Skip to content

Commit

Permalink
Add SecurityContext to deployment and init container
Browse files Browse the repository at this point in the history
  • Loading branch information
@raulcabello
raulcabello committed Oct 16, 2023
1 parent f974f7d commit d3ce167
Show file tree
Hide file tree
Showing 2 changed files with 110 additions and 20 deletions.
98 changes: 83 additions & 15 deletions pkg/controller/gitjob/generatejob_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,17 @@ import (
func TestGenerateJob(t *testing.T) {
ctrl := gomock.NewController(t)

securityContext := &corev1.SecurityContext{
AllowPrivilegeEscalation: &[]bool{false}[0],
ReadOnlyRootFilesystem: &[]bool{true}[0],
Privileged: &[]bool{false}[0],
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
RunAsNonRoot: &[]bool{true}[0],
SeccompProfile: &corev1.SeccompProfile{
Type: corev1.SeccompProfileTypeRuntimeDefault,
},
}

tests := map[string]struct {
gitjob *v1.GitJob
secret corev1controller.SecretCache
Expand All @@ -39,7 +50,12 @@ func TestGenerateJob(t *testing.T) {
Name: gitClonerVolumeName,
MountPath: "/workspace",
},
{
Name: emptyDirVolumeName,
MountPath: "/tmp",
},
},
SecurityContext: securityContext,
},
},
expectedVolumes: []corev1.Volume{
Expand All @@ -49,6 +65,12 @@ func TestGenerateJob(t *testing.T) {
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
{
Name: emptyDirVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
},
},
"http credentials": {
Expand All @@ -75,11 +97,16 @@ func TestGenerateJob(t *testing.T) {
Name: gitClonerVolumeName,
MountPath: "/workspace",
},
{
Name: emptyDirVolumeName,
MountPath: "/tmp",
},
{
Name: gitCredentialVolumeName,
MountPath: "/gitjob/credentials",
},
},
SecurityContext: securityContext,
},
},
expectedVolumes: []corev1.Volume{
Expand All @@ -89,6 +116,12 @@ func TestGenerateJob(t *testing.T) {
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
{
Name: emptyDirVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
{
Name: gitCredentialVolumeName,
VolumeSource: corev1.VolumeSource{
Expand Down Expand Up @@ -124,11 +157,16 @@ func TestGenerateJob(t *testing.T) {
Name: gitClonerVolumeName,
MountPath: "/workspace",
},
{
Name: emptyDirVolumeName,
MountPath: "/tmp",
},
{
Name: gitCredentialVolumeName,
MountPath: "/gitjob/ssh",
},
},
SecurityContext: securityContext,
},
},
expectedVolumes: []corev1.Volume{
Expand All @@ -138,6 +176,12 @@ func TestGenerateJob(t *testing.T) {
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
{
Name: emptyDirVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
{
Name: gitCredentialVolumeName,
VolumeSource: corev1.VolumeSource{
Expand Down Expand Up @@ -173,11 +217,16 @@ func TestGenerateJob(t *testing.T) {
Name: gitClonerVolumeName,
MountPath: "/workspace",
},
{
Name: emptyDirVolumeName,
MountPath: "/tmp",
},
{
Name: bundleCAVolumeName,
MountPath: "/gitjob/cabundle",
},
},
SecurityContext: securityContext,
},
},
expectedVolumes: []corev1.Volume{
Expand All @@ -187,6 +236,12 @@ func TestGenerateJob(t *testing.T) {
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
{
Name: emptyDirVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
{
Name: bundleCAVolumeName,
VolumeSource: corev1.VolumeSource{
Expand Down Expand Up @@ -221,7 +276,12 @@ func TestGenerateJob(t *testing.T) {
Name: gitClonerVolumeName,
MountPath: "/workspace",
},
{
Name: emptyDirVolumeName,
MountPath: "/tmp",
},
},
SecurityContext: securityContext,
},
},
expectedVolumes: []corev1.Volume{
Expand All @@ -231,25 +291,33 @@ func TestGenerateJob(t *testing.T) {
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
{
Name: emptyDirVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
},
},
}

for _, test := range tests {
h := Handler{
image: "test",
secrets: test.secret,
}
job, err := h.generateJob(test.gitjob)
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if !cmp.Equal(job.Spec.Template.Spec.InitContainers, test.expectedInitContainers) {
t.Fatalf("expected initContainers: %v, got: %v", test.expectedInitContainers, job.Spec.Template.Spec.InitContainers)
}
if !cmp.Equal(job.Spec.Template.Spec.Volumes, test.expectedVolumes) {
t.Fatalf("expected volumes: %v, got: %v", test.expectedVolumes, job.Spec.Template.Spec.Volumes)
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
h := Handler{
image: "test",
secrets: test.secret,
}
job, err := h.generateJob(test.gitjob)
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if !cmp.Equal(job.Spec.Template.Spec.InitContainers, test.expectedInitContainers) {
t.Fatalf("expected initContainers: %v, got: %v", test.expectedInitContainers, job.Spec.Template.Spec.InitContainers)
}
if !cmp.Equal(job.Spec.Template.Spec.Volumes, test.expectedVolumes) {
t.Fatalf("expected volumes: %v, got: %v", test.expectedVolumes, job.Spec.Template.Spec.Volumes)
}
})
}
}

Expand Down
32 changes: 27 additions & 5 deletions pkg/controller/gitjob/gitjobs.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ const (
bundleCAFile = "additional-ca.crt"
gitCredentialVolumeName = "git-credential" // #nosec G101 this is not a credential
gitClonerVolumeName = "git-cloner"
emptyDirVolumeName = "empty-dir"
)

func Register(ctx context.Context, cont *types.Context) {
Expand Down Expand Up @@ -189,12 +190,19 @@ func (h Handler) generateJob(obj *v1.GitJob) (*batchv1.Job, error) {
return nil, err
}
job.Spec.Template.Spec.InitContainers = []corev1.Container{initContainer}
job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{
Name: gitClonerVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes,
corev1.Volume{
Name: gitClonerVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
}, corev1.Volume{
Name: emptyDirVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
})
)

if obj.Spec.Git.CABundle != nil {
job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{
Expand Down Expand Up @@ -247,6 +255,10 @@ func (h Handler) generateInitContainer(obj *v1.GitJob) (corev1.Container, error)
Name: gitClonerVolumeName,
MountPath: "/workspace",
},
{
Name: emptyDirVolumeName,
MountPath: "/tmp",
},
}
if obj.Spec.Git.Branch != "" {
args = append(args, "--branch", obj.Spec.Git.Branch)
Expand Down Expand Up @@ -299,5 +311,15 @@ func (h Handler) generateInitContainer(obj *v1.GitJob) (corev1.Container, error)
Image: h.image,
Name: "gitcloner-initializer",
VolumeMounts: volumeMounts,
SecurityContext: &corev1.SecurityContext{
AllowPrivilegeEscalation: &[]bool{false}[0],
ReadOnlyRootFilesystem: &[]bool{true}[0],
Privileged: &[]bool{false}[0],
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
RunAsNonRoot: &[]bool{true}[0],
SeccompProfile: &corev1.SeccompProfile{
Type: corev1.SeccompProfileTypeRuntimeDefault,
},
},
}, nil
}

0 comments on commit d3ce167

Please sign in to comment.