feat(security): enforce restricted security context defaults for all workloads

README.md

@@ -68,13 +68,17 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | cronJob.enabled | bool | `false` | Deploy CronJob resources. |
+| cronJob.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Default Security Context at pod level for all CronJobs. Can be overridden per job with `securityContext`. |
+| cronJob.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Default Security Context at container level for all CronJobs. Can be overridden per job with `containerSecurityContext`. |
 | cronJob.jobs | object, null | `nil` | Map of CronJob resources. Key will be used as a name suffix for the CronJob. Value is the CronJob configuration. See values for more details. |
 
 ### Job Parameters
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | job.enabled | bool | `false` | Deploy Job resources. |
+| job.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Default Security Context at pod level for all Jobs. Can be overridden per job with `securityContext`. |
+| job.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Default Security Context at container level for all Jobs. Can be overridden per job with `containerSecurityContext`. |
 | job.jobs | object, null | `nil` | Map of Job resources. Key will be used as a name suffix for the Job. Value is the Job configuration. See values for more details. |
 
 ### Deployment Parameters
@@ -142,13 +146,14 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to
 | deployment.livenessProbe.tcpSocket | object | `{}` | TCP Socket probe. |
 | deployment.livenessProbe.grpc | object | `{}` | gRPC probe. |
 | deployment.resources | object | `{}` | Resource limits and requests for the pod. |
-| deployment.containerSecurityContext | object, null | `{"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context at Container Level. |
+| deployment.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context at Container Level. |
 | deployment.openshiftOAuthProxy.enabled | bool | `false` | Enable [OpenShift OAuth Proxy](https://github.com/openshift/oauth-proxy). |
 | deployment.openshiftOAuthProxy.port | int | `8080` | Port on which application is running inside container. |
+| deployment.openshiftOAuthProxy.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context for the OAuth Proxy container. |
 | deployment.openshiftOAuthProxy.secretName | string | `"openshift-oauth-proxy-tls"` | Secret name for the OAuth Proxy TLS certificate. |
 | deployment.openshiftOAuthProxy.image | string | `"quay.io/openshift/origin-oauth-proxy:latest@sha256:35967c4d152d7b21167e3ba0aae57e29d3a46a75a738329073ef2227cbc33bde"` | Image for the OAuth Proxy. |
 | deployment.openshiftOAuthProxy.disableTLSArg | bool | `false` | If disabled `--http-address=:8081` will be used instead of `--https-address=:8443`. It can be useful when an ingress is enabled for the application. |
-| deployment.securityContext | object, null | `nil` | Security Context for the pod. |
+| deployment.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Security Context for the pod. |
 | deployment.command | list | `[]` | Command for the app container. |
 | deployment.args | list | `[]` | Args for the app container. |
 | deployment.automountServiceAccountToken | bool | `false` | Mount Service Account token. |

application/templates/cronjob.yaml

@@ -69,6 +69,12 @@ spec:
           {{- range $key, $value := . }}
           - name: {{ $key }}
             {{- dict "value" (omit $value "name") "context" $ | include "application.tplvalues.render" | nindent 12 }}
+            {{- if not (hasKey $value "securityContext") }}
+            {{- with $job.containerSecurityContext | default $.Values.cronJob.containerSecurityContext }}
+            securityContext:
+              {{- toYaml . | nindent 14 }}
+            {{- end }}
+            {{- end }}
           {{- end }}
           {{- end }}
           containers:
@@ -135,7 +141,7 @@ spec:
             volumeMounts:
 {{ toYaml . | indent 12 }}
             {{- end }}
-            {{- with $job.containerSecurityContext }}
+            {{- with $job.containerSecurityContext | default $.Values.cronJob.containerSecurityContext }}
             securityContext:
               {{- toYaml . | nindent 14 }}
             {{- end }}
@@ -165,7 +171,7 @@ spec:
           imagePullSecrets:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- with $job.securityContext }}
+          {{- with $job.securityContext | default $.Values.cronJob.securityContext }}
           securityContext:
             {{- toYaml . | nindent 12 }}
           {{- end }}

application/templates/deployment.yaml

@@ -86,6 +86,12 @@ spec:
   {{- range $key, $value := .Values.deployment.initContainers }}
       - name: {{ $key }}
 {{ include "application.tplvalues.render" ( dict "value" $value "context" $ ) | indent 8 }}
+        {{- if not (hasKey $value "securityContext") }}
+        {{- with $.Values.deployment.containerSecurityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        {{- end }}
       {{- end }}
       {{- end }}
       {{- if .Values.deployment.nodeSelector }}
@@ -138,6 +144,10 @@ spec:
         - containerPort: 8443
         {{- end }}
           name: proxy
+        {{- with .Values.deployment.openshiftOAuthProxy.containerSecurityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
         volumeMounts:
         - mountPath: /etc/tls/private
           name: proxy-tls
@@ -297,10 +307,18 @@ spec:
         {{- $containers := . }}
         {{- range $name := keys . | sortAlpha }}
         {{- $container := index $containers $name }}
+        {{- if and (not (hasKey $container "securityContext")) $.Values.deployment.containerSecurityContext }}
+        {{- $container = merge (dict "securityContext" $.Values.deployment.containerSecurityContext) $container }}
+        {{- end }}
       - {{- merge (dict "name" $name) $container | toYaml | nindent 8 }}
         {{- end }}
         {{- else }}
-{{ toYaml . | indent 6 }}
+        {{- range $container := . }}
+        {{- if and (not (hasKey $container "securityContext")) $.Values.deployment.containerSecurityContext }}
+        {{- $container = merge (dict "securityContext" $.Values.deployment.containerSecurityContext) $container }}
+        {{- end }}
+      - {{- $container | toYaml | nindent 8 }}
+        {{- end }}
         {{- end }}
         {{- end }}
         {{- if .Values.deployment.securityContext }}

application/templates/job.yaml

@@ -49,6 +49,12 @@ spec:
       {{- range $key, $value := . }}
       - name: {{ $key }}
         {{- dict "value" (omit $value "name") "context" $ | include "application.tplvalues.render" | nindent 8 }}
+        {{- if not (hasKey $value "securityContext") }}
+        {{- with $job.containerSecurityContext | default $.Values.job.containerSecurityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        {{- end }}
       {{- end }}
       {{- end }}
       containers:
@@ -111,7 +117,7 @@ spec:
         resources:
 {{ toYaml . | indent 10 }}
         {{- end }}
-        {{- with $job.containerSecurityContext }}
+        {{- with $job.containerSecurityContext | default $.Values.job.containerSecurityContext }}
         securityContext:
           {{- toYaml . | nindent 10 }}
         {{- end }}
@@ -133,7 +139,7 @@ spec:
       {{- with $job.topologySpreadConstraints }}
       topologySpreadConstraints: {{ toYaml . | nindent 8 }}
       {{- end }}
-      {{- with $job.securityContext }}
+      {{- with $job.securityContext | default $.Values.job.securityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}

application/tests/__snapshot__/common_test.yaml.snap

@@ -399,6 +399,13 @@ should match snapshot:
               ports:
                 - containerPort: 8443
                   name: proxy
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
               volumeMounts:
                 - mountPath: /etc/tls/private
                   name: proxy-tls

application/tests/cronjob_test.yaml

@@ -213,11 +213,13 @@ tests:
           content:
             name: example1
             image: another-example-registry/another-example-image:another-example-tag
+          any: true
       - contains:
           path: spec.jobTemplate.spec.template.spec.initContainers
           content:
             name: example2
             image: another-example-registry/another-example-image:another-example-tag
+          any: true
       - notContains:
           path: spec.jobTemplate.spec.template.spec.initContainers
           content:
@@ -398,7 +400,7 @@ tests:
           path: spec.jobTemplate.spec.template.spec.serviceAccountName
           value: example-app
 
-  - it: does not include container security context by default
+  - it: applies the default security context to init containers unless overridden
     set:
       cronJob:
         enabled: true
@@ -407,9 +409,53 @@ tests:
             image:
               repository: example-registry/example-image
               tag: example-tag
+            initContainers:
+              plain:
+                image: busybox
+              custom:
+                image: busybox
+                securityContext:
+                  runAsNonRoot: false
     asserts:
-      - notExists:
+      - contains:
+          path: spec.jobTemplate.spec.template.spec.initContainers
+          content:
+            name: plain
+            image: busybox
+            securityContext:
+              readOnlyRootFilesystem: true
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+      - contains:
+          path: spec.jobTemplate.spec.template.spec.initContainers
+          content:
+            name: custom
+            image: busybox
+            securityContext:
+              runAsNonRoot: false
+
+  - it: applies a restricted container security context by default
+    set:
+      cronJob:
+        enabled: true
+        jobs:
+          example:
+            image:
+              repository: example-registry/example-image
+              tag: example-tag
+    asserts:
+      - equal:
           path: spec.jobTemplate.spec.template.spec.containers[0].securityContext
+          value:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
 
   - it: enable container security context when configured
     set:
@@ -465,7 +511,7 @@ tests:
           path: spec.jobTemplate.spec.template.spec.automountServiceAccountToken
           value: true
 
-  - it: does not include pod security context by default
+  - it: applies the runtime default seccomp profile at pod level by default
     set:
       cronJob:
         enabled: true
@@ -475,8 +521,11 @@ tests:
               repository: example-registry/example-image
               tag: example-tag
     asserts:
-      - notExists:
+      - equal:
           path: spec.jobTemplate.spec.template.spec.securityContext
+          value:
+            seccompProfile:
+              type: RuntimeDefault
 
   - it: enable pod security context when configured
     set:

application/tests/deployment_test.yaml

@@ -8,6 +8,103 @@ set:
   deployment.image.tag: example-tag
 
 tests:
+  - it: applies a restricted container security context by default
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext
+          value:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+
+  - it: applies the default security context to init containers unless overridden
+    set:
+      deployment.initContainers:
+        plain:
+          image: busybox
+        custom:
+          image: busybox
+          securityContext:
+            runAsNonRoot: false
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers
+          content:
+            name: plain
+            image: busybox
+            securityContext:
+              readOnlyRootFilesystem: true
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+      - contains:
+          path: spec.template.spec.initContainers
+          content:
+            name: custom
+            image: busybox
+            securityContext:
+              runAsNonRoot: false
+
+  - it: applies the default security context to additional containers unless overridden
+    set:
+      deployment.additionalContainers:
+        plain:
+          image: busybox
+        custom:
+          image: busybox
+          securityContext:
+            runAsNonRoot: false
+    asserts:
+      - contains:
+          path: spec.template.spec.containers
+          content:
+            name: plain
+            image: busybox
+            securityContext:
+              readOnlyRootFilesystem: true
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+      - contains:
+          path: spec.template.spec.containers
+          content:
+            name: custom
+            image: busybox
+            securityContext:
+              runAsNonRoot: false
+
+  - it: applies the runtime default seccomp profile at pod level by default
+    asserts:
+      - equal:
+          path: spec.template.spec.securityContext
+          value:
+            seccompProfile:
+              type: RuntimeDefault
+
+  - it: applies a restricted security context to the OAuth proxy container
+    set:
+      deployment.openshiftOAuthProxy.enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].name
+          value: oauth-proxy
+      - equal:
+          path: spec.template.spec.containers[0].securityContext
+          value:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+
   - it: does not include OAuth proxy container if disabled
     set:
       deployment.openshiftOAuthProxy.enabled: false