Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security-context for pgbouncer #1339

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

security-context for pgbouncer #1339

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
46aa4fc
security-context for pgbouncer
HiranmoyChowdhury Nov 1, 2024
59606aa
Signed-off-by: Hiranmoy Das Chowdhury <[email protected]>
HiranmoyChowdhury Nov 1, 2024
4d28edc
finished security context
HiranmoyChowdhury Nov 4, 2024
c1f519f
finished security context
HiranmoyChowdhury Dec 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 47 additions & 36 deletions apis/kubedb/v1/pgbouncer_helpers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,12 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/types"
"k8s.io/utils/ptr"
kmapi "kmodules.xyz/client-go/api/v1"
"kmodules.xyz/client-go/apiextensions"
core_util "kmodules.xyz/client-go/core/v1"
meta_util "kmodules.xyz/client-go/meta"
"kmodules.xyz/client-go/policy/secomp"
appcat "kmodules.xyz/custom-resources/apis/appcatalog/v1alpha1"
mona "kmodules.xyz/monitoring-agent-api/api/v1"
ofstv2 "kmodules.xyz/offshoot-api/api/v2"
Expand Down Expand Up @@ -232,12 +234,15 @@ func (p *PgBouncer) SetDefaults(pgBouncerVersion *catalog.PgBouncerVersion, uses
}

p.Spec.Monitor.SetDefaults()

// we have set the permission for exporter certificate for 70 userid
// that's why we need to set RunAsUser and RunAsGroup 70
if p.Spec.Monitor != nil && p.Spec.Monitor.Prometheus != nil {
if p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = pgBouncerVersion.Spec.SecurityContext.RunAsUser
p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = pointer.Int64P(*pgBouncerVersion.Spec.SecurityContext.RunAsUser)
}
if p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = pgBouncerVersion.Spec.SecurityContext.RunAsUser
p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = pointer.Int64P(*pgBouncerVersion.Spec.SecurityContext.RunAsUser)
}
}
dbContainer := core_util.GetContainerByName(p.Spec.PodTemplate.Spec.Containers, ResourceSingularPgBouncer)
Expand Down Expand Up @@ -327,49 +332,55 @@ func (p *PgBouncer) SetSecurityContext(pgBouncerVersion *catalog.PgBouncerVersio
Name: kubedb.PgBouncerContainerName,
}
}

if container.SecurityContext == nil {
container.SecurityContext = &core.SecurityContext{
RunAsUser: func() *int64 {
if p.Spec.PodTemplate.Spec.SecurityContext == nil || p.Spec.PodTemplate.Spec.SecurityContext.RunAsUser == nil {
return pgBouncerVersion.Spec.SecurityContext.RunAsUser
}
return p.Spec.PodTemplate.Spec.SecurityContext.RunAsUser
}(),
RunAsGroup: func() *int64 {
if p.Spec.PodTemplate.Spec.SecurityContext == nil || p.Spec.PodTemplate.Spec.SecurityContext.RunAsGroup == nil {
return pgBouncerVersion.Spec.SecurityContext.RunAsUser
}
return p.Spec.PodTemplate.Spec.SecurityContext.RunAsGroup
}(),
Privileged: pointer.BoolP(false),
}
} else {
if container.SecurityContext.RunAsUser == nil {
container.SecurityContext = &core.SecurityContext{}
}
if container.SecurityContext.RunAsUser == nil {
if p.Spec.PodTemplate.Spec.SecurityContext == nil || p.Spec.PodTemplate.Spec.SecurityContext.RunAsUser == nil {
container.SecurityContext.RunAsUser = pgBouncerVersion.Spec.SecurityContext.RunAsUser
}
if container.SecurityContext.RunAsGroup == nil {
container.SecurityContext.RunAsGroup = container.SecurityContext.RunAsUser
} else {
container.SecurityContext.RunAsUser = p.Spec.PodTemplate.Spec.SecurityContext.RunAsUser
}
}

if p.Spec.PodTemplate.Spec.SecurityContext == nil {
p.Spec.PodTemplate.Spec.SecurityContext = &core.PodSecurityContext{
RunAsUser: container.SecurityContext.RunAsUser,
RunAsGroup: container.SecurityContext.RunAsGroup,
}
} else {
if p.Spec.PodTemplate.Spec.SecurityContext.RunAsUser == nil {
p.Spec.PodTemplate.Spec.SecurityContext.RunAsUser = container.SecurityContext.RunAsUser
if container.SecurityContext.RunAsGroup == nil {
if p.Spec.PodTemplate.Spec.SecurityContext == nil || p.Spec.PodTemplate.Spec.SecurityContext.RunAsGroup == nil {
container.SecurityContext.RunAsGroup = pgBouncerVersion.Spec.SecurityContext.RunAsUser
} else {
container.SecurityContext.RunAsGroup = p.Spec.PodTemplate.Spec.SecurityContext.RunAsGroup
}
if p.Spec.PodTemplate.Spec.SecurityContext.RunAsGroup == nil {
p.Spec.PodTemplate.Spec.SecurityContext.RunAsGroup = container.SecurityContext.RunAsGroup
}

allowPrivilegeEscalation := pointer.Bool(container.SecurityContext.AllowPrivilegeEscalation)
container.SecurityContext.AllowPrivilegeEscalation = &allowPrivilegeEscalation

if container.SecurityContext.Capabilities == nil {
container.SecurityContext.Capabilities = &core.Capabilities{
Drop: []core.Capability{"ALL"},
}
}

// Need to set FSGroup equal to p.Spec.PodTemplate.Spec.ContainerSecurityContext.RunAsGroup.
// So that /var/pv directory have the group permission for the RunAsGroup user GID.
// Otherwise, We will get write permission denied.
p.Spec.PodTemplate.Spec.SecurityContext.FSGroup = container.SecurityContext.RunAsGroup
if container.SecurityContext.RunAsNonRoot == nil {
container.SecurityContext.RunAsNonRoot = ptr.To(true)
}

if container.SecurityContext.SeccompProfile == nil {
container.SecurityContext.SeccompProfile = secomp.DefaultSeccompProfile()
}

// podTemplate
if p.Spec.PodTemplate.Spec.SecurityContext == nil {
p.Spec.PodTemplate.Spec.SecurityContext = &core.PodSecurityContext{}
}
if p.Spec.PodTemplate.Spec.SecurityContext.RunAsUser == nil {
p.Spec.PodTemplate.Spec.SecurityContext.RunAsUser = ptr.To(*container.SecurityContext.RunAsUser)
}
if p.Spec.PodTemplate.Spec.SecurityContext.RunAsGroup == nil {
p.Spec.PodTemplate.Spec.SecurityContext.RunAsGroup = ptr.To(*container.SecurityContext.RunAsGroup)
}

p.Spec.PodTemplate.Spec.SecurityContext.FSGroup = ptr.To(*container.SecurityContext.RunAsGroup)
isPgbouncerContainerPresent := core_util.GetContainerByName(p.Spec.PodTemplate.Spec.Containers, kubedb.PgBouncerContainerName)
if isPgbouncerContainerPresent == nil {
core_util.UpsertContainer(p.Spec.PodTemplate.Spec.Containers, *container)
Expand Down