Skip to content

Commit 1b67352

Browse files
thallgrenthallgren
authored
Merge pull request #3803 from smehboub/fix/podSecurityContext-for-init-intercept
fix: set security context for init intercept
2 parents 7711f8d + 6e7fa64 commit 1b67352

File tree

8 files changed

+50
-30
lines changed

8 files changed

+50
-30
lines changed

‎charts/telepresence-oss/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ The following tables lists the configurable parameters of the Telepresence chart
3232
| agent.logLevel | The logging level for the traffic-agent | defaults to logLevel |
3333
| agent.resources | The resources for the injected agent container | |
3434
| agent.securityContext | The security context to use for the injected agent container | defaults to the securityContext of the first container of the app |
35+
| agent.initSecurityContext | The security context to use for the injected init container | `{}` |
3536
| agentInjector.certificate.accessMethod | Method used by the agent injector to access the certificate (watch or mount). | `watch` |
3637
| agentInjector.certificate.certmanager.commonName | The common name of the generated Certmanager certificate. | `agent-injector` |
3738
| agentInjector.certificate.certmanager.duration | The certificate validity duration. (optional value) | `2160h0m0s` |

‎charts/telepresence-oss/templates/deployment.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,10 @@ spec:
192192
- name: AGENT_SECURITY_CONTEXT
193193
value: '{{ toJson .agent.securityContext }}'
194194
{{- end }}
195+
{{- if .agent.initSecurityContext }}
196+
- name: AGENT_INIT_SECURITY_CONTEXT
197+
value: '{{ toJson .agent.initSecurityContext }}'
198+
{{- end }}
195199
{{- with fromJsonArray (include "traffic-manager.namespaces" $) }}
196200
{{- /*
197201
This environment variable it not used, it's here to force a redeploy of the traffic manager when the list

‎charts/telepresence-oss/values.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,7 @@ agent:
197197
logLevel:
198198
resources: {}
199199
initResources: {}
200+
initSecurityContext: {}
200201
appProtocolStrategy: http2Probe
201202
port: 9900
202203
image:

‎cmd/traffic/cmd/manager/managerutil/envconfig.go

+16-14
Original file line numberDiff line numberDiff line change
@@ -48,20 +48,21 @@ type Env struct {
4848
PodCIDRs []netip.Prefix `env:"POD_CIDRS, parser=split-ipnet, default="`
4949
PodIP netip.Addr `env:"POD_IP, parser=ip"`
5050

51-
AgentRegistry string `env:"AGENT_REGISTRY, parser=string, default="`
52-
AgentImageName string `env:"AGENT_IMAGE_NAME, parser=string, default="`
53-
AgentImageTag string `env:"AGENT_IMAGE_TAG, parser=string, default="`
54-
AgentImagePullPolicy string `env:"AGENT_IMAGE_PULL_POLICY, parser=string, default="`
55-
AgentImagePullSecrets []core.LocalObjectReference `env:"AGENT_IMAGE_PULL_SECRETS, parser=json-local-refs,default="`
56-
AgentInjectPolicy agentconfig.InjectPolicy `env:"AGENT_INJECT_POLICY, parser=enable-policy, default=Never"`
57-
AgentAppProtocolStrategy k8sapi.AppProtocolStrategy `env:"AGENT_APP_PROTO_STRATEGY, parser=app-proto-strategy, default=http2Probe"`
58-
AgentLogLevel string `env:"AGENT_LOG_LEVEL, parser=logLevel, defaultFrom=LogLevel"`
59-
AgentPort uint16 `env:"AGENT_PORT, parser=port-number, default=0"`
60-
AgentResources *core.ResourceRequirements `env:"AGENT_RESOURCES, parser=json-resources, default="`
61-
AgentInitResources *core.ResourceRequirements `env:"AGENT_INIT_RESOURCES, parser=json-resources, default="`
62-
AgentInjectorName string `env:"AGENT_INJECTOR_NAME, parser=string, default="`
63-
AgentInjectorSecret string `env:"AGENT_INJECTOR_SECRET, parser=string, default="`
64-
AgentSecurityContext *core.SecurityContext `env:"AGENT_SECURITY_CONTEXT, parser=json-security-context, default="`
51+
AgentRegistry string `env:"AGENT_REGISTRY, parser=string, default="`
52+
AgentImageName string `env:"AGENT_IMAGE_NAME, parser=string, default="`
53+
AgentImageTag string `env:"AGENT_IMAGE_TAG, parser=string, default="`
54+
AgentImagePullPolicy string `env:"AGENT_IMAGE_PULL_POLICY, parser=string, default="`
55+
AgentImagePullSecrets []core.LocalObjectReference `env:"AGENT_IMAGE_PULL_SECRETS, parser=json-local-refs,default="`
56+
AgentInjectPolicy agentconfig.InjectPolicy `env:"AGENT_INJECT_POLICY, parser=enable-policy, default=Never"`
57+
AgentAppProtocolStrategy k8sapi.AppProtocolStrategy `env:"AGENT_APP_PROTO_STRATEGY, parser=app-proto-strategy, default=http2Probe"`
58+
AgentLogLevel string `env:"AGENT_LOG_LEVEL, parser=logLevel, defaultFrom=LogLevel"`
59+
AgentPort uint16 `env:"AGENT_PORT, parser=port-number, default=0"`
60+
AgentResources *core.ResourceRequirements `env:"AGENT_RESOURCES, parser=json-resources, default="`
61+
AgentInitResources *core.ResourceRequirements `env:"AGENT_INIT_RESOURCES, parser=json-resources, default="`
62+
AgentInjectorName string `env:"AGENT_INJECTOR_NAME, parser=string, default="`
63+
AgentInjectorSecret string `env:"AGENT_INJECTOR_SECRET, parser=string, default="`
64+
AgentSecurityContext *core.SecurityContext `env:"AGENT_SECURITY_CONTEXT, parser=json-security-context, default="`
65+
AgentInitSecurityContext *core.SecurityContext `env:"AGENT_INIT_SECURITY_CONTEXT, parser=json-security-context, default="`
6566

6667
ClientRoutingAlsoProxySubnets []netip.Prefix `env:"CLIENT_ROUTING_ALSO_PROXY_SUBNETS, parser=split-ipnet, default="`
6768
ClientRoutingNeverProxySubnets []netip.Prefix `env:"CLIENT_ROUTING_NEVER_PROXY_SUBNETS, parser=split-ipnet, default="`
@@ -90,6 +91,7 @@ func (e *Env) GeneratorConfig(qualifiedAgentImage string) (agentmap.GeneratorCon
9091
PullSecrets: e.AgentImagePullSecrets,
9192
AppProtocolStrategy: e.AgentAppProtocolStrategy,
9293
SecurityContext: e.AgentSecurityContext,
94+
InitSecurityContext: e.AgentInitSecurityContext,
9395
}, nil
9496
}
9597

‎cmd/traffic/cmd/manager/mutator/agent_injector_test.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -1743,7 +1743,8 @@ matchExpressions:
17431743
Replace: agentconfig.ReplacePolicyIntercept,
17441744
},
17451745
},
1746-
SecurityContext: nil,
1746+
SecurityContext: nil,
1747+
InitSecurityContext: nil,
17471748
}),
17481749
Spec: core.PodSpec{
17491750
InitContainers: []core.Container{{

‎pkg/agentconfig/container.go

+3
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,9 @@ func InitContainer(config *Sidecar) *core.Container {
277277
if r := config.InitResources; r != nil {
278278
ic.Resources = *r
279279
}
280+
if s := config.InitSecurityContext; s != nil {
281+
ic.SecurityContext = s
282+
}
280283
return ic
281284
}
282285

‎pkg/agentconfig/sidecar.go

+6
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,9 @@ type Sidecar struct {
191191

192192
// SecurityContext for the sidecar
193193
SecurityContext *core.SecurityContext `json:"securityContext,omitempty"`
194+
195+
// InitSecurityContext is the SecurityContext for the initContainer sidecar
196+
InitSecurityContext *core.SecurityContext `json:"initSecurityContext,omitempty"`
194197
}
195198

196199
func (s *Sidecar) AgentConfig() *Sidecar {
@@ -249,19 +252,22 @@ func MarshalTight(s SidecarExt) (string, error) {
249252
ps := ac.PullSecrets
250253
ir := ac.InitResources
251254
sc := ac.SecurityContext
255+
is := ac.InitSecurityContext
252256

253257
ac.AgentImage = ""
254258
ac.PullPolicy = ""
255259
ac.PullSecrets = nil
256260
ac.InitResources = nil
257261
ac.SecurityContext = nil
262+
ac.InitSecurityContext = nil
258263

259264
data, err := json.Marshal(s)
260265
ac.AgentImage = ai
261266
ac.PullPolicy = pp
262267
ac.PullSecrets = ps
263268
ac.InitResources = ir
264269
ac.SecurityContext = sc
270+
ac.InitSecurityContext = is
265271

266272
if err != nil {
267273
return "", err

‎pkg/agentmap/generator.go

+17-15
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ type BasicGeneratorConfig struct {
5656
PullSecrets []core.LocalObjectReference
5757
AppProtocolStrategy k8sapi.AppProtocolStrategy
5858
SecurityContext *core.SecurityContext
59+
InitSecurityContext *core.SecurityContext
5960
}
6061

6162
func portsFromContainerPortsAnnotation(wl k8sapi.Workload) (ports []agentconfig.PortIdentifier, err error) {
@@ -194,21 +195,22 @@ func (cfg *BasicGeneratorConfig) Generate(
194195
}
195196

196197
return &agentconfig.Sidecar{
197-
AgentImage: cfg.QualifiedAgentImage,
198-
AgentName: wl.GetName(),
199-
LogLevel: cfg.LogLevel,
200-
Namespace: wl.GetNamespace(),
201-
WorkloadName: wl.GetName(),
202-
WorkloadKind: wl.GetKind(),
203-
ManagerHost: ManagerAppName + "." + cfg.ManagerNamespace,
204-
ManagerPort: cfg.ManagerPort,
205-
APIPort: cfg.APIPort,
206-
Containers: ccs,
207-
InitResources: cfg.InitResources,
208-
Resources: cfg.Resources,
209-
PullPolicy: cfg.PullPolicy,
210-
PullSecrets: cfg.PullSecrets,
211-
SecurityContext: cfg.SecurityContext,
198+
AgentImage: cfg.QualifiedAgentImage,
199+
AgentName: wl.GetName(),
200+
LogLevel: cfg.LogLevel,
201+
Namespace: wl.GetNamespace(),
202+
WorkloadName: wl.GetName(),
203+
WorkloadKind: wl.GetKind(),
204+
ManagerHost: ManagerAppName + "." + cfg.ManagerNamespace,
205+
ManagerPort: cfg.ManagerPort,
206+
APIPort: cfg.APIPort,
207+
Containers: ccs,
208+
InitResources: cfg.InitResources,
209+
Resources: cfg.Resources,
210+
PullPolicy: cfg.PullPolicy,
211+
PullSecrets: cfg.PullSecrets,
212+
SecurityContext: cfg.SecurityContext,
213+
InitSecurityContext: cfg.InitSecurityContext,
212214
}, nil
213215
}
214216

0 commit comments

Comments
 (0)