --- a/pkg/operator/ceph/controller/cleanup.go +++ b/pkg/operator/ceph/controller/cleanup.go @@ -129,6 +129,7 @@ func (c *ResourceCleanup) jobTemplateSpec() v1.PodTemplateSpec { Volumes: volumes, RestartPolicy: v1.RestartPolicyOnFailure, PriorityClassName: cephv1.GetCleanupPriorityClassName(c.cluster.Spec.PriorityClassNames), + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml index 74937c30f..09d4c305a 100644 --- a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml +++ b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml @@ -29,6 +29,7 @@ spec: spec: # HostPID is needed to expose the correct process ID network namespace and not the process namespace hostPID: true + securityContext: {} serviceAccountName: rook-csi-cephfs-plugin-sa {{ if .PluginPriorityClassName }} priorityClassName: {{ .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml index 16784c0cd..41bddfb0b 100644 --- a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml +++ b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml @@ -17,6 +17,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-cephfs-provisioner-sa {{ if .ProvisionerPriorityClassName }} priorityClassName: {{ .ProvisionerPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml index 1f2b306e4..d1077a549 100644 --- a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml +++ b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml @@ -22,6 +22,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-cephfs-plugin-sa hostNetwork: {{ .EnableCSIHostNetwork }} {{ if .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml index 5ee0e6f06..f0143f424 100644 --- a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml +++ b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml @@ -29,6 +29,7 @@ spec: spec: # HostPID is needed to expose the correct process ID network namespace and not the process namespace hostPID: true + securityContext: {} serviceAccountName: rook-csi-nfs-plugin-sa {{ if .PluginPriorityClassName }} priorityClassName: {{ .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml index a9e2124a3..325c2594f 100644 --- a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml +++ b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml @@ -16,6 +16,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-nfs-provisioner-sa {{ if .ProvisionerPriorityClassName }} priorityClassName: {{ .ProvisionerPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml index 2572a205e..d39f20012 100644 --- a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml +++ b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml @@ -17,6 +17,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-nfs-plugin-sa hostNetwork: {{ .EnableCSIHostNetwork }} {{ if .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml index 9be084d4b..2acd7d5fc 100644 --- a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml +++ b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml @@ -29,6 +29,7 @@ spec: spec: # HostPID is needed to expose the correct process ID network namespace and not the process namespace hostPID: true + securityContext: {} serviceAccountName: rook-csi-rbd-plugin-sa {{ if .PluginPriorityClassName }} priorityClassName: {{ .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml index f96451f43..da4661e47 100644 --- a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml +++ b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml @@ -17,6 +17,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-rbd-provisioner-sa {{ if .ProvisionerPriorityClassName }} priorityClassName: {{ .ProvisionerPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml index 960598ace..ef8d0cfc8 100644 --- a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml +++ b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml @@ -22,6 +22,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-rbd-plugin-sa {{ if .PluginPriorityClassName }} priorityClassName: {{ .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/file/mds/spec.go b/pkg/operator/ceph/file/mds/spec.go index 426957a24..625792a85 100644 --- a/pkg/operator/ceph/file/mds/spec.go +++ b/pkg/operator/ceph/file/mds/spec.go @@ -65,6 +65,7 @@ func (c *Cluster) makeDeployment(mdsConfig *mdsConfig, fsNamespacedname types.Na Volumes: controller.DaemonVolumes(mdsConfig.DataPathMap, mdsConfig.ResourceName, c.clusterSpec.DataDirHostPath), HostNetwork: c.clusterSpec.Network.IsHost(), PriorityClassName: c.fs.Spec.MetadataServer.PriorityClassName, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/file/mirror/spec.go b/pkg/operator/ceph/file/mirror/spec.go index 8e9153b5b..caa936444 100644 --- a/pkg/operator/ceph/file/mirror/spec.go +++ b/pkg/operator/ceph/file/mirror/spec.go @@ -46,6 +46,7 @@ func (r *ReconcileFilesystemMirror) makeDeployment(daemonConfig *daemonConfig, f Volumes: controller.DaemonVolumes(daemonConfig.DataPathMap, daemonConfig.ResourceName, r.cephClusterSpec.DataDirHostPath), HostNetwork: r.cephClusterSpec.Network.IsHost(), PriorityClassName: fsMirror.Spec.PriorityClassName, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/nfs/spec.go b/pkg/operator/ceph/nfs/spec.go index 10edf9399..e8e459743 100644 --- a/pkg/operator/ceph/nfs/spec.go +++ b/pkg/operator/ceph/nfs/spec.go @@ -149,6 +149,7 @@ func (r *ReconcileCephNFS) makeDeployment(nfs *cephv1.CephNFS, cfg daemonConfig) // connecting to the krb server. give all ganesha servers the same hostname so they can all // use the same krb credentials to auth Hostname: fmt.Sprintf("%s-%s", nfs.Namespace, nfs.Name), + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, } // Replace default unreachable node toleration diff --git a/pkg/operator/ceph/object/cosi/spec.go b/pkg/operator/ceph/object/cosi/spec.go index 12674353f..c9c7c8a8e 100644 --- a/pkg/operator/ceph/object/cosi/spec.go +++ b/pkg/operator/ceph/object/cosi/spec.go @@ -87,6 +87,7 @@ func createCOSIPodSpec(cephCOSIDriver *cephv1.CephCOSIDriver) (corev1.PodTemplat cosiDriverContainer, cosiSideCarContainer, }, + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: DefaultServiceAccountName, Volumes: []corev1.Volume{ {Name: cosiSocketVolumeName, VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}}}, diff --git a/pkg/operator/ceph/object/spec.go b/pkg/operator/ceph/object/spec.go index 3213cc435..ff59930dc 100644 --- a/pkg/operator/ceph/object/spec.go +++ b/pkg/operator/ceph/object/spec.go @@ -152,6 +152,7 @@ func (c *clusterConfig) makeRGWPodSpec(rgwConfig *rgwConfig) (v1.PodTemplateSpec ), HostNetwork: hostNetwork, PriorityClassName: c.store.Spec.Gateway.PriorityClassName, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: serviceAccountName, } diff --git a/pkg/operator/discover/discover.go b/pkg/operator/discover/discover.go index bf543524b..7e53ec45e 100644 --- a/pkg/operator/discover/discover.go +++ b/pkg/operator/discover/discover.go @@ -175,6 +175,7 @@ func (d *Discover) createDiscoverDaemonSet(ctx context.Context, namespace, disco }, HostNetwork: false, PriorityClassName: k8sutil.GetValue(data, discoverDaemonsetPriorityClassNameEnv, ""), + SecurityContext: &v1.PodSecurityContext{}, }, }, }, diff --git a/pkg/operator/k8sutil/cmdreporter/cmdreporter.go b/pkg/operator/k8sutil/cmdreporter/cmdreporter.go index affc87558..c40e58afc 100644 --- a/pkg/operator/k8sutil/cmdreporter/cmdreporter.go +++ b/pkg/operator/k8sutil/cmdreporter/cmdreporter.go @@ -301,6 +301,7 @@ func (cr *cmdReporterCfg) initJobSpec() (*batch.Job, error) { *cmdReporterContainer, }, RestartPolicy: v1.RestartPolicyOnFailure, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, } copyBinsVol, _ := copyBinariesVolAndMount()