set user group and user id for the default SecurityContext (envoyprox…

…y#4313) set user group and user id Signed-off-by: Huabing Zhao <[email protected]>
guydc · Sep 24, 2024 · bd966b8 · bd966b8
1 parent 7dfa857
commit bd966b8
Show file tree

Hide file tree

Showing 46 changed files with 154 additions and 0 deletions.
diff --git a/charts/gateway-helm/templates/envoy-gateway-deployment.yaml b/charts/gateway-helm/templates/envoy-gateway-deployment.yaml
@@ -82,6 +82,8 @@ spec:
             - ALL
           privileged: false
           runAsNonRoot: true
+          runAsGroup: 65532
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         volumeMounts:

diff --git a/internal/infrastructure/kubernetes/proxy/resource.go b/internal/infrastructure/kubernetes/proxy/resource.go
@@ -447,13 +447,23 @@ func expectedEnvoySecurityContext(containerSpec *egv1a1.KubernetesContainerSpec)
 	}
 
 	sc := resource.DefaultSecurityContext()
+
+	// run as non-root user
+	sc.RunAsGroup = ptr.To(int64(65532))
+	sc.RunAsUser = ptr.To(int64(65532))
+
 	// Envoy container needs to write to the log file/UDS socket.
 	sc.ReadOnlyRootFilesystem = nil
 	return sc
 }
 
 func expectedShutdownManagerSecurityContext() *corev1.SecurityContext {
 	sc := resource.DefaultSecurityContext()
+
+	// run as non-root user
+	sc.RunAsGroup = ptr.To(int64(65532))
+	sc.RunAsUser = ptr.To(int64(65532))
+
 	// ShutdownManger creates a file to indicate the connection drain process is completed,
 	// so it needs file write permission.
 	sc.ReadOnlyRootFilesystem = nil

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml
@@ -94,7 +94,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -168,7 +170,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
@@ -347,7 +347,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
@@ -346,7 +346,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
@@ -261,7 +261,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -335,7 +337,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
@@ -232,7 +232,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -306,7 +308,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
@@ -350,7 +350,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/.../infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml b/.../infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
@@ -270,7 +270,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -344,7 +346,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
@@ -261,7 +261,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -335,7 +337,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
@@ -261,7 +261,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -345,6 +347,7 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 1234
           seccompProfile:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
@@ -350,7 +350,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
@@ -266,7 +266,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -340,7 +342,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml
@@ -94,7 +94,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -168,7 +170,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
@@ -263,7 +263,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -337,7 +339,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
@@ -261,7 +261,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -335,7 +337,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
@@ -261,7 +261,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -335,7 +337,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
@@ -261,7 +261,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -335,7 +337,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/...infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml b/...infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
@@ -261,7 +261,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -335,7 +337,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
@@ -97,7 +97,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -171,7 +173,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
@@ -98,7 +98,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:
@@ -172,7 +174,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -352,7 +352,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe:

diff --git a/...rnal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/...rnal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -354,7 +354,9 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsGroup: 65532
           runAsNonRoot: true
+          runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
         startupProbe: