From aff2982ac510332f982e7ef1b85123c428adc818 Mon Sep 17 00:00:00 2001 From: Christian Schlotter Date: Thu, 6 Apr 2023 09:55:23 +0200 Subject: [PATCH] add explicit securityContexts to the controller and namespace label for privileged This does not really change the configuration, it just makes it explicit and enforce the defaults, except for the seccompPolicy which changes from Unconfined to RuntimeDefault. Syscalls filtered by RuntimeDefault policy are 95% namespaced and require capabilities (which we drop) in the first place, so no practical change there either. This allows the controller to be compatible to the restricted pod security admission profile. However, the nmi daemonset requires the privileged profile which is why this also adds the corresponding label to the namespace, to allow cluster-wide enforcement of a policy lower than privileged, while preserving privileged for the capz-system namespace. This is a recommendation in the CAPI v1.3->1.4 upgrade guide. --- config/default/namespace.yaml | 3 +++ config/manager/manager.yaml | 11 +++++++++++ 2 files changed, 14 insertions(+) diff --git a/config/default/namespace.yaml b/config/default/namespace.yaml index 1ab3a72555d..d331b0ad036 100644 --- a/config/default/namespace.yaml +++ b/config/default/namespace.yaml @@ -2,3 +2,6 @@ apiVersion: v1 kind: Namespace metadata: name: system + labels: + # this is required due to the nmi daemonset + pod-security.kubernetes.io/enforce: privileged diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index 98b04bd30b0..cf8118961eb 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -57,6 +57,17 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsUser: 65532 + runAsGroup: 65532 + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault terminationGracePeriodSeconds: 10 serviceAccountName: manager tolerations: