Skip to content

Commit

Permalink
feat: podSecurity configuration for init-containers (#6361)
Browse files Browse the repository at this point in the history 
feat: added restricted pss for thanos and alertmanager inti loader
  • Loading branch information
@yp969803
yp969803 committed May 16, 2024
1 parent 48444eb commit a61005c
Show file tree
Hide file tree
Showing 16 changed files with 221 additions and 112 deletions.
3 changes: 2 additions & 1 deletion pkg/alertmanager/operator.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -615,8 +615,9 @@ func (c *Operator) sync(ctx context.Context, key string) error {
if err != nil {
return err
}
podSecurityLabel := k8sutil.GetPodSecurityLabel(am.Namespace, ctx, c.kclient)

sset, err := makeStatefulSet(logger, am, c.config, newSSetInputHash, tlsShardedSecret)
sset, err := makeStatefulSet(logger, am, c.config, newSSetInputHash, tlsShardedSecret, podSecurityLabel)
if err != nil {
return fmt.Errorf("failed to generate statefulset: %w", err)
}
Expand Down
8 changes: 5 additions & 3 deletions pkg/alertmanager/statefulset.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ var (
probeTimeoutSeconds int32 = 3
)

func makeStatefulSet(logger log.Logger, am *monitoringv1.Alertmanager, config Config, inputHash string, tlsSecrets *operator.ShardedSecret) (*appsv1.StatefulSet, error) {
func makeStatefulSet(logger log.Logger, am *monitoringv1.Alertmanager, config Config, inputHash string, tlsSecrets *operator.ShardedSecret, podSecurityLabel *string) (*appsv1.StatefulSet, error) {
// TODO(fabxc): is this the right point to inject defaults?
// Ideally we would do it before storing but that's currently not possible.
// Potentially an update handler on first insertion.
Expand All @@ -94,7 +94,7 @@ func makeStatefulSet(logger log.Logger, am *monitoringv1.Alertmanager, config Co
am.Spec.Resources.Requests[v1.ResourceMemory] = resource.MustParse("200Mi")
}

spec, err := makeStatefulSetSpec(logger, am, config, tlsSecrets)
spec, err := makeStatefulSetSpec(logger, am, config, tlsSecrets, podSecurityLabel)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -218,7 +218,7 @@ func makeStatefulSetService(a *monitoringv1.Alertmanager, config Config) *v1.Ser
return svc
}

func makeStatefulSetSpec(logger log.Logger, a *monitoringv1.Alertmanager, config Config, tlsSecrets *operator.ShardedSecret) (*appsv1.StatefulSetSpec, error) {
func makeStatefulSetSpec(logger log.Logger, a *monitoringv1.Alertmanager, config Config, tlsSecrets *operator.ShardedSecret, podSecurityLabel *string) (*appsv1.StatefulSetSpec, error) {
amVersion := operator.StringValOrDefault(a.Spec.Version, operator.DefaultAlertmanagerVersion)
amImagePath, err := operator.BuildImagePath(
operator.StringPtrValOrDefault(a.Spec.Image, ""),
Expand Down Expand Up @@ -710,6 +710,7 @@ func makeStatefulSetSpec(logger log.Logger, a *monitoringv1.Alertmanager, config
},
operator.CreateConfigReloader(
"config-reloader",
podSecurityLabel,
operator.ReloaderConfig(config.ReloaderConfig),
operator.ReloaderURL(url.URL{
Scheme: alertmanagerURIScheme,
Expand Down Expand Up @@ -743,6 +744,7 @@ func makeStatefulSetSpec(logger log.Logger, a *monitoringv1.Alertmanager, config
operatorInitContainers = append(operatorInitContainers,
operator.CreateConfigReloader(
"init-config-reloader",
podSecurityLabel,
operator.ReloaderConfig(config.ReloaderConfig),
operator.ReloaderRunOnce(),
operator.LogFormat(a.Spec.LogFormat),
Expand Down
74 changes: 37 additions & 37 deletions pkg/alertmanager/statefulset_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ func TestStatefulSetLabelingAndAnnotations(t *testing.T) {
Labels: labels,
Annotations: annotations,
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)

require.NoError(t, err)

Expand Down Expand Up @@ -108,7 +108,7 @@ func TestStatefulSetStoragePath(t *testing.T) {
Labels: labels,
Annotations: annotations,
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)

require.NoError(t, err)

Expand Down Expand Up @@ -141,7 +141,7 @@ func TestPodLabelsAnnotations(t *testing.T) {
Labels: labels,
},
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
require.NoError(t, err)
if val, ok := sset.Spec.Template.ObjectMeta.Labels["testlabel"]; !ok || val != "testvalue" {
t.Fatal("Pod labels are not properly propagated")
Expand All @@ -162,7 +162,7 @@ func TestPodLabelsShouldNotBeSelectorLabels(t *testing.T) {
Labels: labels,
},
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)

require.NoError(t, err)

Expand Down Expand Up @@ -201,7 +201,7 @@ func TestStatefulSetPVC(t *testing.T) {
VolumeClaimTemplate: pvc,
},
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)

require.NoError(t, err)
ssetPvc := sset.Spec.VolumeClaimTemplates[0]
Expand Down Expand Up @@ -232,7 +232,7 @@ func TestStatefulEmptyDir(t *testing.T) {
EmptyDir: &emptyDir,
},
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)

require.NoError(t, err)
ssetVolumes := sset.Spec.Template.Spec.Volumes
Expand Down Expand Up @@ -270,7 +270,7 @@ func TestStatefulSetEphemeral(t *testing.T) {
Ephemeral: &ephemeral,
},
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)

require.NoError(t, err)
ssetVolumes := sset.Spec.Template.Spec.Volumes
Expand All @@ -285,7 +285,7 @@ func TestListenLocal(t *testing.T) {
Spec: monitoringv1.AlertmanagerSpec{
ListenLocal: true,
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand Down Expand Up @@ -336,7 +336,7 @@ func TestListenTLS(t *testing.T) {
},
},
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand Down Expand Up @@ -421,7 +421,7 @@ func TestMakeStatefulSetSpecSingleDoubleDashedArgs(t *testing.T) {
replicas := int32(3)
a.Spec.Replicas = &replicas

statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand All @@ -442,7 +442,7 @@ func TestMakeStatefulSetSpecWebRoutePrefix(t *testing.T) {
a.Spec.Version = operator.DefaultAlertmanagerVersion
a.Spec.Replicas = &replicas

statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -499,7 +499,7 @@ func TestMakeStatefulSetSpecWebTimeout(t *testing.T) {
a.Spec.Version = ts.version
a.Spec.Web = ts.web

ss, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
ss, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -551,7 +551,7 @@ func TestMakeStatefulSetSpecWebConcurrency(t *testing.T) {
a.Spec.Version = ts.version
a.Spec.Web = ts.web

ss, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
ss, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand All @@ -578,7 +578,7 @@ func TestMakeStatefulSetSpecPeersWithoutClusterDomain(t *testing.T) {
},
}

statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -613,7 +613,7 @@ func TestMakeStatefulSetSpecPeersWithClusterDomain(t *testing.T) {
configWithClusterDomain := defaultTestConfig
configWithClusterDomain.ClusterDomain = "custom.cluster"

statefulSet, err := makeStatefulSetSpec(nil, &a, configWithClusterDomain, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, configWithClusterDomain, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand All @@ -639,7 +639,7 @@ func TestMakeStatefulSetSpecAdditionalPeers(t *testing.T) {
a.Spec.Replicas = &replicas
a.Spec.AdditionalPeers = []string{"example.com"}

statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -676,7 +676,7 @@ func TestMakeStatefulSetSpecNotificationTemplates(t *testing.T) {
},
},
}
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -711,7 +711,7 @@ func TestAdditionalSecretsMounted(t *testing.T) {
Spec: monitoringv1.AlertmanagerSpec{
Secrets: secrets,
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
require.NoError(t, err)

secret1Found := false
Expand Down Expand Up @@ -765,7 +765,7 @@ func TestAlertManagerDefaultBaseImageFlag(t *testing.T) {
Labels: labels,
Annotations: annotations,
},
}, alertManagerBaseImageConfig, "", &operator.ShardedSecret{})
}, alertManagerBaseImageConfig, "", &operator.ShardedSecret{}, nil)

require.NoError(t, err)

Expand All @@ -783,7 +783,7 @@ func TestSHAAndTagAndVersion(t *testing.T) {
Tag: "my-unrelated-tag",
Version: "v0.15.3",
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand All @@ -801,7 +801,7 @@ func TestSHAAndTagAndVersion(t *testing.T) {
Tag: "my-unrelated-tag",
Version: "v0.15.3",
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand All @@ -821,7 +821,7 @@ func TestSHAAndTagAndVersion(t *testing.T) {
Version: "v0.15.3",
Image: &image,
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand All @@ -848,7 +848,7 @@ func TestRetention(t *testing.T) {
Spec: monitoringv1.AlertmanagerSpec{
Retention: test.specRetention,
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand All @@ -874,7 +874,7 @@ func TestAdditionalConfigMap(t *testing.T) {
Spec: monitoringv1.AlertmanagerSpec{
ConfigMaps: []string{"test-cm1"},
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand Down Expand Up @@ -912,7 +912,7 @@ func TestSidecarResources(t *testing.T) {
Spec: monitoringv1.AlertmanagerSpec{},
}

sset, err := makeStatefulSet(nil, am, testConfig, "", &operator.ShardedSecret{})
sset, err := makeStatefulSet(nil, am, testConfig, "", &operator.ShardedSecret{}, nil)
require.NoError(t, err)
return sset
})
Expand All @@ -921,7 +921,7 @@ func TestSidecarResources(t *testing.T) {
func TestTerminationPolicy(t *testing.T) {
sset, err := makeStatefulSet(nil, &monitoringv1.Alertmanager{
Spec: monitoringv1.AlertmanagerSpec{},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand All @@ -939,7 +939,7 @@ func TestClusterListenAddressForSingleReplica(t *testing.T) {
a.Spec.Version = operator.DefaultAlertmanagerVersion
a.Spec.Replicas = &replicas

statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand All @@ -966,7 +966,7 @@ func TestClusterListenAddressForSingleReplicaWithForceEnableClusterMode(t *testi
a.Spec.Replicas = &replicas
a.Spec.ForceEnableClusterMode = true

statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand All @@ -992,7 +992,7 @@ func TestClusterListenAddressForMultiReplica(t *testing.T) {
a.Spec.Version = operator.DefaultAlertmanagerVersion
a.Spec.Replicas = &replicas

statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand All @@ -1019,7 +1019,7 @@ func TestExpectStatefulSetMinReadySeconds(t *testing.T) {
a.Spec.Replicas = &replicas

// assert defaults to zero if nil
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand All @@ -1030,7 +1030,7 @@ func TestExpectStatefulSetMinReadySeconds(t *testing.T) {
// assert set correctly if not nil
var expect uint32 = 5
a.Spec.MinReadySeconds = &expect
statefulSet, err = makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
statefulSet, err = makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -1095,7 +1095,7 @@ func TestPodTemplateConfig(t *testing.T) {
ImagePullSecrets: imagePullSecrets,
ImagePullPolicy: imagePullPolicy,
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand Down Expand Up @@ -1137,7 +1137,7 @@ func TestPodTemplateConfig(t *testing.T) {
}

func TestConfigReloader(t *testing.T) {
baseSet, err := makeStatefulSet(nil, &monitoringv1.Alertmanager{}, defaultTestConfig, "", &operator.ShardedSecret{})
baseSet, err := makeStatefulSet(nil, &monitoringv1.Alertmanager{}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
require.NoError(t, err)

expectedArgsConfigReloader := []string{
Expand Down Expand Up @@ -1180,7 +1180,7 @@ func TestAutomountServiceAccountToken(t *testing.T) {
Spec: monitoringv1.AlertmanagerSpec{
AutomountServiceAccountToken: &automountServiceAccountToken,
},
}, defaultTestConfig, "", &operator.ShardedSecret{})
}, defaultTestConfig, "", &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatalf("Unexpected error while making StatefulSet: %v", err)
}
Expand Down Expand Up @@ -1228,7 +1228,7 @@ func TestClusterLabel(t *testing.T) {
a.Spec.ClusterLabel = &ts.customClusterLabel
}

ss, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{})
ss, err := makeStatefulSetSpec(nil, &a, defaultTestConfig, &operator.ShardedSecret{}, nil)
require.NoError(t, err)

args := ss.Template.Spec.Containers[0].Args
Expand Down Expand Up @@ -1330,7 +1330,7 @@ func TestMakeStatefulSetSpecTemplatesUniqueness(t *testing.T) {
}

for _, test := range tt {
statefulSpec, err := makeStatefulSetSpec(log.NewNopLogger(), &test.a, defaultTestConfig, &operator.ShardedSecret{})
statefulSpec, err := makeStatefulSetSpec(log.NewNopLogger(), &test.a, defaultTestConfig, &operator.ShardedSecret{}, nil)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -1390,7 +1390,7 @@ func TestEnableFeatures(t *testing.T) {
Replicas: toPtr(int32(1)),
EnableFeatures: test.features,
},
}, defaultTestConfig, &operator.ShardedSecret{})
}, defaultTestConfig, &operator.ShardedSecret{}, nil)
require.NoError(t, err)

expectedFeatures := make([]string, 0)
Expand Down
Loading

0 comments on commit a61005c

Please sign in to comment.