From 381734a9c7b7de717bd866666b449f21054135f0 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 1 Aug 2026 01:31:48 +1000 Subject: [PATCH] puppet: reduce privilege in namespace workloads (#307) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: shrink the blast radius of the Puppet control-plane pods (CA keys, eyaml keys, compiled catalogs) per the security sweep in #307 — remove root where it is not required and strip cargo-culted capabilities. Changes: - puppetboard: run the cert-generator init as uid 1000 (was root + allowPrivilegeEscalation:true); add pod fsGroup 1000 and drop the trailing `chown -R 1000:1000` — the PVC is now group-owned. - puppetdb: run the create-log-dir init as uid 999 (was root); add pod fsGroup 999 and drop its `chown 999:999`. - All OpenVox capability add-lists: remove the duplicate CAP_-prefixed spellings (Kubernetes normalises both to the same kernel cap) and drop the unused AUDIT_WRITE. - Set allowPrivilegeEscalation:false and seccompProfile RuntimeDefault across the workloads. The main puppetserver/puppetdb containers and the perms-and-dirs / generate-types root containers stay root: the OpenVox entrypoint chowns root-owned baked-in dirs and drops the JVM to the puppet user via `runuser` (needs CHOWN/SETUID/SETGID), so a non-root start crashloops. Their cap sets are reduced to the minimum justified. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- apps/base/puppet/cronjob_generate-types.yaml | 16 +++++----- apps/base/puppet/deployment_puppetboard.yaml | 18 ++++++++---- apps/base/puppet/deployment_puppetdb.yaml | 29 ++++++++++++------- .../deployment_puppetserver-compiler.yaml | 28 +++++++----------- .../deployment_puppetserver-master.yaml | 28 +++++++----------- 5 files changed, 58 insertions(+), 61 deletions(-) diff --git a/apps/base/puppet/cronjob_generate-types.yaml b/apps/base/puppet/cronjob_generate-types.yaml index 6a1eeb8..84d4d1c 100644 --- a/apps/base/puppet/cronjob_generate-types.yaml +++ b/apps/base/puppet/cronjob_generate-types.yaml @@ -52,20 +52,16 @@ spec: securityContext: runAsUser: 0 runAsNonRoot: false + allowPrivilegeEscalation: false + # Root to `gem install` into the image's root-owned gem dir and + # to `runuser` for `puppet generate types` (SETUID/SETGID). capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER + - SETGID + - SETUID drop: - all volumeMounts: @@ -76,6 +72,8 @@ spec: restartPolicy: OnFailure securityContext: fsGroup: 999 + seccompProfile: + type: RuntimeDefault volumes: - name: puppet-code-volume persistentVolumeClaim: diff --git a/apps/base/puppet/deployment_puppetboard.yaml b/apps/base/puppet/deployment_puppetboard.yaml index 97a4b01..e770387 100644 --- a/apps/base/puppet/deployment_puppetboard.yaml +++ b/apps/base/puppet/deployment_puppetboard.yaml @@ -29,6 +29,11 @@ spec: app.kubernetes.io/version: 8.8.0 spec: enableServiceLinks: false + securityContext: + fsGroup: 1000 + fsGroupChangePolicy: OnRootMismatch + seccompProfile: + type: RuntimeDefault initContainers: - name: wait-puppetserver image: curlimages/curl:8.11.1 @@ -115,9 +120,6 @@ spec: chmod 600 ${CERT_DIR}/${HOSTNAME}.key chmod 644 ${CERT_DIR}/ca.pem - # Change ownership to puppetboard user (1000:1000) - chown -R 1000:1000 ${CERT_DIR} - echo "Certificate generation completed for ${HOSTNAME}" volumeMounts: - name: puppetboard-certs @@ -130,9 +132,13 @@ spec: cpu: 50m memory: 64Mi securityContext: - runAsUser: 0 - runAsGroup: 0 - allowPrivilegeEscalation: true + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - all containers: - name: puppetboard image: ghcr.io/voxpupuli/puppetboard:7.0.1 diff --git a/apps/base/puppet/deployment_puppetdb.yaml b/apps/base/puppet/deployment_puppetdb.yaml index 38e8883..f63055d 100644 --- a/apps/base/puppet/deployment_puppetdb.yaml +++ b/apps/base/puppet/deployment_puppetdb.yaml @@ -75,18 +75,16 @@ spec: name: postgres-read-credentials securityContext: allowPrivilegeEscalation: false + # Root entrypoint drops to the puppetdb user via `runuser` (needs + # SETUID/SETGID) after chowning SSL/data dirs (CHOWN). Cannot run + # non-root: the image entrypoint requires a root start. capabilities: add: - - CAP_FOWNER - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE + - FOWNER + - SETGID + - SETUID drop: - all volumeMounts: @@ -105,7 +103,7 @@ spec: - sh - -c args: - - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile + - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile env: - name: POD_NAME valueFrom: @@ -119,7 +117,13 @@ spec: cpu: 20m memory: 32Mi securityContext: - runAsUser: 0 + runAsUser: 999 + runAsGroup: 999 + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - all volumeMounts: - mountPath: /opt/puppetlabs/server/data/puppetdb name: puppetdb-storage @@ -178,6 +182,11 @@ spec: runAsGroup: 1000 runAsNonRoot: true allowPrivilegeEscalation: false + securityContext: + fsGroup: 999 + fsGroupChangePolicy: OnRootMismatch + seccompProfile: + type: RuntimeDefault volumes: - name: puppetdb-storage persistentVolumeClaim: diff --git a/apps/base/puppet/deployment_puppetserver-compiler.yaml b/apps/base/puppet/deployment_puppetserver-compiler.yaml index a21b41d..a7b5380 100644 --- a/apps/base/puppet/deployment_puppetserver-compiler.yaml +++ b/apps/base/puppet/deployment_puppetserver-compiler.yaml @@ -66,20 +66,16 @@ spec: timeoutSeconds: 20 securityContext: allowPrivilegeEscalation: false + # Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to + # the puppet user via `runuser` (needs SETUID/SETGID). Cannot run + # non-root: the image entrypoint requires a root start. capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER + - SETGID + - SETUID drop: - all startupProbe: @@ -159,19 +155,13 @@ spec: securityContext: runAsUser: 0 runAsNonRoot: false + allowPrivilegeEscalation: false + # Runs as root to chown the mounted PVC dirs to puppet:puppet before + # the main container starts (CHOWN); does not drop privileges itself. capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER drop: - all @@ -212,6 +202,8 @@ spec: name: puppet-shared-bins securityContext: fsGroup: 999 + seccompProfile: + type: RuntimeDefault volumes: - name: puppet-code-volume persistentVolumeClaim: diff --git a/apps/base/puppet/deployment_puppetserver-master.yaml b/apps/base/puppet/deployment_puppetserver-master.yaml index 3f13268..189b901 100644 --- a/apps/base/puppet/deployment_puppetserver-master.yaml +++ b/apps/base/puppet/deployment_puppetserver-master.yaml @@ -66,20 +66,16 @@ spec: timeoutSeconds: 20 securityContext: allowPrivilegeEscalation: false + # Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to + # the puppet user via `runuser` (needs SETUID/SETGID). Cannot run + # non-root: the image entrypoint requires a root start. capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER + - SETGID + - SETUID drop: - all startupProbe: @@ -133,19 +129,13 @@ spec: securityContext: runAsUser: 0 runAsNonRoot: false + allowPrivilegeEscalation: false + # Runs as root to chown the mounted PVC dirs to puppet:puppet before + # the main container starts (CHOWN); does not drop privileges itself. capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER drop: - all @@ -157,6 +147,8 @@ spec: subPath: check_for_masters.sh securityContext: fsGroup: 999 + seccompProfile: + type: RuntimeDefault volumes: - name: puppet-ca-storage persistentVolumeClaim: