✨ applying restrictive SCC for all conatiners produced by the tool

Gala-R · May 25, 2022 · 1bd3ffe · 1bd3ffe
1 parent a2b2be2
commit 1bd3ffe
Show file tree

Hide file tree

Showing 37 changed files with 374 additions and 0 deletions.
diff --git a/...mon/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go b/...mon/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go
@@ -53,8 +53,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault		
       containers:
       - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
@@ -74,6 +83,11 @@ spec:
             memory: 64Mi
 {{- if not .ComponentConfig }}
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         args:
         - "--health-probe-bind-address=:8081"
         - "--metrics-bind-address=127.0.0.1:8080"

diff --git a/.../common/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_config_patch.go b/.../common/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_config_patch.go
@@ -48,8 +48,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         args:
         - "--config=controller_manager_config.yaml"
         volumeMounts:
@@ -58,6 +67,11 @@ spec:
           subPath: controller_manager_config.yaml
       volumes:
       - name: manager-config
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         configMap:
           name: manager-config
 `
diff --git a/...common/kustomize/v1/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go b/...common/kustomize/v1/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go
@@ -57,8 +57,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 9443
           name: webhook-server

diff --git a/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/manager/config.go b/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/manager/config.go
@@ -72,6 +72,8 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - command:
         - /manager
@@ -83,6 +85,9 @@ spec:
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         livenessProbe:
           httpGet:
             path: /healthz

diff --git a/...mon/kustomize/v2/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go b/...mon/kustomize/v2/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go
@@ -53,8 +53,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault		
       containers:
       - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"

diff --git a/.../common/kustomize/v2/scaffolds/internal/templates/config/kdefault/manager_config_patch.go b/.../common/kustomize/v2/scaffolds/internal/templates/config/kdefault/manager_config_patch.go
@@ -48,8 +48,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         args:
         - "--config=controller_manager_config.yaml"
         volumeMounts:
@@ -58,6 +67,11 @@ spec:
           subPath: controller_manager_config.yaml
       volumes:
       - name: manager-config
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         configMap:
           name: manager-config
 `
diff --git a/...common/kustomize/v2/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go b/...common/kustomize/v2/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go
@@ -57,8 +57,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 9443
           name: webhook-server

diff --git a/...lugins/golang/v2/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go b/...lugins/golang/v2/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go
@@ -52,8 +52,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault		
       containers:
       - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"

diff --git a/pkg/plugins/golang/v2/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go b/pkg/plugins/golang/v2/scaffolds/internal/templates/config/kdefault/webhook_manager_patch.go
@@ -48,8 +48,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 9443
           name: webhook-server

diff --git a/testdata/project-v2-addon/config/default/manager_auth_proxy_patch.yaml b/testdata/project-v2-addon/config/default/manager_auth_proxy_patch.yaml
@@ -8,8 +8,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault		
       containers:
       - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"

diff --git a/testdata/project-v2-addon/config/default/manager_webhook_patch.yaml b/testdata/project-v2-addon/config/default/manager_webhook_patch.yaml
@@ -6,8 +6,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 9443
           name: webhook-server

diff --git a/testdata/project-v2-multigroup/config/default/manager_auth_proxy_patch.yaml b/testdata/project-v2-multigroup/config/default/manager_auth_proxy_patch.yaml
@@ -8,8 +8,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault		
       containers:
       - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"

diff --git a/testdata/project-v2-multigroup/config/default/manager_webhook_patch.yaml b/testdata/project-v2-multigroup/config/default/manager_webhook_patch.yaml
@@ -6,8 +6,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 9443
           name: webhook-server

diff --git a/testdata/project-v2/config/default/manager_auth_proxy_patch.yaml b/testdata/project-v2/config/default/manager_auth_proxy_patch.yaml
@@ -8,8 +8,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault		
       containers:
       - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"

diff --git a/testdata/project-v2/config/default/manager_webhook_patch.yaml b/testdata/project-v2/config/default/manager_webhook_patch.yaml
@@ -6,8 +6,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 9443
           name: webhook-server

diff --git a/testdata/project-v3-addon/config/default/manager_auth_proxy_patch.yaml b/testdata/project-v3-addon/config/default/manager_auth_proxy_patch.yaml
@@ -8,8 +8,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault		
       containers:
       - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
@@ -28,6 +37,11 @@ spec:
             cpu: 5m
             memory: 64Mi
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         args:
         - "--health-probe-bind-address=:8081"
         - "--metrics-bind-address=127.0.0.1:8080"

diff --git a/testdata/project-v3-addon/config/default/manager_config_patch.yaml b/testdata/project-v3-addon/config/default/manager_config_patch.yaml
@@ -6,8 +6,17 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         args:
         - "--config=controller_manager_config.yaml"
         volumeMounts:
@@ -16,5 +25,10 @@ spec:
           subPath: controller_manager_config.yaml
       volumes:
       - name: manager-config
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         configMap:
           name: manager-config
diff --git a/testdata/project-v3-addon/config/manager/manager.yaml b/testdata/project-v3-addon/config/manager/manager.yaml
@@ -26,6 +26,8 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - command:
         - /manager
@@ -35,6 +37,9 @@ spec:
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         livenessProbe:
           httpGet:
             path: /healthz