From 492715f534c9b04e8b4eca6f6ad9f4680228479a Mon Sep 17 00:00:00 2001 From: oriyarde Date: Wed, 2 Dec 2020 20:35:25 +0200 Subject: [PATCH 1/7] add more explicit security contexts --- deploy/installer/generated/ibm-block-csi-operator.yaml | 5 +++++ ...bm-block-csi-operator.v1.4.0.clusterserviceversion.yaml | 5 +++++ ...bm-block-csi-operator.v1.4.0.clusterserviceversion.yaml | 5 +++++ deploy/operator.yaml | 5 +++++ pkg/controller/ibmblockcsi/syncer/csi_controller.go | 7 ++++++- pkg/controller/ibmblockcsi/syncer/csi_node.go | 2 ++ 6 files changed, 28 insertions(+), 1 deletion(-) diff --git a/deploy/installer/generated/ibm-block-csi-operator.yaml b/deploy/installer/generated/ibm-block-csi-operator.yaml index 93370252b..cf1255c89 100644 --- a/deploy/installer/generated/ibm-block-csi-operator.yaml +++ b/deploy/installer/generated/ibm-block-csi-operator.yaml @@ -1467,9 +1467,14 @@ spec: initialDelaySeconds: 10 periodSeconds: 30 securityContext: + allowPrivilegeEscalation: false capabilities: drop: - ALL + privileged: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 image: ibmcom/ibm-block-csi-operator:1.4.0 imagePullPolicy: IfNotPresent command: diff --git a/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml b/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml index 5c7a48bec..5e3c12875 100644 --- a/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml +++ b/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml @@ -765,9 +765,14 @@ spec: initialDelaySeconds: 10 periodSeconds: 30 securityContext: + allowPrivilegeEscalation: false capabilities: drop: - ALL + privileged: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 image: ibmcom/ibm-block-csi-operator:1.4.0 imagePullPolicy: IfNotPresent command: diff --git a/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml b/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml index 4a07723d1..369574251 100644 --- a/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml +++ b/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml @@ -763,9 +763,14 @@ spec: initialDelaySeconds: 10 periodSeconds: 30 securityContext: + allowPrivilegeEscalation: false capabilities: drop: - ALL + privileged: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 image: registry.connect.redhat.com/ibm/ibm-block-csi-operator:1.4.0 imagePullPolicy: IfNotPresent command: diff --git a/deploy/operator.yaml b/deploy/operator.yaml index 7cd0b549e..86ba83d89 100644 --- a/deploy/operator.yaml +++ b/deploy/operator.yaml @@ -60,9 +60,14 @@ spec: initialDelaySeconds: 10 periodSeconds: 30 securityContext: + allowPrivilegeEscalation: false capabilities: drop: - ALL + privileged: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 image: ibmcom/ibm-block-csi-operator:1.4.0 imagePullPolicy: IfNotPresent command: diff --git a/pkg/controller/ibmblockcsi/syncer/csi_controller.go b/pkg/controller/ibmblockcsi/syncer/csi_controller.go index e41920efb..67acce1d5 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_controller.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_controller.go @@ -223,7 +223,12 @@ func ensureNodeAffinity() *corev1.NodeAffinity { } func (s *csiControllerSyncer) ensureContainer(name, image string, args []string) corev1.Container { - sc := &corev1.SecurityContext{AllowPrivilegeEscalation: boolptr.False()} + sc := &corev1.SecurityContext{ + Privileged: boolptr.False(), + RunAsNonRoot: boolptr.True(), + ReadOnlyRootFilesystem: boolptr.True(), + AllowPrivilegeEscalation: boolptr.False(), + } fillSecurityContextCapabilities(sc) return corev1.Container{ Name: name, diff --git a/pkg/controller/ibmblockcsi/syncer/csi_node.go b/pkg/controller/ibmblockcsi/syncer/csi_node.go index 4874c79cd..7de79db18 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_node.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_node.go @@ -135,6 +135,8 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container { nodePlugin.SecurityContext = &corev1.SecurityContext{ Privileged: boolptr.True(), + RunAsNonRoot: boolptr.False(), + ReadOnlyRootFilesystem: boolptr.True(), AllowPrivilegeEscalation: boolptr.True(), } fillSecurityContextCapabilities( From e299ef76cf6de12e650ff191fa1a09c60bbbe689 Mon Sep 17 00:00:00 2001 From: oriyarde Date: Wed, 2 Dec 2020 21:50:14 +0200 Subject: [PATCH 2/7] align indentation --- pkg/controller/ibmblockcsi/syncer/csi_controller.go | 6 +++--- pkg/controller/ibmblockcsi/syncer/csi_node.go | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pkg/controller/ibmblockcsi/syncer/csi_controller.go b/pkg/controller/ibmblockcsi/syncer/csi_controller.go index 67acce1d5..2dd9c098c 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_controller.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_controller.go @@ -224,9 +224,9 @@ func ensureNodeAffinity() *corev1.NodeAffinity { func (s *csiControllerSyncer) ensureContainer(name, image string, args []string) corev1.Container { sc := &corev1.SecurityContext{ - Privileged: boolptr.False(), - RunAsNonRoot: boolptr.True(), - ReadOnlyRootFilesystem: boolptr.True(), + Privileged: boolptr.False(), + RunAsNonRoot: boolptr.True(), + ReadOnlyRootFilesystem: boolptr.True(), AllowPrivilegeEscalation: boolptr.False(), } fillSecurityContextCapabilities(sc) diff --git a/pkg/controller/ibmblockcsi/syncer/csi_node.go b/pkg/controller/ibmblockcsi/syncer/csi_node.go index 7de79db18..ae7f36f3e 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_node.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_node.go @@ -135,8 +135,8 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container { nodePlugin.SecurityContext = &corev1.SecurityContext{ Privileged: boolptr.True(), - RunAsNonRoot: boolptr.False(), - ReadOnlyRootFilesystem: boolptr.True(), + RunAsNonRoot: boolptr.False(), + ReadOnlyRootFilesystem: boolptr.True(), AllowPrivilegeEscalation: boolptr.True(), } fillSecurityContextCapabilities( From f83df768bc03a731288dec399c4d2a8fe9ac9a8a Mon Sep 17 00:00:00 2001 From: oriyarde Date: Thu, 3 Dec 2020 17:34:06 +0200 Subject: [PATCH 3/7] add security policies --- deploy/installer/generated/ibm-block-csi-operator.yaml | 3 +++ .../ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml | 3 +++ .../ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml | 3 +++ deploy/operator.yaml | 3 +++ 4 files changed, 12 insertions(+) diff --git a/deploy/installer/generated/ibm-block-csi-operator.yaml b/deploy/installer/generated/ibm-block-csi-operator.yaml index cf1255c89..f9e2b2727 100644 --- a/deploy/installer/generated/ibm-block-csi-operator.yaml +++ b/deploy/installer/generated/ibm-block-csi-operator.yaml @@ -1447,6 +1447,9 @@ spec: - amd64 - s390x - ppc64le + hostIPC: false + hostNetwork: false + hostPID: false containers: - name: ibm-block-csi-operator resources: diff --git a/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml b/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml index 5e3c12875..d1893ae84 100644 --- a/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml +++ b/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml @@ -745,6 +745,9 @@ spec: operator: In values: - amd64 + hostIPC: false + hostNetwork: false + hostPID: false containers: - name: ibm-block-csi-operator resources: diff --git a/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml b/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml index 369574251..9ac557780 100644 --- a/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml +++ b/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml @@ -743,6 +743,9 @@ spec: operator: In values: - amd64 + hostIPC: false + hostNetwork: false + hostPID: false containers: - name: ibm-block-csi-operator resources: diff --git a/deploy/operator.yaml b/deploy/operator.yaml index 86ba83d89..fff29400d 100644 --- a/deploy/operator.yaml +++ b/deploy/operator.yaml @@ -40,6 +40,9 @@ spec: - amd64 - s390x - ppc64le + hostIPC: false + hostNetwork: false + hostPID: false containers: - name: ibm-block-csi-operator resources: From e108f4ea1c20fec745c79085d1d2ea6452e33ea4 Mon Sep 17 00:00:00 2001 From: oriyarde Date: Thu, 3 Dec 2020 20:40:30 +0200 Subject: [PATCH 4/7] more security context for node pod containers --- pkg/controller/ibmblockcsi/syncer/csi_node.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/pkg/controller/ibmblockcsi/syncer/csi_node.go b/pkg/controller/ibmblockcsi/syncer/csi_node.go index ae7f36f3e..5dda0d23f 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_node.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_node.go @@ -165,7 +165,12 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container { }, }, } - registrar.SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: boolptr.False()} + registrar.SecurityContext = &corev1.SecurityContext{ + Privileged: boolptr.False(), + RunAsNonRoot: boolptr.True(), + ReadOnlyRootFilesystem: boolptr.True(), + AllowPrivilegeEscalation: boolptr.False(), + } fillSecurityContextCapabilities(registrar.SecurityContext) registrar.ImagePullPolicy = s.getCSINodeDriverRegistrarPullPolicy() @@ -176,7 +181,12 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container { "--csi-address=/csi/csi.sock", }, ) - livenessProbe.SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: boolptr.False()} + livenessProbe.SecurityContext = &corev1.SecurityContext{ + Privileged: boolptr.False(), + RunAsNonRoot: boolptr.True(), + ReadOnlyRootFilesystem: boolptr.True(), + AllowPrivilegeEscalation: boolptr.False(), + } fillSecurityContextCapabilities(livenessProbe.SecurityContext) livenessProbe.ImagePullPolicy = s.getCSINodeDriverRegistrarPullPolicy() From 4a13e3742ad50632e5fd89d08b87b4a92c0269db Mon Sep 17 00:00:00 2001 From: oriyarde Date: Thu, 3 Dec 2020 22:32:50 +0200 Subject: [PATCH 5/7] add security context user id for node containers --- pkg/config/settings.go | 1 + pkg/controller/ibmblockcsi/syncer/csi_node.go | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/pkg/config/settings.go b/pkg/config/settings.go index 754b02fa7..601e9f659 100644 --- a/pkg/config/settings.go +++ b/pkg/config/settings.go @@ -31,6 +31,7 @@ const ( DefaultNamespace = "default" DefaultLogLevel = "DEBUG" ControllerUserID = int64(9999) + NonRootUserID = int64(1001) NodeAgentPort = "10086" ) diff --git a/pkg/controller/ibmblockcsi/syncer/csi_node.go b/pkg/controller/ibmblockcsi/syncer/csi_node.go index 5dda0d23f..5bdae4457 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_node.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_node.go @@ -165,8 +165,12 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container { }, }, } + + nonRootUserID := config.NonRootUserID + registrar.SecurityContext = &corev1.SecurityContext{ Privileged: boolptr.False(), + RunAsUser: &nonRootUserID, RunAsNonRoot: boolptr.True(), ReadOnlyRootFilesystem: boolptr.True(), AllowPrivilegeEscalation: boolptr.False(), @@ -183,6 +187,7 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container { ) livenessProbe.SecurityContext = &corev1.SecurityContext{ Privileged: boolptr.False(), + RunAsUser: &nonRootUserID, RunAsNonRoot: boolptr.True(), ReadOnlyRootFilesystem: boolptr.True(), AllowPrivilegeEscalation: boolptr.False(), From 07dabe477778df8186bf6f1b5d39c7d794e634a9 Mon Sep 17 00:00:00 2001 From: oriyarde Date: Fri, 4 Dec 2020 00:44:36 +0200 Subject: [PATCH 6/7] add security context to driver pods --- pkg/controller/ibmblockcsi/syncer/csi_controller.go | 5 +++-- pkg/controller/ibmblockcsi/syncer/csi_node.go | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/controller/ibmblockcsi/syncer/csi_controller.go b/pkg/controller/ibmblockcsi/syncer/csi_controller.go index 2dd9c098c..8122e01bf 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_controller.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_controller.go @@ -101,8 +101,9 @@ func (s *csiControllerSyncer) ensurePodSpec() corev1.PodSpec { Containers: s.ensureContainersSpec(), Volumes: s.ensureVolumes(), SecurityContext: &corev1.PodSecurityContext{ - FSGroup: &fsGroup, - RunAsUser: &fsGroup, + RunAsUser: &fsGroup, + RunAsNonRoot: boolptr.True(), + FSGroup: &fsGroup, }, Affinity: s.driver.Spec.Controller.Affinity, Tolerations: s.driver.Spec.Controller.Tolerations, diff --git a/pkg/controller/ibmblockcsi/syncer/csi_node.go b/pkg/controller/ibmblockcsi/syncer/csi_node.go index 5bdae4457..7c7b09573 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_node.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_node.go @@ -99,6 +99,7 @@ func (s *csiNodeSyncer) ensurePodSpec() corev1.PodSpec { HostIPC: true, HostNetwork: true, ServiceAccountName: config.GetNameForResource(config.CSINodeServiceAccount, s.driver.Name), + SecurityContext: &corev1.PodSecurityContext{RunAsNonRoot: boolptr.True()}, Affinity: s.driver.Spec.Node.Affinity, Tolerations: s.driver.Spec.Node.Tolerations, } From 145f2249fd3ceb3c9ea3a5bf906497bff674d50e Mon Sep 17 00:00:00 2001 From: oriyarde Date: Mon, 7 Dec 2020 16:55:11 +0200 Subject: [PATCH 7/7] allow registrar to write to /csi/csi.sock --- pkg/controller/ibmblockcsi/syncer/csi_node.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/controller/ibmblockcsi/syncer/csi_node.go b/pkg/controller/ibmblockcsi/syncer/csi_node.go index 7c7b09573..5b81dca5a 100644 --- a/pkg/controller/ibmblockcsi/syncer/csi_node.go +++ b/pkg/controller/ibmblockcsi/syncer/csi_node.go @@ -173,7 +173,7 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container { Privileged: boolptr.False(), RunAsUser: &nonRootUserID, RunAsNonRoot: boolptr.True(), - ReadOnlyRootFilesystem: boolptr.True(), + ReadOnlyRootFilesystem: boolptr.False(), AllowPrivilegeEscalation: boolptr.False(), } fillSecurityContextCapabilities(registrar.SecurityContext)