Skip to content

Commit

Permalink
Set pod security labels on root, org and space namespaces
Browse files Browse the repository at this point in the history 
Issue: #1220
Co-authored-by: Danail Branekov <danailster@gmail.com>
  • Loading branch information
@danail-branekov
Kieron Browne and danail-branekov committed Jun 27, 2022
1 parent 73cf1ed commit 45d916c
Show file tree
Hide file tree
Showing 7 changed files with 42 additions and 1 deletion.
8 changes: 8 additions & 0 deletions INSTALL.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,14 @@ Create the root namespace:
kubectl create namespace $ROOT_NAMESPACE
```

All korifi namespaces are created with the [restricted Pod Security labels](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/). For consistency, apply these to the root namespace:

```sh
kubectl label namespaces $ROOT_NAMESPACE \
pod-security.kubernetes.io/enforce=restricted \
pod-security.kubernetes.io/warn=restricted
```

Bind `$ADMIN_USERNAME` to the admin role:

```sh
Expand Down
10 changes: 10 additions & 0 deletions controllers/controllers/workloads/integration/cforg_controller_integration_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
"k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/pod-security-admission/api"
"sigs.k8s.io/controller-runtime/pkg/client"

korifiv1alpha1 "code.cloudfoundry.org/korifi/controllers/api/v1alpha1"
Expand Down Expand Up @@ -169,6 +170,15 @@ var _ = Describe("CFOrgReconciler Integration Tests", func() {
g.Expect(meta.IsStatusConditionTrue(createdOrg.Status.Conditions, "Ready")).To(BeTrue())
}).Should(Succeed())
})

It("sets restricted pod security labels on the namespace", func() {
Eventually(func(g Gomega) {
var ns v1.Namespace
g.Expect(k8sClient.Get(testCtx, types.NamespacedName{Name: orgGUID}, &ns)).To(Succeed())
g.Expect(ns.Labels).To(HaveKeyWithValue(api.EnforceLevelLabel, string(api.LevelRestricted)))
g.Expect(ns.Labels).To(HaveKeyWithValue(api.EnforceLevelLabel, string(api.LevelRestricted)))
}).Should(Succeed())
})
})

When("roles are added/updated in root-ns after CFOrg creation", func() {
Expand Down
10 changes: 10 additions & 0 deletions controllers/controllers/workloads/integration/cfspace_controller_integration_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
"k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/pod-security-admission/api"
"sigs.k8s.io/controller-runtime/pkg/client"

korifiv1alpha1 "code.cloudfoundry.org/korifi/controllers/api/v1alpha1"
Expand Down Expand Up @@ -186,6 +187,15 @@ var _ = Describe("CFSpaceReconciler Integration Tests", func() {
g.Expect(meta.IsStatusConditionTrue(createdSpace.Status.Conditions, "Ready")).To(BeTrue())
}).Should(Succeed())
})

It("sets restricted pod security labels on the namespace", func() {
Eventually(func(g Gomega) {
var ns corev1.Namespace
g.Expect(k8sClient.Get(ctx, types.NamespacedName{Name: cfSpace.Name}, &ns)).To(Succeed())
g.Expect(ns.Labels).To(HaveKeyWithValue(api.EnforceLevelLabel, string(api.LevelRestricted)))
g.Expect(ns.Labels).To(HaveKeyWithValue(api.EnforceLevelLabel, string(api.LevelRestricted)))
}).Should(Succeed())
})
})

When("roles are added/updated in CFOrg namespace after CFSpace creation", func() {
Expand Down
4 changes: 4 additions & 0 deletions controllers/controllers/workloads/shared.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/types"
"k8s.io/pod-security-admission/api"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
Expand Down Expand Up @@ -55,6 +56,9 @@ func createOrPatchNamespace(ctx context.Context, client client.Client, log logr.
for key, value := range labels {
namespace.Labels[key] = value
}
namespace.Labels[api.EnforceLevelLabel] = string(api.LevelRestricted)
namespace.Labels[api.AuditLevelLabel] = string(api.LevelRestricted)

return nil
})
if err != nil {
Expand Down
3 changes: 3 additions & 0 deletions dependencies/cf-setup.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ apiVersion: v1
kind: Namespace
metadata:
name: cf
labels:
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/audit: restricted

---
apiVersion: rbac.authorization.k8s.io/v1
Expand Down
3 changes: 2 additions & 1 deletion go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ require (
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
google.golang.org/genproto v0.0.0-20220422154200-b37d22cd5731 // indirect
google.golang.org/grpc v1.46.0 // indirect
k8s.io/pod-security-admission v0.24.2 // indirect
)

require (
Expand Down Expand Up @@ -131,7 +132,7 @@ require (
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
k8s.io/apiextensions-apiserver v0.24.1 // indirect
k8s.io/component-base v0.24.1 // indirect
k8s.io/component-base v0.24.2 // indirect
k8s.io/klog/v2 v2.60.1 // indirect
k8s.io/kube-openapi v0.0.0-20220603121420-31174f50af60 // indirect
k8s.io/legacy-cloud-providers v0.19.7 // indirect
Expand Down
5 changes: 5 additions & 0 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3250,6 +3250,7 @@ k8s.io/apiserver v0.21.3/go.mod h1:eDPWlZG6/cCCMj/JBcEpDoK+I+6i3r9GsChYBHSbAzU=
k8s.io/apiserver v0.22.5/go.mod h1:s2WbtgZAkTKt679sYtSudEQrTGWUSQAPe6MupLnlmaQ=
k8s.io/apiserver v0.23.0/go.mod h1:Cec35u/9zAepDPPFyT+UMrgqOCjgJ5qtfVJDxjZYmt4=
k8s.io/apiserver v0.24.1/go.mod h1:dQWNMx15S8NqJMp0gpYfssyvhYnkilc1LpExd/dkLh0=
k8s.io/apiserver v0.24.2/go.mod h1:pSuKzr3zV+L+MWqsEo0kHHYwCo77AT5qXbFXP2jbvFI=
k8s.io/cli-runtime v0.21.0/go.mod h1:XoaHP93mGPF37MkLbjGVYqg3S1MnsFdKtiA/RZzzxOo=
k8s.io/cli-runtime v0.21.3/go.mod h1:h65y0uXIXDnNjd5J+F3CvQU3ZNplH4+rjqbII7JkD4A=
k8s.io/client-go v0.18.0/go.mod h1:uQSYDYs4WhVZ9i6AIoEZuwUggLVEF64HOD37boKAtF8=
Expand Down Expand Up @@ -3300,6 +3301,8 @@ k8s.io/component-base v0.22.5/go.mod h1:VK3I+TjuF9eaa+Ln67dKxhGar5ynVbwnGrUiNF4M
k8s.io/component-base v0.23.0/go.mod h1:DHH5uiFvLC1edCpvcTDV++NKULdYYU6pR9Tt3HIKMKI=
k8s.io/component-base v0.24.1 h1:APv6W/YmfOWZfo+XJ1mZwep/f7g7Tpwvdbo9CQLDuts=
k8s.io/component-base v0.24.1/go.mod h1:DW5vQGYVCog8WYpNob3PMmmsY8A3L9QZNg4j/dV3s38=
k8s.io/component-base v0.24.2 h1:kwpQdoSfbcH+8MPN4tALtajLDfSfYxBDYlXobNWI6OU=
k8s.io/component-base v0.24.2/go.mod h1:ucHwW76dajvQ9B7+zecZAP3BVqvrHoOxm8olHEg0nmM=
k8s.io/component-helpers v0.21.0/go.mod h1:tezqefP7lxfvJyR+0a+6QtVrkZ/wIkyMLK4WcQ3Cj8U=
k8s.io/component-helpers v0.21.3/go.mod h1:FJCpEhM9fkKvNN0QAl33ozmMj+Bx8R64wcOBqhng0oQ=
k8s.io/cri-api v0.17.3/go.mod h1:X1sbHmuXhwaHs9xxYffLqJogVsnI+f6cPRcgPel7ywM=
Expand Down Expand Up @@ -3352,6 +3355,8 @@ k8s.io/metrics v0.21.0/go.mod h1:L3Ji9EGPP1YBbfm9sPfEXSpnj8i24bfQbAFAsW0NueQ=
k8s.io/metrics v0.21.3/go.mod h1:mN3Klf203Lw1hOsfg1MG7DR/kKUhwiyu8GSFCXZdz+o=
k8s.io/metrics v0.24.2 h1:3lgEq973VGPWAEaT9VI/p0XmI0R5kJgb/r9Ufr5fz8k=
k8s.io/metrics v0.24.2/go.mod h1:5NWURxZ6Lz5gj8TFU83+vdWIVASx7W8lwPpHYCqopMo=
k8s.io/pod-security-admission v0.24.2 h1:Wl92TCvxsqba+kDK59Dnf/qIsSoP1ekRlj5qT1XEmNk=
k8s.io/pod-security-admission v0.24.2/go.mod h1:znnuDHWWWvh/tpbYYPwTsd4y//qHi3cOX+wGxET/mMI=
k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
k8s.io/utils v0.0.0-20200729134348-d5654de09c73/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
Expand Down

0 comments on commit 45d916c

Please sign in to comment.