unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

puppet: reduce privilege in namespace workloads (#307) (#319)

Browse Source 
Why: shrink the blast radius of the Puppet control-plane pods (CA/eyaml keys, compiled catalogs) per the security sweep in #307 — remove root where it is not required and strip cargo-culted capabilities.

How:
- puppetboard cert-generator init: root+APE:true -> uid 1000, drop:[all], APE:false; pod fsGroup 1000; removed trailing `chown -R 1000:1000` (PVC now group-owned).
- puppetdb create-log-dir init: root -> uid 999, drop:[all], APE:false; pod fsGroup 999; removed `chown 999:999`.
- All OpenVox capability add-lists: removed the duplicate CAP_-prefixed spellings (k8s normalises both to the same kernel cap) and dropped the unused AUDIT_WRITE.
- Added allowPrivilegeEscalation:false and seccompProfile RuntimeDefault across the workloads.

Stays root (evidence-backed, class-B fallback): the puppetserver master/compiler and puppetdb main containers, plus the perms-and-dirs and generate-types root containers. The OpenVox image entrypoint runs `chown -R puppet:puppet` over root-owned baked-in dirs and drops the JVM to the puppet user via `runuser` (needs CHOWN/SETUID/SETGID); a non-root start crashloops. Their cap sets are reduced to the minimum justified (CHOWN/DAC_OVERRIDE/FOWNER[/SETUID/SETGID]).

Validation: `kustomize build --enable-helm` clean; kubeconform 0 invalid / 0 errors; pre-commit (yamllint etc.) green. Confirmed against live pods: puppetserver/puppetdb JVMs already run as puppet/puppetdb via `runuser`; `pam_loginuid` is absent from the su/runuser PAM stacks and loginuid is unset, so dropping AUDIT_WRITE is safe.

Post-merge smoke test (puppet had an outage this session — watch closely): after argocd sync, confirm puppetserver master + a compiler reach `running` at /status/v1/simple, puppetdb reaches `running`, puppetboard serves 200, and the generate-types + g10k CronJobs complete — i.e. catalogs still compile and reports still ingest.

Closes #307

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Reviewed-on: #319
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #319.
This commit is contained in:
Ben Vincent
2026-08-08 22:36:44 +10:00
committed by BenVincent
parent 5ebf2cc581
commit 4c2f275f04
5 changed files with 58 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/puppet/cronjob_generate-types.yaml
+7 -9
View File
@@ -52,20 +52,16 @@ spec:
securityContext:
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false
# Root to `gem install` into the image's root-owned gem dir and
# to `runuser` for `puppet generate types` (SETUID/SETGID).
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
- SETGID
- SETUID
drop:
- all
volumeMounts:
@@ -76,6 +72,8 @@ spec:
restartPolicy: OnFailure
securityContext:
fsGroup: 999
seccompProfile:
type: RuntimeDefault
volumes:
- name: puppet-code-volume
persistentVolumeClaim:
apps/base/puppet/deployment_puppetboard.yaml
+12 -6
View File
@@ -29,6 +29,11 @@ spec:
app.kubernetes.io/version: 8.8.0
spec:
enableServiceLinks: false
securityContext:
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
initContainers:
- name: wait-puppetserver
image: curlimages/curl:8.11.1
@@ -115,9 +120,6 @@ spec:
chmod 600 ${CERT_DIR}/${HOSTNAME}.key
chmod 644 ${CERT_DIR}/ca.pem
# Change ownership to puppetboard user (1000:1000)
chown -R 1000:1000 ${CERT_DIR}
echo "Certificate generation completed for ${HOSTNAME}"
volumeMounts:
- name: puppetboard-certs
@@ -130,9 +132,13 @@ spec:
cpu: 50m
memory: 64Mi
securityContext:
runAsUser: 0
runAsGroup: 0
allowPrivilegeEscalation: true
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- all
containers:
- name: puppetboard
image: ghcr.io/voxpupuli/puppetboard:7.0.1
apps/base/puppet/deployment_puppetdb.yaml
+19 -10
View File
@@ -75,18 +75,16 @@ spec:
name: postgres-read-credentials
securityContext:
allowPrivilegeEscalation: false
# Root entrypoint drops to the puppetdb user via `runuser` (needs
# SETUID/SETGID) after chowning SSL/data dirs (CHOWN). Cannot run
# non-root: the image entrypoint requires a root start.
capabilities:
add:
- CAP_FOWNER
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
drop:
- all
volumeMounts:
@@ -105,7 +103,7 @@ spec:
- sh
- -c
args:
- mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
- mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
env:
- name: POD_NAME
valueFrom:
@@ -119,7 +117,13 @@ spec:
cpu: 20m
memory: 32Mi
securityContext:
runAsUser: 0
runAsUser: 999
runAsGroup: 999
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- all
volumeMounts:
- mountPath: /opt/puppetlabs/server/data/puppetdb
name: puppetdb-storage
@@ -178,6 +182,11 @@ spec:
runAsGroup: 1000
runAsNonRoot: true
allowPrivilegeEscalation: false
securityContext:
fsGroup: 999
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
volumes:
- name: puppetdb-storage
persistentVolumeClaim:
apps/base/puppet/deployment_puppetserver-compiler.yaml
+10 -18
View File
@@ -66,20 +66,16 @@ spec:
timeoutSeconds: 20
securityContext:
allowPrivilegeEscalation: false
# Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to
# the puppet user via `runuser` (needs SETUID/SETGID). Cannot run
# non-root: the image entrypoint requires a root start.
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
- SETGID
- SETUID
drop:
- all
startupProbe:
@@ -159,19 +155,13 @@ spec:
securityContext:
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false
# Runs as root to chown the mounted PVC dirs to puppet:puppet before
# the main container starts (CHOWN); does not drop privileges itself.
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
drop:
- all
@@ -212,6 +202,8 @@ spec:
name: puppet-shared-bins
securityContext:
fsGroup: 999
seccompProfile:
type: RuntimeDefault
volumes:
- name: puppet-code-volume
persistentVolumeClaim:
apps/base/puppet/deployment_puppetserver-master.yaml
+10 -18
View File
@@ -66,20 +66,16 @@ spec:
timeoutSeconds: 20
securityContext:
allowPrivilegeEscalation: false
# Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to
# the puppet user via `runuser` (needs SETUID/SETGID). Cannot run
# non-root: the image entrypoint requires a root start.
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
- SETGID
- SETUID
drop:
- all
startupProbe:
@@ -133,19 +129,13 @@ spec:
securityContext:
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false
# Runs as root to chown the mounted PVC dirs to puppet:puppet before
# the main container starts (CHOWN); does not drop privileges itself.
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
drop:
- all
@@ -157,6 +147,8 @@ spec:
subPath: check_for_masters.sh
securityContext:
fsGroup: 999
seccompProfile:
type: RuntimeDefault
volumes:
- name: puppet-ca-storage
persistentVolumeClaim: