Repository navigation
feat!(security): addition of security context to allow CIS compliance - #3
Closed
ferdiekrammer wants to merge 1 commit into
Closed
ferdiekrammer wants to merge 1 commit into
ferdiekrammer wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds pod and container security-context helpers to the common Helm chart to support CIS-oriented hardening defaults.
Changes:
- Splits pod security context into
common.security.podContextwhile preservingcommon.security.context. - Adds
common.security.containerContextand includes it in the common container template. - Adds
temp.yamlto the common chart.helmignore.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
charts/common/templates/_security_context.yaml |
Adds pod/container security context templating and defaults. |
charts/common/templates/_container.yaml |
Includes the new container security context in rendered containers. |
charts/common/.helmignore |
Ignores temp.yaml. |
Comments suppressed due to low confidence (1)
charts/common/templates/_security_context.yaml:53
- The container seccomp rendering has the same loss of
localhostProfile:containerSecurityContext.seccompProfile.type: Localhostwith a configured profile path renders only the type, so Kubernetes cannot apply the intended Localhost profile.
{{- if $seccomp }}
seccompProfile:
type: {{ $seccomp.type }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+16
to
+18
| {{- if hasKey $context "seccompProfile" }} | ||
| seccompProfile: | ||
| type: {{ $context.seccompProfile.type }} |
Comment on lines
+41
to
+50
|
|
||
| securityContext: | ||
| runAsNonRoot: {{ $runAsNonRoot }} | ||
| runAsUser: {{ $runAsUser }} | ||
| allowPrivilegeEscalation: {{ $allowPrivEsc }} | ||
| readOnlyRootFilesystem: {{ $readOnlyRoot }} | ||
| {{- if and .Values.containerSecurityContext (hasKey $ctr "capabilities") }} | ||
| capabilities: | ||
| {{- toYaml $ctr.capabilities | nindent 4 }} | ||
| {{- end }} |
| */}} | ||
| {{- $runAsNonRoot := ternary $ctr.runAsNonRoot (ternary $pod.runAsNonRoot true (hasKey $pod "runAsNonRoot")) (hasKey $ctr "runAsNonRoot") -}} | ||
| {{- $runAsUser := ternary $ctr.runAsUser (ternary $pod.runAsUser 1001 (hasKey $pod "runAsUser")) (hasKey $ctr "runAsUser") -}} | ||
| {{- $seccomp := ternary $ctr.seccompProfile (ternary $pod.seccompProfile nil (hasKey $pod "seccompProfile")) (hasKey $ctr "seccompProfile") -}} |
Member
|
Thank you @ferdiekrammer for starting this. #5 built on the same idea and has been merged instead (released as |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
addition to security contexts to make the helm chart CIS compliant
issues
mlflow-oidc/helm#11