refactor(helm): add control for securityContext

[zvlb]

Signed-off-by: Zemtsov Vladimir [email protected]

Small feature for control securityContext in helm

Local test:

~ kind create cluster
...


~ k cluster-info
Kubernetes control plane is running at https://127.0.0.1:60977
CoreDNS is running at https://127.0.0.1:60977/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.


~ helm install capsule . -n capsule-system --create-namespace
NAME: capsule
LAST DEPLOYED: Fri Feb 10 09:57:02 2023
NAMESPACE: capsule-system
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
  ...

~ k get deployments.apps -n capsule-system capsule-controller-manager -o yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  ...
  name: capsule-controller-manager
  namespace: capsule-system
  ...
spec:
  ...
  template:
    ...
    spec:
      containers:
      - ...
        ...
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
        ...
      ...
      securityContext:
        runAsGroup: 1002
        runAsNonRoot: true
        runAsUser: 1002
      ...



~ k create -f - << EOF
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: oil
spec:
  owners:
  - name: alice
    kind: User
EOF
tenant.capsule.clastix.io/oil created


~ k get tenants
NAME   STATE    NAMESPACE QUOTA   NAMESPACE COUNT   NODE SELECTOR   AGE
oil    Active                     0                                 4s


~ ../../hack/create-user.sh alice oil
creating certs in TMPDIR /var/folders/c7/78_t4pvj5zd2qrcwgq05h7_40000gn/T/tmp.Sr8bOiQ3
merging groups /O=capsule.clastix.io
Generating RSA private key, 2048 bit long modulus
......................................+++
........+++
e is 65537 (0x10001)
certificatesigningrequest.certificates.k8s.io/alice-oil created
certificatesigningrequest.certificates.k8s.io/alice-oil approved
kubeconfig file is: alice-oil.kubeconfig
to use it as alice export KUBECONFIG=alice-oil.kubeconfig


~ export KUBECONFIG=alice-oil.kubeconfig
~ k create namespace oil-production
namespace/oil-production created

~ k create namespace oil-development
namespace/oil-development created


~ export KUBECONFIG=
~ k get tenant oil
NAME   STATE    NAMESPACE QUOTA   NAMESPACE COUNT   NODE SELECTOR   AGE
oil    Active                     2                                 38s

[netlify]

✅ Deploy Preview for capsule-documentation canceled.

Name	Link
🔨 Latest commit	60d4f62
🔍 Latest deploy log	https://app.netlify.com/sites/capsule-documentation/deploys/63e60a1fbbca060008ac8474

[zvlb]

This PR continuation of this - #693

SecurityContext I take from this issue - #680

[prometherion]

Astonishing work, @zvlb! <3

@oliverbaehler may I ask for your review on this?

[oliverbaehler]

Thanks for your contribution. Please look at my suggested change and retest everything :)

[zvlb]

I added default seccompProfile and retest capsule. All work good

[oliverbaehler]

@zvlb Thanks for the changes,

What I can still reproduce, is that when I install capsule with from your fork, the controller has one restart (Tested with 3 helm installations):

╰─○ kubectl logs -f capsule-controller-manager-75df7c7f56-frrc6 -n capsule-system                                           
{"level":"info","ts":"2023-02-10T11:33:40.825Z","logger":"setup","msg":"Capsule Version v0.2.1 d92f1e7"}
{"level":"info","ts":"2023-02-10T11:33:40.825Z","logger":"setup","msg":"Build from: https://github.com/clastix/capsule"}
{"level":"info","ts":"2023-02-10T11:33:40.825Z","logger":"setup","msg":"Build date: 2023-01-31T16:01:21"}
{"level":"info","ts":"2023-02-10T11:33:40.825Z","logger":"setup","msg":"Go Version: go1.18.10"}
{"level":"info","ts":"2023-02-10T11:33:40.825Z","logger":"setup","msg":"Go OS/Arch: linux/amd64"}
{"level":"info","ts":"2023-02-10T11:33:40.927Z","logger":"controller-runtime.metrics","msg":"Metrics server is starting to listen","addr":":8080"}
{"level":"info","ts":"2023-02-10T11:33:41.023Z","logger":"controllers.TLS","msg":"Generating new TLS certificate"}
{"level":"error","ts":"2023-02-10T11:34:30.524Z","logger":"controllers.TLS","msg":"cannot update Capsule TLS","error":"client rate limiter Wait returned an error: context canceled","stacktrace":"main.main\n\t/workspace/main.go:194\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:250"}
{"level":"error","ts":"2023-02-10T11:34:30.524Z","logger":"setup","msg":"unable to reconcile Capsule TLS secret","error":"client rate limiter Wait returned an error: context canceled","stacktrace":"main.main\n\t/workspace/main.go:195\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:250"}

What's the behavior for you? (Just want to make sure this doesn't break the default deployment) :)

[oliverbaehler]

/lgtm

[prometherion]

What's the behavior for you? (Just want to make sure this doesn't break the default deployment) :)

It's something I experienced too, it happens time to time while generating the webhook certificates.

We should increase the memory of the Controller to avoid this.

[zvlb]

Hi. I have a question.
Why step "release" was skipped?
https://github.com/clastix/capsule/actions/runs/4143616968

[prometherion]

Because I merged the PR and hadn't pushed the Helm tag:

https://github.com/clastix/capsule/blob/770ad22170d5484de7093bdcf8aa27178e9e95fe/.github/workflows/helm.yml#L70-L86

Please, note line nr. 71

Just pushed the related tag and the new Chart version is available, remember to issue helm repo update to get your local cache updated!

[zvlb]

TY!