From 32d58b6fa3e96d326717b508397df5feecd0e734 Mon Sep 17 00:00:00 2001 From: John Gardiner Myers Date: Thu, 6 Feb 2020 12:10:16 -0800 Subject: [PATCH] Mark dns-controller and kops-controller as non-root --- .../dns-controller.addons.k8s.io/k8s-1.12.yaml.template | 2 ++ .../kops-controller.addons.k8s.io/k8s-1.16.yaml.template | 2 ++ .../tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml | 4 ++-- .../cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml | 2 ++ .../cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml | 2 ++ .../tests/bootstrapchannelbuilder/cilium/manifest.yaml | 4 ++-- .../simple/dns-controller.addons.k8s.io-k8s-1.12.yaml | 2 ++ .../simple/kops-controller.addons.k8s.io-k8s-1.16.yaml | 2 ++ .../tests/bootstrapchannelbuilder/simple/manifest.yaml | 4 ++-- .../cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml | 4 ++-- 10 files changed, 20 insertions(+), 8 deletions(-) diff --git a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template index 70ee091ab0839..d1002555ba035 100644 --- a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template +++ b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template @@ -56,6 +56,8 @@ spec: requests: cpu: 50m memory: 50Mi + securityContext: + runAsNonRoot: true --- diff --git a/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template b/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template index fd64777b99723..083c69375bef7 100644 --- a/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template +++ b/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template @@ -70,6 +70,8 @@ spec: requests: cpu: 50m memory: 50Mi + securityContext: + runAsNonRoot: true volumes: {{ if .UseHostCertificates }} - hostPath: diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml index 4ab91a1b9f366..64ea82c6cd0a1 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml @@ -7,7 +7,7 @@ spec: - id: k8s-1.16 kubernetesVersion: '>=1.16.0-alpha.0' manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml - manifestHash: cb89e5732aed2e90a8e06779102d32235fcdb6ec + manifestHash: 7997b2057867a9ff6b739f03c0e362a23f79ca5c name: kops-controller.addons.k8s.io selector: k8s-addon: kops-controller.addons.k8s.io @@ -83,7 +83,7 @@ spec: - id: k8s-1.12 kubernetesVersion: '>=1.12.0' manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml - manifestHash: 2b23a520e39d2c1dcd1a28933c6f6375b302f40f + manifestHash: a51d165920b21b203fd57f8b1f3f58641c4347c7 name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml index d705505e0fed1..abb54010343dc 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml @@ -35,6 +35,8 @@ spec: requests: cpu: 50m memory: 50Mi + securityContext: + runAsNonRoot: true dnsPolicy: Default hostNetwork: true nodeSelector: diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml index 81a3d2f7500a7..60734a90f660e 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml @@ -42,6 +42,8 @@ spec: requests: cpu: 50m memory: 50Mi + securityContext: + runAsNonRoot: true volumeMounts: - mountPath: /etc/kubernetes/kops-controller/ name: kops-controller-config diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml index aef6a95dcdbed..83500979c1956 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml @@ -7,7 +7,7 @@ spec: - id: k8s-1.16 kubernetesVersion: '>=1.16.0-alpha.0' manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml - manifestHash: cb89e5732aed2e90a8e06779102d32235fcdb6ec + manifestHash: 7997b2057867a9ff6b739f03c0e362a23f79ca5c name: kops-controller.addons.k8s.io selector: k8s-addon: kops-controller.addons.k8s.io @@ -83,7 +83,7 @@ spec: - id: k8s-1.12 kubernetesVersion: '>=1.12.0' manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml - manifestHash: 2b23a520e39d2c1dcd1a28933c6f6375b302f40f + manifestHash: a51d165920b21b203fd57f8b1f3f58641c4347c7 name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml index d705505e0fed1..abb54010343dc 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml @@ -35,6 +35,8 @@ spec: requests: cpu: 50m memory: 50Mi + securityContext: + runAsNonRoot: true dnsPolicy: Default hostNetwork: true nodeSelector: diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml index 81a3d2f7500a7..60734a90f660e 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml @@ -42,6 +42,8 @@ spec: requests: cpu: 50m memory: 50Mi + securityContext: + runAsNonRoot: true volumeMounts: - mountPath: /etc/kubernetes/kops-controller/ name: kops-controller-config diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml index d41f239304026..749b0162e3a3c 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml @@ -7,7 +7,7 @@ spec: - id: k8s-1.16 kubernetesVersion: '>=1.16.0-alpha.0' manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml - manifestHash: cb89e5732aed2e90a8e06779102d32235fcdb6ec + manifestHash: 7997b2057867a9ff6b739f03c0e362a23f79ca5c name: kops-controller.addons.k8s.io selector: k8s-addon: kops-controller.addons.k8s.io @@ -83,7 +83,7 @@ spec: - id: k8s-1.12 kubernetesVersion: '>=1.12.0' manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml - manifestHash: 2b23a520e39d2c1dcd1a28933c6f6375b302f40f + manifestHash: a51d165920b21b203fd57f8b1f3f58641c4347c7 name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml index b2c30954d5043..bb5db28963d27 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml @@ -7,7 +7,7 @@ spec: - id: k8s-1.16 kubernetesVersion: '>=1.16.0-alpha.0' manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml - manifestHash: cb89e5732aed2e90a8e06779102d32235fcdb6ec + manifestHash: 7997b2057867a9ff6b739f03c0e362a23f79ca5c name: kops-controller.addons.k8s.io selector: k8s-addon: kops-controller.addons.k8s.io @@ -83,7 +83,7 @@ spec: - id: k8s-1.12 kubernetesVersion: '>=1.12.0' manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml - manifestHash: 2b23a520e39d2c1dcd1a28933c6f6375b302f40f + manifestHash: a51d165920b21b203fd57f8b1f3f58641c4347c7 name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io