Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add runPrivileged/runAsUser options, for running on more restricted/s… #271

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add runPrivileged/runAsUser options, for running on more restricted/s… #271

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
10734bc
Add runPrivileged/runAsUser options, for running on more restricted/s…
Dec 18, 2018
c0fbe8f
Merge branch 'master' into master
maartenvandenbogaard Jan 23, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion cmd/operator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,8 @@ var (
enableInitDaemonset bool
initDaemonsetNamespace string
busyboxImage string
runPrivileged bool
runAsUser int64
)

func init() {
Expand All @@ -64,6 +66,8 @@ func init() {
flag.BoolVar(&enableInitDaemonset, "enableInitDaemonset", true, "Set to false to disable the sysctl init daemonset")
flag.StringVar(&initDaemonsetNamespace, "initDaemonsetNamespace", "default", "Namespace to deploy the sysctl init daemonset into")
flag.StringVar(&busyboxImage, "busybox-image", "busybox:1.26.2", "Image to use for sysctl init daemonset")
flag.BoolVar(&runPrivileged, "runPrivileged", true, "Run pods as privileged. Set to false if your Kubernetes cluster doesn't allow running containers in privileged mode. Setting does not affect InitDaemonset.")
flag.Int64Var(&runAsUser, "runAsUser", 0, "Run the first process in the container as this uid. Change this if your Kubernetes cluster doesn't allow running containers as root. Setting does not affect InitDaemonset.")
flag.Parse()
}

Expand All @@ -78,11 +82,16 @@ func Main() int {

// Print params configured
logrus.Info("Using Variables:")
logrus.Infof(" masterhost: %s", masterHost)
logrus.Infof(" enableInitDaemonset: %t", enableInitDaemonset)
logrus.Infof(" initDaemonsetNamespace: %s", initDaemonsetNamespace)
logrus.Infof(" baseImage: %s", baseImage)
logrus.Infof(" busybox-image: %s", busyboxImage)
logrus.Infof(" runPrivileged: %t", runPrivileged)
logrus.Infof(" runAsUser: %d", runAsUser)

// Init
k8sclient, err := k8sutil.New(kubeCfgFile, masterHost, enableInitDaemonset, initDaemonsetNamespace, busyboxImage)
k8sclient, err := k8sutil.New(kubeCfgFile, masterHost, enableInitDaemonset, initDaemonsetNamespace, busyboxImage, runPrivileged, runAsUser)
if err != nil {
logrus.Error("Could not init k8sclient! ", err)
return 1
Expand Down
7 changes: 6 additions & 1 deletion pkg/k8sutil/deployments.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,15 +170,20 @@ func (k *K8sutil) CreateClientDeployment(baseImage string, replicas *int32, java
},
},
Spec: v1.PodSpec{
SecurityContext: &v1.PodSecurityContext{
RunAsUser: &k.RunAsUser,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if these aren't defined how does the controller react? We should add tests around them to validate this new behavior.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default for RunAsUser (0) is defined in init(), so there's always a value.

FSGroup: &k.RunAsUser,
},
Affinity: &affinity,
Containers: []v1.Container{
v1.Container{
Name: deploymentName,
SecurityContext: &v1.SecurityContext{
Privileged: &[]bool{true}[0],
Privileged: &k.RunPrivileged,
Capabilities: &v1.Capabilities{
Add: []v1.Capability{
"IPC_LOCK",
"SYS_RESOURCE",
},
},
},
Expand Down
19 changes: 14 additions & 5 deletions pkg/k8sutil/k8sutil.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,10 +89,12 @@ type K8sutil struct {
EnableInitDaemonset bool
InitDaemonsetNamespace string
BusyboxImage string
RunPrivileged bool
RunAsUser int64
}

// New creates a new instance of k8sutil
func New(kubeCfgFile, masterHost string, enableInitDaemonset bool, initDaemonsetNamespace, busyboxImage string) (*K8sutil, error) {
func New(kubeCfgFile, masterHost string, enableInitDaemonset bool, initDaemonsetNamespace, busyboxImage string, runPrivileged bool, runAsUser int64) (*K8sutil, error) {

crdClient, kubeClient, kubeExt, k8sVersion, err := newKubeClient(kubeCfgFile)

Expand All @@ -109,6 +111,8 @@ func New(kubeCfgFile, masterHost string, enableInitDaemonset bool, initDaemonset
EnableInitDaemonset: enableInitDaemonset,
InitDaemonsetNamespace: initDaemonsetNamespace,
BusyboxImage: busyboxImage,
RunPrivileged: runPrivileged,
RunAsUser: runAsUser,
}

return k, nil
Expand Down Expand Up @@ -395,8 +399,8 @@ func processDeploymentType(deploymentType string, clusterName string) (string, s
return deploymentName, role, isNodeMaster, isNodeData
}

func buildStatefulSet(statefulSetName, clusterName, deploymentType, baseImage, storageClass, dataDiskSize, javaOptions, masterJavaOptions, dataJavaOptions, serviceAccountName,
statsdEndpoint, networkHost string, replicas *int32, useSSL *bool, resources myspec.Resources, imagePullSecrets []myspec.ImagePullSecrets, imagePullPolicy string, nodeSelector map[string]string, tolerations []v1.Toleration) *apps.StatefulSet {
func buildStatefulSet(statefulSetName, clusterName, deploymentType, baseImage, storageClass, dataDiskSize, javaOptions, serviceAccountName,
statsdEndpoint, networkHost string, replicas *int32, useSSL *bool, resources myspec.Resources, imagePullSecrets []myspec.ImagePullSecrets, imagePullPolicy string, nodeSelector map[string]string, tolerations []v1.Toleration, runPrivileged *bool, runAsUser *int64) *apps.StatefulSet {

_, role, isNodeMaster, isNodeData := processDeploymentType(deploymentType, clusterName)

Expand Down Expand Up @@ -485,6 +489,10 @@ func buildStatefulSet(statefulSetName, clusterName, deploymentType, baseImage, s
},
},
Spec: v1.PodSpec{
SecurityContext: &v1.PodSecurityContext{
RunAsUser: runAsUser,
FSGroup: runAsUser,
},
Tolerations: tolerations,
NodeSelector: nodeSelector,
Affinity: &v1.Affinity{
Expand All @@ -511,10 +519,11 @@ func buildStatefulSet(statefulSetName, clusterName, deploymentType, baseImage, s
v1.Container{
Name: statefulSetName,
SecurityContext: &v1.SecurityContext{
Privileged: &[]bool{true}[0],
Privileged: runPrivileged,
Capabilities: &v1.Capabilities{
Add: []v1.Capability{
"IPC_LOCK",
"SYS_RESOURCE",
},
},
},
Expand Down Expand Up @@ -681,7 +690,7 @@ func (k *K8sutil) CreateDataNodeDeployment(deploymentType string, replicas *int3
logrus.Infof("StatefulSet %s not found, creating...", statefulSetName)

statefulSet := buildStatefulSet(statefulSetName, clusterName, deploymentType, baseImage, storageClass, dataDiskSize, javaOptions, masterJavaOptions, dataJavaOptions, serviceAccountName,
statsdEndpoint, networkHost, replicas, useSSL, resources, imagePullSecrets, imagePullPolicy, nodeSelector, tolerations)
statsdEndpoint, networkHost, replicas, useSSL, resources, imagePullSecrets, imagePullPolicy, nodeSelector, tolerations, &k.RunPrivileged, &k.RunAsUser)

if _, err := k.Kclient.AppsV1beta2().StatefulSets(namespace).Create(statefulSet); err != nil {
logrus.Error("Could not create stateful set: ", err)
Expand Down
6 changes: 4 additions & 2 deletions pkg/k8sutil/k8sutil_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,10 @@ func TestSSLCertConfig(t *testing.T) {
useSSL := false
nodeSelector := make(map[string]string)
tolerations := []corev1.Toleration{}
runPrivileged := true
var runAsUser int64 = 0
statefulSet := buildStatefulSet("test", clusterName, "master", "foo/image", "test", "1G", "",
"", "", "", "", "", nil, &useSSL, resources, nil, "", nodeSelector, tolerations)
"", "", "", "", "", nil, &useSSL, resources, nil, "", nodeSelector, tolerations, &runPrivileged, &runAsUser)

for _, volume := range statefulSet.Spec.Template.Spec.Volumes {
if volume.Name == fmt.Sprintf("%s-%s", secretName, clusterName) {
Expand All @@ -53,7 +55,7 @@ func TestSSLCertConfig(t *testing.T) {

useSSL = true
statefulSet = buildStatefulSet("test", clusterName, "master", "foo/image", "test", "1G", "",
"", "", "", "", "", nil, &useSSL, resources, nil, "", nodeSelector, tolerations)
"", "", "", "", "", nil, &useSSL, resources, nil, "", nodeSelector, tolerations, &runPrivileged, &runAsUser)

found := false
for _, volume := range statefulSet.Spec.Template.Spec.Volumes {
Expand Down