Skip to content

Commit 4d8517f

Browse files
amrityamroutamrityamrout
authored
Merge pull request #121 from abnamro/2389377-fix-critical-findings-from-kubeaudit
2389377 fix critical findings from kube-audit and datree scan
2 parents c1c4c92 + 15e9e1c commit 4d8517f

File tree

14 files changed

+238
-8
lines changed

14 files changed

+238
-8
lines changed

‎components/resc-backend/Dockerfile

+6-2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ ARG NAME="resc_backend"
44
ARG DESCRIPTION="Repository Scanner Backend"
55
ARG VERSION=${VERSION}
66
ARG RUN_AS_USER="apiuser"
7+
ARG RUN_AS_GROUP="apiuser"
8+
ARG UID=10001
9+
ARG GID=10002
710

811
RUN apk -U upgrade \
912
&& apk add --no-cache curl git nginx build-base linux-headers \
@@ -24,8 +27,9 @@ RUN mkdir /resc_backend
2427

2528
COPY ./ /resc_backend
2629

27-
RUN addgroup -S $RUN_AS_USER && adduser -S $RUN_AS_USER -g "$RUN_AS_USER" \
28-
&& chown -R $RUN_AS_USER:$RUN_AS_USER ./resc_backend
30+
RUN addgroup -g $GID $RUN_AS_GROUP \
31+
&& adduser -D -u $UID -G $RUN_AS_GROUP $RUN_AS_USER \
32+
&& chown -R $RUN_AS_USER:$RUN_AS_GROUP ./resc_backend
2933

3034
USER $RUN_AS_USER
3135
ENV PATH=$PATH:/home/apiuser/.local/bin

‎components/resc-vcs-scanner/Dockerfile

+7-3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ ARG NAME="resc-vcs-scanner"
44
ARG DESCRIPTION="RESC Version Control System Scanner"
55
ARG VERSION=${VERSION}
66
ARG RUN_AS_USER="apiuser"
7+
ARG RUN_AS_GROUP="apiuser"
8+
ARG UID=10001
9+
ARG GID=10002
710

811
RUN apk -U upgrade \
912
&& apk add --no-cache git \
@@ -13,12 +16,13 @@ RUN mkdir /resc_backend && mkdir /vcs_scanner
1316

1417
COPY ./resc-backend /resc_backend
1518

16-
RUN addgroup -S $RUN_AS_USER && adduser -S $RUN_AS_USER -g "$RUN_AS_USER" \
17-
&& chown -R $RUN_AS_USER:$RUN_AS_USER ./resc_backend
19+
RUN addgroup -g $GID $RUN_AS_GROUP \
20+
&& adduser -D -u $UID -G $RUN_AS_GROUP $RUN_AS_USER \
21+
&& chown -R $RUN_AS_USER:$RUN_AS_GROUP ./resc_backend
1822

1923
COPY ./resc-vcs-scanner /vcs_scanner
2024

21-
RUN chown -R $RUN_AS_USER:$RUN_AS_USER ./vcs_scanner \
25+
RUN chown -R $RUN_AS_USER:$RUN_AS_GROUP ./vcs_scanner \
2226
&& chmod +x ./vcs_scanner/gitleaks_config/seco-gitleaks-linux-amd64
2327

2428
USER $RUN_AS_USER

‎components/resc-vcs-scraper/Dockerfile

+6-2
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,19 @@ ARG NAME="resc-vcs-scraper"
44
ARG DESCRIPTION="Version Control Systems Scraper"
55
ARG VERSION=${VERSION}
66
ARG RUN_AS_USER="apiuser"
7+
ARG RUN_AS_GROUP="apiuser"
8+
ARG UID=10001
9+
ARG GID=10002
710

811
RUN apk -U upgrade \
912
&& apk add --no-cache --virtual .build-deps pcre-dev gcc musl-dev python3-dev libffi-dev openssl-dev \
1013
&& mkdir /vcs-scraper
1114

1215
COPY ./ /vcs-scraper
1316

14-
RUN addgroup -S $RUN_AS_USER && adduser -S $RUN_AS_USER -g "$RUN_AS_USER" \
15-
&& chown -R $RUN_AS_USER:$RUN_AS_USER ./vcs-scraper
17+
RUN addgroup -g $GID $RUN_AS_GROUP \
18+
&& adduser -D -u $UID -G $RUN_AS_GROUP $RUN_AS_USER \
19+
&& chown -R $RUN_AS_USER:$RUN_AS_GROUP ./vcs-scraper
1620

1721
USER $RUN_AS_USER
1822

‎deployment/kubernetes/charts/resc-database-init/templates/database_job.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ spec:
77
ttlSecondsAfterFinished: 600
88
template:
99
metadata:
10+
annotations:
11+
container.apparmor.security.beta.kubernetes.io/resc-db-init: unconfined
1012
labels:
1113
{{ if .Values.additionalLabels }}
1214
{{- range $key, $val := .Values.additionalLabels }}
@@ -15,6 +17,8 @@ spec:
1517
{{ end }}
1618
app: {{ .Values.global.appName }}
1719
tier: database
20+
kubeaudit.io/allow-disabled-apparmor: "apparmor-needs-to-be-installed-on-host"
21+
kubeaudit.io/allow-read-only-root-filesystem-false: "required-to-write-log-files"
1822
spec:
1923
{{ if .Values.global.serviceAccountName }}
2024
serviceAccountName: {{ .Values.global.serviceAccountName }}
@@ -41,6 +45,17 @@ spec:
4145
- name: config-volume
4246
mountPath: /tmp/odbc.ini
4347
subPath: odbc.ini
48+
securityContext:
49+
allowPrivilegeEscalation: false
50+
readOnlyRootFilesystem: false
51+
privileged: false
52+
capabilities:
53+
drop:
54+
- ALL
55+
seccompProfile:
56+
type: RuntimeDefault
57+
runAsNonRoot: true
58+
runAsUser: 10001
4459
volumes:
4560
- name: config-volume
4661
configMap:
@@ -50,4 +65,5 @@ spec:
5065
imagePullSecrets:
5166
- name: {{ .Values.global.imagePullSecret }}
5267
{{ end }}
68+
automountServiceAccountToken: false
5369
backoffLimit: {{ .Values.backoffLimit }}

‎deployment/kubernetes/charts/resc-database/templates/database_deployment.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,14 @@ spec:
1212
replicas: 1
1313
template:
1414
metadata:
15+
annotations:
16+
container.apparmor.security.beta.kubernetes.io/resc-db: unconfined
1517
labels:
1618
app: {{ .Values.global.appName }}
1719
tier: ms-database
20+
kubeaudit.io/allow-disabled-apparmor: "apparmor-needs-to-be-installed-on-host"
21+
kubeaudit.io/allow-capability-net-bind-service: "required-by-sqlserver-to-bind-the-default-MSDTC-RPC-on-port-135"
22+
kubeaudit.io/allow-read-only-root-filesystem-false: "required-to-write-database-files"
1823
spec:
1924
volumes:
2025
- name: {{ .Values.global.appName }}-database-pv-storage
@@ -28,6 +33,9 @@ spec:
2833
requests:
2934
cpu: {{ .Values.database.resources.requests.cpu }}
3035
memory: {{ .Values.database.resources.requests.memory }}
36+
limits:
37+
cpu: {{ .Values.database.resources.limits.cpu }}
38+
memory: {{ .Values.database.resources.limits.memory }}
3139
env:
3240
- name: GET_HOSTS_FROM
3341
value: dns
@@ -41,4 +49,23 @@ spec:
4149
name: {{ .Values.global.appName }}-database-pv-storage
4250
ports:
4351
- containerPort: {{ .Values.database.port }}
52+
securityContext:
53+
allowPrivilegeEscalation: false
54+
readOnlyRootFilesystem: false
55+
privileged: false
56+
capabilities:
57+
drop:
58+
- ALL
59+
add:
60+
- NET_BIND_SERVICE
61+
runAsNonRoot: true
62+
runAsUser: 10001
63+
seccompProfile:
64+
type: RuntimeDefault
65+
readinessProbe:
66+
initialDelaySeconds: 15
67+
periodSeconds: 300
68+
tcpSocket:
69+
port: {{ .Values.database.port }}
70+
automountServiceAccountToken: false
4471
{{ end }}

‎deployment/kubernetes/charts/resc-database/values.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,8 @@ database:
1111
requests:
1212
cpu: 200m
1313
memory: 500M
14+
limits:
15+
cpu: "2"
16+
memory: 2G
1417
pvc_path: "/var/resc/mssql/data"
1518
pvc_size: 10Gi

‎deployment/kubernetes/charts/resc-frontend/templates/frontend_deployment.yaml

+16-1
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,12 @@ spec:
1313
metadata:
1414
annotations:
1515
rollme: {{ randAlphaNum 5 | quote }}
16+
container.apparmor.security.beta.kubernetes.io/resc-frontend: unconfined
1617
labels:
1718
app: {{ .Values.global.appName }}
1819
tier: frontend
20+
kubeaudit.io/allow-disabled-apparmor: "apparmor-needs-to-be-installed-on-host"
21+
kubeaudit.io/allow-read-only-root-filesystem-false: "required-to-write-log-files"
1922
spec:
2023
containers:
2124
- name: {{ .Values.global.appName }}-frontend
@@ -36,7 +39,19 @@ spec:
3639
name: {{ .Values.global.appName }}-frontend-config
3740
ports:
3841
- containerPort: {{ .Values.port }}
42+
securityContext:
43+
allowPrivilegeEscalation: false
44+
readOnlyRootFilesystem: false
45+
privileged: false
46+
capabilities:
47+
drop:
48+
- ALL
49+
seccompProfile:
50+
type: RuntimeDefault
51+
runAsNonRoot: true
52+
runAsUser: 101
3953
{{ if .Values.global.imagePullSecret }}
4054
imagePullSecrets:
4155
- name: {{ .Values.global.imagePullSecret }}
42-
{{ end }}
56+
{{ end }}
57+
automountServiceAccountToken: false

‎deployment/kubernetes/charts/resc-rabbitmq/templates/rabbitmq_job.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ spec:
1111
{{- with include "resc.mqInitAnnotations" .}}
1212
{{- nindent 8 .}}
1313
{{- end }}
14+
container.apparmor.security.beta.kubernetes.io/resc-mq-init: unconfined
15+
labels:
16+
kubeaudit.io/allow-disabled-apparmor: "apparmor-needs-to-be-installed-on-host"
17+
kubeaudit.io/allow-read-only-root-filesystem-false: "required-to-write-log-files"
1418
spec:
1519
{{ if .Values.global.serviceAccountName }}
1620
serviceAccountName: {{ .Values.global.serviceAccountName }}
@@ -37,9 +41,25 @@ spec:
3741
- secretRef:
3842
name: {{ .Values.global.appName }}-rabbitmq-admin-secret
3943
{{ end }}
44+
securityContext:
45+
allowPrivilegeEscalation: false
46+
readOnlyRootFilesystem: false
47+
privileged: false
48+
capabilities:
49+
drop:
50+
- ALL
51+
seccompProfile:
52+
type: RuntimeDefault
53+
runAsNonRoot: true
54+
runAsUser: 10001
4055
restartPolicy: {{ .Values.mqInit.restartPolicy }}
4156
{{ if .Values.global.imagePullSecret }}
4257
imagePullSecrets:
4358
- name: {{ .Values.global.imagePullSecret }}
4459
{{ end }}
60+
{{ if .Values.global.serviceAccountName }}
61+
automountServiceAccountToken: true
62+
{{ else }}
63+
automountServiceAccountToken: false
64+
{{ end }}
4565
backoffLimit: {{ .Values.mqInit.backoffLimit }}

‎deployment/kubernetes/charts/resc-rabbitmq/templates/rabbitmq_statefulset.yaml

+35
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,16 @@ spec:
1515
labels:
1616
app: {{ .Values.global.appName }}
1717
tier: rabbitmq
18+
kubeaudit.io/allow-disabled-apparmor: "apparmor-needs-to-be-installed-on-host"
19+
kubeaudit.io/allow-read-only-root-filesystem-false: "required-to-write-log-files"
20+
kubeaudit.io/allow-capability-setgid: "required-by-raabitmq-to-set-group-identitys"
21+
kubeaudit.io/allow-capability-setuid: "required-by-raabitmq-to-set-user-identity"
1822
annotations:
1923
rollme: {{ randAlphaNum 5 | quote }}
2024
{{- with include "resc.mqAnnotations" .}}
2125
{{- nindent 8 .}}
2226
{{- end }}
27+
container.apparmor.security.beta.kubernetes.io/resc-mq: unconfined
2328
spec:
2429
{{ if .Values.global.serviceAccountName }}
2530
serviceAccountName: {{ .Values.global.serviceAccountName }}
@@ -63,7 +68,37 @@ spec:
6368
- mountPath: "/var/lib/rabbitmq/mnesia"
6469
subPath: "var/lib/rabbitmq/mnesia"
6570
name: {{ .Values.global.appName }}-mq-pv-storage
71+
securityContext:
72+
allowPrivilegeEscalation: false
73+
readOnlyRootFilesystem: false
74+
privileged: false
75+
capabilities:
76+
drop:
77+
- ALL
78+
add:
79+
- SETGID
80+
- SETUID
81+
seccompProfile:
82+
type: RuntimeDefault
83+
runAsNonRoot: true
84+
runAsUser: 10001
85+
{{ if eq .Values.useKubernetesSecret "true"}}
86+
readinessProbe:
87+
initialDelaySeconds: 15
88+
periodSeconds: 300
89+
httpGet:
90+
path: /api/health/checks/alarms
91+
port: {{ .Values.rabbitMQ.config.mgmtPort}}
92+
httpHeaders:
93+
- name: Authorization
94+
value: Basic {{ printf "%s:%s" .Values.rabbitMQ.config.admin_username .Values.rabbitMQ.config.admin_password | b64enc }}
95+
{{ end }}
6696
{{ if .Values.global.imagePullSecret_proxy }}
6797
imagePullSecrets:
6898
- name: {{ .Values.global.imagePullSecret_proxy }}
6999
{{ end }}
100+
{{ if .Values.global.serviceAccountName }}
101+
automountServiceAccountToken: true
102+
{{ else }}
103+
automountServiceAccountToken: false
104+
{{ end }}

‎deployment/kubernetes/charts/resc-rules-init/templates/rules_job.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,13 @@ spec:
99
ttlSecondsAfterFinished: 600
1010
template:
1111
metadata:
12+
annotations:
13+
container.apparmor.security.beta.kubernetes.io/resc-rules-init: unconfined
1214
labels:
1315
app: {{ .Values.global.appName }}
1416
tier: database
17+
kubeaudit.io/allow-disabled-apparmor: "apparmor-needs-to-be-installed-on-host"
18+
kubeaudit.io/allow-read-only-root-filesystem-false: "required-to-write-log-files"
1519
spec:
1620
{{ if .Values.serviceAccountName }}
1721
serviceAccountName: {{ .Values.global.serviceAccountName }}
@@ -35,6 +39,17 @@ spec:
3539
volumeMounts:
3640
- name: config-volume
3741
mountPath: /tmp/
42+
securityContext:
43+
allowPrivilegeEscalation: false
44+
readOnlyRootFilesystem: false
45+
privileged: false
46+
capabilities:
47+
drop:
48+
- ALL
49+
seccompProfile:
50+
type: RuntimeDefault
51+
runAsNonRoot: true
52+
runAsUser: 10001
3853
volumes:
3954
- name: config-volume
4055
configMap:
@@ -44,4 +59,9 @@ spec:
4459
imagePullSecrets:
4560
- name: {{ .Values.global.imagePullSecret }}
4661
{{ end }}
62+
{{ if .Values.global.serviceAccountName }}
63+
automountServiceAccountToken: true
64+
{{ else }}
65+
automountServiceAccountToken: false
66+
{{ end }}
4767
backoffLimit: {{ .Values.backoffLimit }}

‎deployment/kubernetes/charts/resc-vcs-scanner-secrets/templates/vcs_scanner_secrets_deployment.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,14 @@ spec:
1212
metadata:
1313
labels:
1414
tier: {{ .Values.global.appName }}-vcs-scanner-secrets
15+
kubeaudit.io/allow-disabled-apparmor: "apparmor-needs-to-be-installed-on-host"
16+
kubeaudit.io/allow-read-only-root-filesystem-false: "required-to-write-log-files"
1517
annotations:
1618
rollme: {{ randAlphaNum 5 | quote }}
1719
{{- with include "resc.vcsScannerSecretsAnnotations" .}}
1820
{{- nindent 8 .}}
1921
{{- end }}
22+
container.apparmor.security.beta.kubernetes.io/resc--vcs-scanner-secrets: unconfined
2023
spec:
2124
{{ if .Values.global.serviceAccountName }}
2225
serviceAccountName: {{ .Values.global.serviceAccountName }}
@@ -52,6 +55,17 @@ spec:
5255
env:
5356
- name: GET_HOSTS_FROM
5457
value: dns
58+
securityContext:
59+
allowPrivilegeEscalation: false
60+
readOnlyRootFilesystem: false
61+
privileged: false
62+
capabilities:
63+
drop:
64+
- ALL
65+
seccompProfile:
66+
type: RuntimeDefault
67+
runAsNonRoot: true
68+
runAsUser: 10001
5569
volumes:
5670
- name: config-volume
5771
configMap:
@@ -61,3 +75,8 @@ spec:
6175
imagePullSecrets:
6276
- name: {{ .Values.global.imagePullSecret }}
6377
{{ end }}
78+
{{ if .Values.global.serviceAccountName }}
79+
automountServiceAccountToken: true
80+
{{ else }}
81+
automountServiceAccountToken: false
82+
{{ end }}

0 commit comments

Comments
 (0)