unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

puppet: reduce privilege in namespace workloads (#307) #319

Merged
benvin merged 1 commits from benvin/puppet-rootless into main 2026-08-08 22:36:44 +10:00
Conversation 0 Commits 1 Files Changed 5
+58 -61
5 changed files with 58 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/puppet/cronjob_generate-types.yaml
+7 -9
View File
@@ -52,20 +52,16 @@ spec:
securityContext:
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false
# Root to `gem install` into the image's root-owned gem dir and
# to `runuser` for `puppet generate types` (SETUID/SETGID).
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
- SETGID
- SETUID
drop:
- all
volumeMounts:
@@ -76,6 +72,8 @@ spec:
restartPolicy: OnFailure
securityContext:
fsGroup: 999
seccompProfile:
type: RuntimeDefault
volumes:
- name: puppet-code-volume
persistentVolumeClaim:
apps/base/puppet/deployment_puppetboard.yaml
+12 -6
View File
@@ -29,6 +29,11 @@ spec:
app.kubernetes.io/version: 8.8.0
spec:
enableServiceLinks: false
securityContext:
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
initContainers:
- name: wait-puppetserver
image: curlimages/curl:8.11.1
@@ -115,9 +120,6 @@ spec:
chmod 600 ${CERT_DIR}/${HOSTNAME}.key
chmod 644 ${CERT_DIR}/ca.pem
# Change ownership to puppetboard user (1000:1000)
chown -R 1000:1000 ${CERT_DIR}
echo "Certificate generation completed for ${HOSTNAME}"
volumeMounts:
- name: puppetboard-certs
@@ -130,9 +132,13 @@ spec:
cpu: 50m
memory: 64Mi
securityContext:
runAsUser: 0
runAsGroup: 0
allowPrivilegeEscalation: true
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- all
containers:
- name: puppetboard
image: ghcr.io/voxpupuli/puppetboard:7.0.1
apps/base/puppet/deployment_puppetdb.yaml
+19 -10
View File
@@ -75,18 +75,16 @@ spec:
name: postgres-read-credentials
securityContext:
allowPrivilegeEscalation: false
# Root entrypoint drops to the puppetdb user via `runuser` (needs
# SETUID/SETGID) after chowning SSL/data dirs (CHOWN). Cannot run
# non-root: the image entrypoint requires a root start.
capabilities:
add:
- CAP_FOWNER
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
drop:
- all
volumeMounts:
@@ -105,7 +103,7 @@ spec:
- sh
- -c
args:
- mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
- mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
env:
- name: POD_NAME
valueFrom:
@@ -119,7 +117,13 @@ spec:
cpu: 20m
memory: 32Mi
securityContext:
runAsUser: 0
runAsUser: 999
runAsGroup: 999
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- all
volumeMounts:
- mountPath: /opt/puppetlabs/server/data/puppetdb
name: puppetdb-storage
@@ -178,6 +182,11 @@ spec:
runAsGroup: 1000
runAsNonRoot: true
allowPrivilegeEscalation: false
securityContext:
fsGroup: 999
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
volumes:
- name: puppetdb-storage
persistentVolumeClaim:
apps/base/puppet/deployment_puppetserver-compiler.yaml
+10 -18
View File
@@ -66,20 +66,16 @@ spec:
timeoutSeconds: 20
securityContext:
allowPrivilegeEscalation: false
# Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to
# the puppet user via `runuser` (needs SETUID/SETGID). Cannot run
# non-root: the image entrypoint requires a root start.
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
- SETGID
- SETUID
drop:
- all
startupProbe:
@@ -159,19 +155,13 @@ spec:
securityContext:
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false
# Runs as root to chown the mounted PVC dirs to puppet:puppet before
# the main container starts (CHOWN); does not drop privileges itself.
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
drop:
- all
@@ -212,6 +202,8 @@ spec:
name: puppet-shared-bins
securityContext:
fsGroup: 999
seccompProfile:
type: RuntimeDefault
volumes:
- name: puppet-code-volume
persistentVolumeClaim:
apps/base/puppet/deployment_puppetserver-master.yaml
+10 -18
View File
@@ -66,20 +66,16 @@ spec:
timeoutSeconds: 20
securityContext:
allowPrivilegeEscalation: false
# Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to
# the puppet user via `runuser` (needs SETUID/SETGID). Cannot run
# non-root: the image entrypoint requires a root start.
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
- SETGID
- SETUID
drop:
- all
startupProbe:
@@ -133,19 +129,13 @@ spec:
securityContext:
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false
# Runs as root to chown the mounted PVC dirs to puppet:puppet before
# the main container starts (CHOWN); does not drop privileges itself.
capabilities:
add:
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE
- CAP_AUDIT_WRITE
- CAP_FOWNER
- CHOWN
- SETUID
- SETGID
- DAC_OVERRIDE
- AUDIT_WRITE
- FOWNER
drop:
- all
@@ -157,6 +147,8 @@ spec:
subPath: check_for_masters.sh
securityContext:
fsGroup: 999
seccompProfile:
type: RuntimeDefault
volumes:
- name: puppet-ca-storage
persistentVolumeClaim: