From 4c2f275f049d38a5cd7603aa673425ac58c1ae76 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 8 Aug 2026 22:36:44 +1000 Subject: [PATCH] puppet: reduce privilege in namespace workloads (#307) (#319) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: shrink the blast radius of the Puppet control-plane pods (CA/eyaml keys, compiled catalogs) per the security sweep in #307 — remove root where it is not required and strip cargo-culted capabilities. How: - puppetboard cert-generator init: root+APE:true -> uid 1000, drop:[all], APE:false; pod fsGroup 1000; removed trailing `chown -R 1000:1000` (PVC now group-owned). - puppetdb create-log-dir init: root -> uid 999, drop:[all], APE:false; pod fsGroup 999; removed `chown 999:999`. - All OpenVox capability add-lists: removed the duplicate CAP_-prefixed spellings (k8s normalises both to the same kernel cap) and dropped the unused AUDIT_WRITE. - Added allowPrivilegeEscalation:false and seccompProfile RuntimeDefault across the workloads. Stays root (evidence-backed, class-B fallback): the puppetserver master/compiler and puppetdb main containers, plus the perms-and-dirs and generate-types root containers. The OpenVox image entrypoint runs `chown -R puppet:puppet` over root-owned baked-in dirs and drops the JVM to the puppet user via `runuser` (needs CHOWN/SETUID/SETGID); a non-root start crashloops. Their cap sets are reduced to the minimum justified (CHOWN/DAC_OVERRIDE/FOWNER[/SETUID/SETGID]). Validation: `kustomize build --enable-helm` clean; kubeconform 0 invalid / 0 errors; pre-commit (yamllint etc.) green. Confirmed against live pods: puppetserver/puppetdb JVMs already run as puppet/puppetdb via `runuser`; `pam_loginuid` is absent from the su/runuser PAM stacks and loginuid is unset, so dropping AUDIT_WRITE is safe. Post-merge smoke test (puppet had an outage this session — watch closely): after argocd sync, confirm puppetserver master + a compiler reach `running` at /status/v1/simple, puppetdb reaches `running`, puppetboard serves 200, and the generate-types + g10k CronJobs complete — i.e. catalogs still compile and reports still ingest. Closes #307 https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/319 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/puppet/cronjob_generate-types.yaml | 16 +++++----- apps/base/puppet/deployment_puppetboard.yaml | 18 ++++++++---- apps/base/puppet/deployment_puppetdb.yaml | 29 ++++++++++++------- .../deployment_puppetserver-compiler.yaml | 28 +++++++----------- .../deployment_puppetserver-master.yaml | 28 +++++++----------- 5 files changed, 58 insertions(+), 61 deletions(-) diff --git a/apps/base/puppet/cronjob_generate-types.yaml b/apps/base/puppet/cronjob_generate-types.yaml index 6a1eeb8..84d4d1c 100644 --- a/apps/base/puppet/cronjob_generate-types.yaml +++ b/apps/base/puppet/cronjob_generate-types.yaml @@ -52,20 +52,16 @@ spec: securityContext: runAsUser: 0 runAsNonRoot: false + allowPrivilegeEscalation: false + # Root to `gem install` into the image's root-owned gem dir and + # to `runuser` for `puppet generate types` (SETUID/SETGID). capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER + - SETGID + - SETUID drop: - all volumeMounts: @@ -76,6 +72,8 @@ spec: restartPolicy: OnFailure securityContext: fsGroup: 999 + seccompProfile: + type: RuntimeDefault volumes: - name: puppet-code-volume persistentVolumeClaim: diff --git a/apps/base/puppet/deployment_puppetboard.yaml b/apps/base/puppet/deployment_puppetboard.yaml index 97a4b01..e770387 100644 --- a/apps/base/puppet/deployment_puppetboard.yaml +++ b/apps/base/puppet/deployment_puppetboard.yaml @@ -29,6 +29,11 @@ spec: app.kubernetes.io/version: 8.8.0 spec: enableServiceLinks: false + securityContext: + fsGroup: 1000 + fsGroupChangePolicy: OnRootMismatch + seccompProfile: + type: RuntimeDefault initContainers: - name: wait-puppetserver image: curlimages/curl:8.11.1 @@ -115,9 +120,6 @@ spec: chmod 600 ${CERT_DIR}/${HOSTNAME}.key chmod 644 ${CERT_DIR}/ca.pem - # Change ownership to puppetboard user (1000:1000) - chown -R 1000:1000 ${CERT_DIR} - echo "Certificate generation completed for ${HOSTNAME}" volumeMounts: - name: puppetboard-certs @@ -130,9 +132,13 @@ spec: cpu: 50m memory: 64Mi securityContext: - runAsUser: 0 - runAsGroup: 0 - allowPrivilegeEscalation: true + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - all containers: - name: puppetboard image: ghcr.io/voxpupuli/puppetboard:7.0.1 diff --git a/apps/base/puppet/deployment_puppetdb.yaml b/apps/base/puppet/deployment_puppetdb.yaml index 38e8883..f63055d 100644 --- a/apps/base/puppet/deployment_puppetdb.yaml +++ b/apps/base/puppet/deployment_puppetdb.yaml @@ -75,18 +75,16 @@ spec: name: postgres-read-credentials securityContext: allowPrivilegeEscalation: false + # Root entrypoint drops to the puppetdb user via `runuser` (needs + # SETUID/SETGID) after chowning SSL/data dirs (CHOWN). Cannot run + # non-root: the image entrypoint requires a root start. capabilities: add: - - CAP_FOWNER - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE + - FOWNER + - SETGID + - SETUID drop: - all volumeMounts: @@ -105,7 +103,7 @@ spec: - sh - -c args: - - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile + - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile env: - name: POD_NAME valueFrom: @@ -119,7 +117,13 @@ spec: cpu: 20m memory: 32Mi securityContext: - runAsUser: 0 + runAsUser: 999 + runAsGroup: 999 + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - all volumeMounts: - mountPath: /opt/puppetlabs/server/data/puppetdb name: puppetdb-storage @@ -178,6 +182,11 @@ spec: runAsGroup: 1000 runAsNonRoot: true allowPrivilegeEscalation: false + securityContext: + fsGroup: 999 + fsGroupChangePolicy: OnRootMismatch + seccompProfile: + type: RuntimeDefault volumes: - name: puppetdb-storage persistentVolumeClaim: diff --git a/apps/base/puppet/deployment_puppetserver-compiler.yaml b/apps/base/puppet/deployment_puppetserver-compiler.yaml index a21b41d..a7b5380 100644 --- a/apps/base/puppet/deployment_puppetserver-compiler.yaml +++ b/apps/base/puppet/deployment_puppetserver-compiler.yaml @@ -66,20 +66,16 @@ spec: timeoutSeconds: 20 securityContext: allowPrivilegeEscalation: false + # Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to + # the puppet user via `runuser` (needs SETUID/SETGID). Cannot run + # non-root: the image entrypoint requires a root start. capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER + - SETGID + - SETUID drop: - all startupProbe: @@ -159,19 +155,13 @@ spec: securityContext: runAsUser: 0 runAsNonRoot: false + allowPrivilegeEscalation: false + # Runs as root to chown the mounted PVC dirs to puppet:puppet before + # the main container starts (CHOWN); does not drop privileges itself. capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER drop: - all @@ -212,6 +202,8 @@ spec: name: puppet-shared-bins securityContext: fsGroup: 999 + seccompProfile: + type: RuntimeDefault volumes: - name: puppet-code-volume persistentVolumeClaim: diff --git a/apps/base/puppet/deployment_puppetserver-master.yaml b/apps/base/puppet/deployment_puppetserver-master.yaml index 3f13268..189b901 100644 --- a/apps/base/puppet/deployment_puppetserver-master.yaml +++ b/apps/base/puppet/deployment_puppetserver-master.yaml @@ -66,20 +66,16 @@ spec: timeoutSeconds: 20 securityContext: allowPrivilegeEscalation: false + # Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to + # the puppet user via `runuser` (needs SETUID/SETGID). Cannot run + # non-root: the image entrypoint requires a root start. capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER + - SETGID + - SETUID drop: - all startupProbe: @@ -133,19 +129,13 @@ spec: securityContext: runAsUser: 0 runAsNonRoot: false + allowPrivilegeEscalation: false + # Runs as root to chown the mounted PVC dirs to puppet:puppet before + # the main container starts (CHOWN); does not drop privileges itself. capabilities: add: - - CAP_CHOWN - - CAP_SETUID - - CAP_SETGID - - CAP_DAC_OVERRIDE - - CAP_AUDIT_WRITE - - CAP_FOWNER - CHOWN - - SETUID - - SETGID - DAC_OVERRIDE - - AUDIT_WRITE - FOWNER drop: - all @@ -157,6 +147,8 @@ spec: subPath: check_for_masters.sh securityContext: fsGroup: 999 + seccompProfile: + type: RuntimeDefault volumes: - name: puppet-ca-storage persistentVolumeClaim: