#802 Secure controller by avoiding priv esc

[ioannis-matzaris]

Description of the change

• Change the uid in the docker image
• Change the defaults for runAsUser & runAsGroup to 10001
• Change the allowPrivilegeEscalation to false
• Update the helm chart

Benefits

• https://avd.aquasec.com/misconfig/kubernetes/ksv001/
• https://avd.aquasec.com/misconfig/kubernetes/ksv020/
• https://avd.aquasec.com/misconfig/kubernetes/ksv021/

Possible drawbacks

Applicable issues

• fixes Secure the Controller by avoiding privilege escalation issue #802

Additional information

[github-actions]

This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution.

[alvneiayu]

thanks @IoannisMatzaris

We are investigating your change. I will come back asap.

Álvaro

[github-actions]

This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution.

[github-actions]

This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution.

[alvneiayu]

hi @IoannisMatzaris

First of all, thanks a lot for your time and your PR. The PR has some conflicts and I included a question and a comment.

Thanks a lot again

Álvaro

[alvneiayu]

You are including the allowPrivilegeEscalation in the values yaml but you must change the psp.yaml to include the logic to use the value that you are setting up in the values.yaml

[alvneiayu]

question: this 10001 user still belongs to root group?

[github-actions]

This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution.

[github-actions]

Due to the lack of activity in the last 7 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary.

[R011y]

@JorgeN118 Did this change get merged after all? Currently trying to determine if users can safely set allowPrivilegeEscalation: false for sealed-secrets controller manifests.

[R011y]

Any update here @agarcia-oss ?? Would be good to know if the controller.yaml can support this now.

[alvneiayu]

hi @R011y

We requested some information and changes to the user and we didn't receive answer from them. This is not already included.
We are open to continue working on this, do you want to help us contributing in this PR ? (creating a new PR maybe it is better)

Thanks a lot

Álvaro

[alvneiayu]

BTW, if you are using the generated yaml that we are releasing, we have included: #1261. Maybe it solves your problems