Skip to content

Commit ce89920

Browse files
biswajit-9776pschoen-itsc
biswajit-9776
authored and
pschoen-itsc
committed
Added securityContext profiles for deployments failing PSS restricted level (kubeflow#2836)
* Added securityContext for profile-controller deployments Signed-off-by: biswajit-9776 <[email protected]> * Fixed PSS warnings for containers kfam and manager Signed-off-by: biswajit-9776 <[email protected]> * Added securitycontext profiles to dex and oauth2-proxy deployments Signed-off-by: biswajit-9776 <[email protected]> * Added seccompProfile for cluster-local-gateway Signed-off-by: biswajit-9776 <[email protected]> * Added securityContext to cronjob Signed-off-by: biswajit-9776 <[email protected]> * Added securityContext to pipelines pods Signed-off-by: biswajit-9776 <[email protected]> * trigger GitHub actions Signed-off-by: biswajit-9776 <[email protected]> * trigger GitHub actions Signed-off-by: biswajit-9776 <[email protected]> * Undoing changes to cronjob Signed-off-by: biswajit-9776 <[email protected]> --------- Signed-off-by: biswajit-9776 <[email protected]> Signed-off-by: Patrick Schönthaler <[email protected]>
1 parent 6ea6431 commit ce89920

18 files changed

+302
-0
lines changed

‎contrib/security/PSS/patches/cache-server.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: cache-server
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: server
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/cluster-local-gateway.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: cluster-local-gateway
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: istio-proxy
10+
securityContext:
11+
seccompProfile:
12+
type: RuntimeDefault

‎contrib/security/PSS/patches/dex.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: dex
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: dex
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/kfam.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: profiles-deployment
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: kfam
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/kubeflow-pipelines-profile-controller.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: kubeflow-pipelines-profile-controller
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: profile-controller
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/manager.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: profiles-deployment
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: manager
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/metadata-envoy-deployment.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: metadata-envoy-deployment
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: container
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/metadata-grpc-deployment.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: metadata-grpc-deployment
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: container
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/metadata-writer.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: metadata-writer
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: main
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/minio.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: minio
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: minio
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/ml-pipeline-persistenceagent.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: ml-pipeline-persistenceagent
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: ml-pipeline-persistenceagent
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/ml-pipeline-scheduledworkflow.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: ml-pipeline-scheduledworkflow
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: ml-pipeline-scheduledworkflow
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/ml-pipeline-ui.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: ml-pipeline-ui
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: ml-pipeline-ui
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/ml-pipeline-viewer-crd.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: ml-pipeline-viewer-crd
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: ml-pipeline-viewer-crd
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/ml-pipeline-visualizationserver.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: ml-pipeline-visualizationserver
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: ml-pipeline-visualizationserver
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/ml-pipeline.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: ml-pipeline
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: ml-pipeline-api-server
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/mysql.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: mysql
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: mysql
10+
securityContext:
11+
allowPrivilegeEscalation: false
12+
seccompProfile:
13+
type: RuntimeDefault
14+
runAsNonRoot: true
15+
capabilities:
16+
drop:
17+
- ALL

‎contrib/security/PSS/patches/oauth2-proxy.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: oauth2-proxy
5+
spec:
6+
replicas: 2
7+
template:
8+
spec:
9+
containers:
10+
- name: oauth2-proxy
11+
securityContext:
12+
allowPrivilegeEscalation: false
13+
seccompProfile:
14+
type: RuntimeDefault
15+
runAsNonRoot: true
16+
capabilities:
17+
drop:
18+
- ALL

0 commit comments

Comments
 (0)