From 931af3241de199893cc708ee9f7bde5bba7430b0 Mon Sep 17 00:00:00 2001
From: Arthur Silva Sens <arthursens2005@gmail.com>
Date: Tue, 1 Feb 2022 09:25:21 +0000
Subject: [PATCH] Drop Linux capabilities
Signed-off-by: GitHub <noreply@github.com>
---
Makefile | 2 +-
.../components/blackbox-exporter.libsonnet | 2 ++
jsonnet/kube-prometheus/components/grafana.libsonnet | 2 ++
.../kube-prometheus/components/kube-rbac-proxy.libsonnet | 1 +
.../components/kube-state-metrics.libsonnet | 5 +++++
.../kube-prometheus/components/node-exporter.libsonnet | 1 +
.../components/prometheus-adapter.libsonnet | 1 +
.../components/prometheus-operator.libsonnet | 8 +++++++-
manifests/blackboxExporter-deployment.yaml | 9 +++++++++
manifests/grafana-deployment.yaml | 3 +++
manifests/kubeStateMetrics-deployment.yaml | 9 +++++++++
manifests/nodeExporter-daemonset.yaml | 8 ++++++++
manifests/prometheusAdapter-deployment.yaml | 3 +++
manifests/prometheusOperator-deployment.yaml | 6 ++++++
14 files changed, 58 insertions(+), 2 deletions(-)
diff --git a/Makefile b/Makefile
index ca1097ef..85d2e879 100644
--- a/Makefile
+++ b/Makefile
@@ -66,7 +66,7 @@ kubeconform: crdschemas manifests $(KUBECONFORM_BIN)
.PHONY: kubescape
kubescape: $(KUBESCAPE_BIN) ## Runs a security analysis on generated manifests - failing if risk score is above threshold percentage 't'
- $(KUBESCAPE_BIN) scan -s framework -t 20 nsa manifests/*.yaml --exceptions 'kubescape-exceptions.json'
+ $(KUBESCAPE_BIN) scan -s framework -t 16 nsa manifests/*.yaml --exceptions 'kubescape-exceptions.json'
.PHONY: fmt
fmt: $(JSONNETFMT_BIN)
diff --git a/jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet b/jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet
index 775e3c66..8a05beff 100644
--- a/jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet
+++ b/jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet
@@ -175,6 +175,7 @@ function(params) {
runAsUser: 65534,
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
+ capabilities: { drop: ['ALL'] },
},
volumeMounts: [{
mountPath: '/etc/blackbox_exporter/',
@@ -196,6 +197,7 @@ function(params) {
runAsUser: 65534,
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
+ capabilities: { drop: ['ALL'] },
},
terminationMessagePath: '/dev/termination-log',
terminationMessagePolicy: 'FallbackToLogsOnError',
diff --git a/jsonnet/kube-prometheus/components/grafana.libsonnet b/jsonnet/kube-prometheus/components/grafana.libsonnet
index 5ce0bdde..2ba9518c 100644
--- a/jsonnet/kube-prometheus/components/grafana.libsonnet
+++ b/jsonnet/kube-prometheus/components/grafana.libsonnet
@@ -87,6 +87,7 @@ function(params)
// FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
// 'allowPrivilegeEscalation: false' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/128 gets merged.
// 'readOnlyRootFilesystem: true' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/129 gets merged.
+ // 'capabilities: { drop: ['ALL'] }' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/130 gets merged.
deployment+: {
spec+: {
template+: {
@@ -95,6 +96,7 @@ function(params)
securityContext+: {
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
+ capabilities: { drop: ['ALL'] },
},
}, super.containers),
},
diff --git a/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet b/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet
index f852f143..bcc9f97f 100644
--- a/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet
+++ b/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet
@@ -63,5 +63,6 @@ function(params) {
runAsNonRoot: true,
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
+ capabilities: { drop: ['ALL'] },
},
}
diff --git a/jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet b/jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet
index 186069f5..cd925c0b 100644
--- a/jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet
+++ b/jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet
@@ -118,6 +118,8 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
image: ksm._config.kubeRbacProxyImage,
}),
+ // FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
+ // 'capabilities: { drop: ['ALL'] },' can be deleted when https://github.com/kubernetes/kube-state-metrics/pull/1674 gets merged.
deployment+: {
spec+: {
template+: {
@@ -133,6 +135,9 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
readinessProbe:: null,
args: ['--host=127.0.0.1', '--port=8081', '--telemetry-host=127.0.0.1', '--telemetry-port=8082'],
resources: ksm._config.resources,
+ securityContext+: {
+ capabilities: { drop: ['ALL'] },
+ },
}, super.containers) + [kubeRbacProxyMain, kubeRbacProxySelf],
},
},
diff --git a/jsonnet/kube-prometheus/components/node-exporter.libsonnet b/jsonnet/kube-prometheus/components/node-exporter.libsonnet
index a351bf40..c9dd2d2f 100644
--- a/jsonnet/kube-prometheus/components/node-exporter.libsonnet
+++ b/jsonnet/kube-prometheus/components/node-exporter.libsonnet
@@ -184,6 +184,7 @@ function(params) {
securityContext: {
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
+ capabilities: { drop: ['ALL'], add: ['CAP_SYS_TIME'] },
},
};
diff --git a/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet b/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
index aa127362..b0cf3a4b 100644
--- a/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
+++ b/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
@@ -229,6 +229,7 @@ function(params) {
securityContext: {
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
+ capabilities: { drop: ['ALL'] },
},
};
diff --git a/jsonnet/kube-prometheus/components/prometheus-operator.libsonnet b/jsonnet/kube-prometheus/components/prometheus-operator.libsonnet
index b2e97acc..b6139da1 100644
--- a/jsonnet/kube-prometheus/components/prometheus-operator.libsonnet
+++ b/jsonnet/kube-prometheus/components/prometheus-operator.libsonnet
@@ -125,11 +125,17 @@ function(params)
image: po._config.kubeRbacProxyImage,
}),
+ // FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
+ // 'capabilities: { drop: ['ALL'] },' can be deleted when https://github.com/prometheus-operator/prometheus-operator/pull/4546 gets merged.
deployment+: {
spec+: {
template+: {
spec+: {
- containers+: [kubeRbacProxy],
+ containers: std.map(function(c) c {
+ securityContext+: {
+ capabilities: { drop: ['ALL'] },
+ },
+ }, super.containers) + [kubeRbacProxy],
},
},
},
diff --git a/manifests/blackboxExporter-deployment.yaml b/manifests/blackboxExporter-deployment.yaml
index 13877ada..fed1d365 100644
--- a/manifests/blackboxExporter-deployment.yaml
+++ b/manifests/blackboxExporter-deployment.yaml
@@ -43,6 +43,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65534
@@ -64,6 +67,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65534
@@ -92,6 +98,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
diff --git a/manifests/grafana-deployment.yaml b/manifests/grafana-deployment.yaml
index 10bd28b0..a25a6cba 100644
--- a/manifests/grafana-deployment.yaml
+++ b/manifests/grafana-deployment.yaml
@@ -47,6 +47,9 @@ spec:
memory: 100Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /var/lib/grafana
diff --git a/manifests/kubeStateMetrics-deployment.yaml b/manifests/kubeStateMetrics-deployment.yaml
index 365d56e8..86ab4faa 100644
--- a/manifests/kubeStateMetrics-deployment.yaml
+++ b/manifests/kubeStateMetrics-deployment.yaml
@@ -43,6 +43,9 @@ spec:
memory: 190Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
runAsUser: 65534
- args:
@@ -64,6 +67,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
@@ -87,6 +93,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
diff --git a/manifests/nodeExporter-daemonset.yaml b/manifests/nodeExporter-daemonset.yaml
index d5d386fe..cec3b265 100644
--- a/manifests/nodeExporter-daemonset.yaml
+++ b/manifests/nodeExporter-daemonset.yaml
@@ -45,6 +45,11 @@ spec:
memory: 180Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ add:
+ - CAP_SYS_TIME
+ drop:
+ - ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /host/sys
@@ -80,6 +85,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
diff --git a/manifests/prometheusAdapter-deployment.yaml b/manifests/prometheusAdapter-deployment.yaml
index 37337d82..8f2eeae6 100644
--- a/manifests/prometheusAdapter-deployment.yaml
+++ b/manifests/prometheusAdapter-deployment.yaml
@@ -49,6 +49,9 @@ spec:
memory: 180Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
diff --git a/manifests/prometheusOperator-deployment.yaml b/manifests/prometheusOperator-deployment.yaml
index aa9ac1ab..10317204 100644
--- a/manifests/prometheusOperator-deployment.yaml
+++ b/manifests/prometheusOperator-deployment.yaml
@@ -44,6 +44,9 @@ spec:
memory: 100Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
- args:
- --logtostderr
@@ -64,6 +67,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
--
GitLab