Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

helm chart: apply least required privileges in security contexts #3925

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

helm chart: apply least required privileges in security contexts #3925

wants to merge 1 commit into from

Conversation

rptaylor
Copy link
Contributor

@rptaylor rptaylor commented Jan 3, 2025

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Remove unneeded/unused privileges, to follow security best practices by default and enable installation of kueue on clusters that enforce PSS.

Which issue(s) this PR fixes:

Fixes #3850

Special notes for your reviewer:

Users can keep the same behaviour as before if they want by setting

controllerManager:
  manager:
    podSecurityContext:
      runAsNonRoot: true
      seccompProfile: null
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities: null

Does this PR introduce a user-facing change?

NONE

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 3, 2025
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rptaylor
Once this PR has been reviewed and has the lgtm label, please assign mimowo for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested review from PBundyra and trasc January 3, 2025 20:32
@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 3, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @rptaylor. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jan 3, 2025
@netlify Netlify
Copy link

netlify bot commented Jan 3, 2025 •
edited
Loading

✅ Deploy Preview for kubernetes-sigs-kueue ready!

Name Link
🔨 Latest commit 7d9a450
🔍 Latest deploy log https://app.netlify.com/sites/kubernetes-sigs-kueue/deploys/6778494afcdba3000809c02e
😎 Deploy Preview https://deploy-preview-3925--kubernetes-sigs-kueue.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@rptaylor rptaylor mentioned this pull request Jan 3, 2025
Open
@kannon92
Copy link
Contributor

kannon92 commented Jan 6, 2025

/ok-to-test

Should we add this as the default deployment for the manager pod of kueue in the kustomize?

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 6, 2025
@rptaylor
Copy link
Contributor Author

rptaylor commented Jan 6, 2025

Should we add this as the default deployment for the manager pod of kueue in the kustomize?

Probably the different deployment options should be as consistent as possible with each other.

@kannon92
Copy link
Contributor

kannon92 commented Jan 6, 2025

Probably the different deployment options should be as consistent as possible with each other.

Yea, I'd add this here

mimowo
mimowo reviewed Jan 7, 2025
View reviewed changes
charts/kueue/Chart.yaml
@@ -13,7 +13,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.1.0
version: 0.1.1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this change required? If no please revert / move to a dedicated PR.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, an updated chart always needs an updated version, unless perhaps you have some CI that automatically takes care of incrementing the chart version? But the comment right there says "This version number should be incremented each time you make changes to the chart and its templates".

charts/kueue/values.yaml
@@ -29,8 +29,13 @@ controllerManager:
memory: 512Mi
podSecurityContext:
runAsNonRoot: true
seccompProfile:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please also update the manager.yaml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mimowo mimowo mimowo left review comments

@PBundyra PBundyra Awaiting requested review from PBundyra

@trasc trasc Awaiting requested review from trasc

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesn't merit a release note. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

More comprehensive securityContext settings in helm chart
4 participants
@rptaylor @k8s-ci-robot @kannon92 @mimowo