unkinben
4c2f275f04
Why: shrink the blast radius of the Puppet control-plane pods (CA/eyaml keys, compiled catalogs) per the security sweep in #307 — remove root where it is not required and strip cargo-culted capabilities. How: - puppetboard cert-generator init: root+APE:true -> uid 1000, drop:[all], APE:false; pod fsGroup 1000; removed trailing `chown -R 1000:1000` (PVC now group-owned). - puppetdb create-log-dir init: root -> uid 999, drop:[all], APE:false; pod fsGroup 999; removed `chown 999:999`. - All OpenVox capability add-lists: removed the duplicate CAP_-prefixed spellings (k8s normalises both to the same kernel cap) and dropped the unused AUDIT_WRITE. - Added allowPrivilegeEscalation:false and seccompProfile RuntimeDefault across the workloads. Stays root (evidence-backed, class-B fallback): the puppetserver master/compiler and puppetdb main containers, plus the perms-and-dirs and generate-types root containers. The OpenVox image entrypoint runs `chown -R puppet:puppet` over root-owned baked-in dirs and drops the JVM to the puppet user via `runuser` (needs CHOWN/SETUID/SETGID); a non-root start crashloops. Their cap sets are reduced to the minimum justified (CHOWN/DAC_OVERRIDE/FOWNER[/SETUID/SETGID]). Validation: `kustomize build --enable-helm` clean; kubeconform 0 invalid / 0 errors; pre-commit (yamllint etc.) green. Confirmed against live pods: puppetserver/puppetdb JVMs already run as puppet/puppetdb via `runuser`; `pam_loginuid` is absent from the su/runuser PAM stacks and loginuid is unset, so dropping AUDIT_WRITE is safe. Post-merge smoke test (puppet had an outage this session — watch closely): after argocd sync, confirm puppetserver master + a compiler reach `running` at /status/v1/simple, puppetdb reaches `running`, puppetboard serves 200, and the generate-types + g10k CronJobs complete — i.e. catalogs still compile and reports still ingest. Closes #307 https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Reviewed-on: #319 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
197 lines
6.1 KiB
YAML
197 lines
6.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: puppetdb
|
|
app.kubernetes.io/instance: puppetserver
|
|
app.kubernetes.io/name: puppetserver
|
|
app.kubernetes.io/version: 8.8.0
|
|
name: puppetdb
|
|
namespace: puppet
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: puppetdb
|
|
app.kubernetes.io/name: puppetserver
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
labels:
|
|
app.kubernetes.io/component: puppetdb
|
|
app.kubernetes.io/instance: puppetserver
|
|
app.kubernetes.io/name: puppetserver
|
|
app.kubernetes.io/version: 8.8.0
|
|
spec:
|
|
hostname: puppetdb
|
|
imagePullSecrets: null
|
|
containers:
|
|
- name: puppetdb
|
|
image: ghcr.io/openvoxproject/openvoxdb:8.9.0-main
|
|
imagePullPolicy: IfNotPresent
|
|
resources:
|
|
limits:
|
|
cpu: 1
|
|
memory: 1536Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 768Mi
|
|
ports:
|
|
- containerPort: 8080
|
|
name: pdb-http
|
|
- containerPort: 8081
|
|
name: pdb-https
|
|
envFrom:
|
|
- configMapRef:
|
|
name: puppetdb-config
|
|
env:
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: OPENVOXDB_POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: postgres-credentials
|
|
- name: OPENVOXDB_POSTGRES_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: username
|
|
name: postgres-credentials
|
|
- name: OPENVOXDB_READ_POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: postgres-read-credentials
|
|
- name: OPENVOXDB_READ_POSTGRES_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: username
|
|
name: postgres-read-credentials
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
# Root entrypoint drops to the puppetdb user via `runuser` (needs
|
|
# SETUID/SETGID) after chowning SSL/data dirs (CHOWN). Cannot run
|
|
# non-root: the image entrypoint requires a root start.
|
|
capabilities:
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- SETGID
|
|
- SETUID
|
|
drop:
|
|
- all
|
|
volumeMounts:
|
|
- mountPath: /opt/puppetlabs/server/data/puppetdb
|
|
name: puppetdb-storage
|
|
- mountPath: /opt/puppetlabs/server/data/puppetdb/stockpile
|
|
name: puppetdb-storage
|
|
subPathExpr: stockpile/$(POD_NAME)
|
|
- mountPath: /etc/puppetlabs/puppetdb/conf.d/read-database.conf
|
|
name: puppetdb-read-database-conf
|
|
subPath: read-database.conf
|
|
initContainers:
|
|
- name: create-log-dir
|
|
image: docker.io/busybox:1.37
|
|
command:
|
|
- sh
|
|
- -c
|
|
args:
|
|
- mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
|
|
env:
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
resources:
|
|
limits:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
requests:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
securityContext:
|
|
runAsUser: 999
|
|
runAsGroup: 999
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- all
|
|
volumeMounts:
|
|
- mountPath: /opt/puppetlabs/server/data/puppetdb
|
|
name: puppetdb-storage
|
|
- mountPath: /opt/puppetlabs/server/data/puppetdb/stockpile
|
|
name: puppetdb-storage
|
|
subPathExpr: stockpile/$(POD_NAME)
|
|
|
|
- name: pgchecker
|
|
image: docker.io/busybox:1.37
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -c
|
|
args:
|
|
- |
|
|
echo 'Waiting for PostgreSQL to become ready...'
|
|
until printf "." && nc -z -w 2 puppet-postgres-pooler 5432; do
|
|
sleep 2;
|
|
done;
|
|
echo 'PostgreSQL OK ✓'
|
|
resources:
|
|
limits:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
requests:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
|
|
- name: wait-puppetserver
|
|
image: curlimages/curl:8.11.1
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -c
|
|
args:
|
|
- |
|
|
echo 'Waiting for puppetserver to become ready...'
|
|
until printf "." && curl --silent --fail --insecure 'https://puppetca:8140/status/v1/simple' | grep -q '^running$'; do
|
|
sleep 2;
|
|
done;
|
|
echo 'Puppetserver OK ✓'
|
|
resources:
|
|
limits:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
requests:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
securityContext:
|
|
fsGroup: 999
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumes:
|
|
- name: puppetdb-storage
|
|
persistentVolumeClaim:
|
|
claimName: puppetserver-puppetdb-claim
|
|
- name: puppetdb-read-database-conf
|
|
configMap:
|
|
name: puppetdb-read-database-conf
|