Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict security context of pods by default #799

Closed
brusdev opened this issue Feb 16, 2024 · 1 comment
Closed

Restrict security context of pods by default #799

brusdev opened this issue Feb 16, 2024 · 1 comment
Labels
enhancement New feature or request

Comments

@brusdev
Copy link
Contributor

brusdev commented Feb 16, 2024 •
edited

Describe the feature
The operator pod and the broker pods can run with a safer and restricted security context without issues. Restricting the security context of the pods by default allows to deploy a cluster of brokers also in Kubernetes namespaces with the restricted policy.

The minimal changes to run the pods in Kubernetes namespaces with the restricted policy:

  • spec.containers[*].securityContext.allowPrivilegeEscalation: false

  • spec.initContainers[*].securityContext.allowPrivilegeEscalation: false

  • spec.ephemeralContainers[*].securityContext.allowPrivilegeEscalation: false

  • spec.securityContext.runAsNonRoot: true

  • spec.containers[*].securityContext.runAsNonRoot: true

  • spec.initContainers[*].securityContext.runAsNonRoot: true

  • spec.ephemeralContainers[*].securityContext.runAsNonRoot: true

  • spec.securityContext.seccompProfile.type: RuntimeDefault

  • spec.containers[*].securityContext.seccompProfile.type: RuntimeDefault

  • spec.initContainers[*].securityContext.seccompProfile.type: RuntimeDefault

  • spec.ephemeralContainers[*].securityContext.seccompProfile.type: RuntimeDefault

  • spec.containers[*].securityContext.capabilities.drop: ["ALL"]

  • spec.initContainers[*].securityContext.capabilities.drop: ["ALL"]

  • spec.ephemeralContainers[*].securityContext.capabilities.drop: ["ALL"]

Tip

Vote this issue reacting with 👍 or 👎
@brusdev brusdev added the enhancement New feature or request label Feb 16, 2024
brusdev added a commit to brusdev/activemq-artemis-operator that referenced this issue Feb 19, 2024
@brusdev
[artemiscloud#799] Restrict security context of pods by default
c4b3065 
The operator pod and the broker pods can run with a safer and restricted
security context without issues. Restricting the security context of the pods
by default allows to deploy a cluster of brokers also in Kubernetes namespaces
with the restricted policy.
brusdev added a commit to brusdev/activemq-artemis-operator that referenced this issue Feb 19, 2024
@brusdev
[artemiscloud#799] Restrict security context of pods by default
c3dd39f 
The operator pod and the broker pods can run with a safer and restricted
security context without issues. Restricting the security context of the pods
by default allows to deploy a cluster of brokers also in Kubernetes namespaces
with the restricted policy.
brusdev added a commit to brusdev/activemq-artemis-operator that referenced this issue Feb 19, 2024
@brusdev
[artemiscloud#799] Restrict security context of pods by default
eb41468 
The operator pod and the broker pods can run with a safer and restricted
security context without issues. Restricting the security context of the pods
by default allows to deploy a cluster of brokers also in Kubernetes namespaces
with the restricted policy.
brusdev added a commit to brusdev/activemq-artemis-operator that referenced this issue Feb 20, 2024
@brusdev
[artemiscloud#799] Restrict security context of pods by default
24c3268 
The operator pod and the broker pods can run with a safer and restricted
security context without issues. Restricting the security context of the pods
by default allows to deploy a cluster of brokers also in Kubernetes namespaces
with the restricted policy.
This was referenced Feb 20, 2024
Closed
Closed
brusdev added a commit to brusdev/activemq-artemis-operator that referenced this issue Feb 21, 2024
@brusdev
[artemiscloud#799] Restrict security context of pods by default
161a124 
The operator pod and the broker pods can run with a safer and restricted
security context without issues. Restricting the security context of the pods
by default allows to deploy a cluster of brokers also in Kubernetes namespaces
with the restricted policy.
brusdev added a commit that referenced this issue Feb 21, 2024
@brusdev
[#799] Restrict security context of pods by default
b0cbbe1 
The operator pod and the broker pods can run with a safer and restricted
security context without issues. Restricting the security context of the pods
by default allows to deploy a cluster of brokers also in Kubernetes namespaces
with the restricted policy.
@brusdev
Copy link
Contributor Author

brusdev commented Feb 21, 2024

The security context of pods will be restricted by default in 1.1.0

@brusdev brusdev closed this as completed Feb 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@brusdev