Custom SecurityContext in Postgresql, OperatorConfiguration CRDs #2244

hshmilo · 2023-02-27T10:11:33Z

This PR extends the Postgresql, OperatorConfiguration CRDs with the following list of properties related to pod/containers SecurityContext.
Postgresql CRD:

spiloSeccompProfile – adds SeccompProfile config property on the cluster pod level.
securityContext for the sidecars configuration – configures securityContext property for particular sidecar container.

OperatorConfiguration CRD:

dropped_pod_capabilities - list of dropped capabilities for spilo container.
spilo_seccompprofile – adds SeccompProfile config property on clusters pod level.
securityContext for the sidecars configuration – configures securityContext property for particular sidecar container.

This PR addresses #2223

EmilMunksoe · 2023-04-27T13:06:54Z

+1

x3rus · 2023-05-17T14:01:21Z

+1

ugur99 · 2023-08-08T12:12:56Z

Hi everyone, any updates regarding this PR?

m1m1x · 2023-09-17T07:19:27Z

Hi,

any chance to review this MR please? It would be a good addition for cluster security in depth.

mattwing · 2023-12-06T19:51:18Z

+1 on needing this to comply with restricted profiles, as @EmilMunksoe mentioned #2223 (comment)

Tahedah · 2024-04-17T12:09:36Z

Hey, this is also a blocker for us since we have strict pod policies for the clusters. Is this something that will be merged soon?

sj-porter-knime · 2024-04-22T20:14:21Z

+1

BalintCsonka · 2024-04-23T13:41:20Z

+1

mrpainte · 2024-05-02T14:50:18Z

+1 this would allow my team to be able to deploy postgres into our clusters with this operator

bumarcell · 2024-05-13T13:01:17Z

Why is this MR (which will make many lives easier) ignored for over a year now? waiting only makes it more complicated to merge and now there are merge conflicts to resolve.
I hope there's a good reason for that.. 😓

ajchiarello · 2024-05-13T15:18:04Z

Honestly, the delay on this led me to move from this operator over the CloudNative PostgreSQL Operator, which does everything and is already secure.

sdesbure · 2024-05-14T07:32:04Z

Honestly, the delay on this led me to move from this operator over the CloudNative PostgreSQL Operator, which does everything and is already secure.

same here :(

zacharyljones · 2024-08-09T15:12:06Z

+1

mheers · 2024-08-09T15:25:52Z

I circumvented the problem with a MutatingWebhookConfiguration and the corresponding controller:

https://github.com/mheers/pod-spec-mutator

You create a deployment with an env var that specifies how the pod will modified before starting:
https://github.com/mheers/pod-spec-mutator/blob/main/deploy/deployment.yaml#L38

With this one can easily specify the SecurityContext and have it merged in the starting pods specification on-the-fly.

ajchiarello · 2024-08-09T15:30:28Z

I circumvented the problem with a MutatingWebhookConfiguration and the corresponding controller:

I circumvented the problem by moving to the CNPG Operator which does everything securely by default.

mheers · 2024-08-09T15:34:54Z

I circumvented the problem with a MutatingWebhookConfiguration and the corresponding controller:

I circumvented the problem by moving to the CNPG Operator which does everything securely by default.

I also checked CNPG and indeed it offers to set the SecurityContext, but I also need to define additional volumes and hostAliases - which is also not supported by CNPG so I sticked with zalando and built the admission-hook.

chef-6229 · 2024-08-15T12:45:19Z

please merge this PR

sj-porter-knime · 2024-08-27T17:59:57Z

I think labeling this PR as minor might be a bit of an understatement - setting restricted security contexts is a best practice for any database running in Kubernetes and increasingly becoming a hard requirement. Almost every company we see using Kubernetes is installing tools like Kyverno or Gatekeeper to enforce security policies, making Postgres instances controlled via this operator a security exception in every single case. Using mutation policies with Kyverno is a creative workaround for those brave enough to use mutation policies, but also a bit of an anti-pattern.

Could we please get an acknowledgement or response from the PR reviewers (or other repo maintainers) with current status and/or some steps that community members can take to help it along? Do you need testers, or is there something else you're concerned about that we can help with? Migrating to another Postgres Operator would be a large undertaking for us, but if we can't get these security exceptions resolved, we may be forced to migrate at some point like others already have.

szuecs · 2024-08-29T17:06:21Z

charts/postgres-operator/crds/operatorconfigurations.yaml

@@ -324,8 +328,17 @@ spec:
                    type: integer
                  spilo_runasgroup:
                    type: integer
+                  spilo_runasnonroot:


Why do you need this if there is a spilo_runasuser?

@szuecs such field is required to conform with pod security standards restricted profile
https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted

Ok then let's have it!
Please resolve all the comments related with this one.
Thanks for your work!

szuecs · 2024-08-29T17:06:49Z

charts/postgres-operator/crds/postgresqls.yaml

@@ -466,8 +466,17 @@ spec:
                type: integer
              spiloRunAsGroup:
                type: integer
+              spiloRunAsNonRoot:


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:06:58Z

charts/postgres-operator/values.yaml

@@ -196,10 +200,15 @@ configKubernetes:
  # set user and group for the spilo container (required to run Spilo as non-root process)
  # spilo_runasuser: 101
  # spilo_runasgroup: 103
+  # spilo_runasnonroot: true


https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:09:59Z

docs/administrator.md

-cluster to access buckets to write WAL-E logs: Workload Identity (recommended)
-or using a GCP Service Account Key (legacy).
-
-#### Workload Identity setup


why is this all dropped?
I have no idea about GCP, but the PR seems to be about CRD change to allow to customize SecurityContext.
Please make sure the focus of the PR stays in line with the changes.

szuecs · 2024-08-29T17:10:42Z

docs/reference/cluster_manifest.md

@@ -78,13 +78,26 @@ These parameters are grouped directly under  the `spec` key in the manifest.
  This must be set to run the container without root. By default the container
  runs with root. This option only works for Spilo versions >= 1.6-p3.

+* **spiloRunAsNonRoot**


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:02Z

docs/reference/operator_parameters.md

@@ -453,12 +453,25 @@ configuration they are grouped under the `kubernetes` key.
  This must be set to run the container without root. By default the container
  runs with root. This option only works for Spilo versions >= 1.6-p3.

+* **spilo_runasnonroot**


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:16Z

docs/user.md

+        capabilities:
+          drop:
+          - ALL
+        runAsNonRoot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:24Z

manifests/complete-postgres-manifest.yaml

@@ -93,7 +93,11 @@ spec:
  enableShmVolume: true
 #  spiloRunAsUser: 101
 #  spiloRunAsGroup: 103
+#  spiloRunAsNonRoot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:30Z

manifests/complete-postgres-manifest.yaml

+#       capabilities:
+#        drop:
+#         - ALL
+#       runAsNonRoot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:40Z

manifests/configmap.yaml

@@ -150,7 +151,11 @@ data:
  spilo_allow_privilege_escalation: "true"
  # spilo_runasuser: 101
  # spilo_runasgroup: 103
+  # spilo_runasnonroot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:47Z

manifests/operatorconfiguration.crd.yaml

@@ -322,8 +326,17 @@ spec:
                    type: integer
                  spilo_runasgroup:
                    type: integer
+                  spilo_runasnonroot:


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:54Z

manifests/postgresql-operator-default-configuration.yaml

@@ -100,7 +102,11 @@ configuration:
    spilo_allow_privilege_escalation: true
    # spilo_runasuser: 101
    # spilo_runasgroup: 103
+    # spilo_runasnonroot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:12:00Z

manifests/postgresql.crd.yaml

@@ -464,8 +464,17 @@ spec:
                type: integer
              spiloRunAsGroup:
                type: integer
+              spiloRunAsNonRoot:


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:12:18Z

pkg/apis/acid.zalan.do/v1/crds.go

@@ -728,9 +728,23 @@ var PostgresCRDResourceValidation = apiextv1.CustomResourceValidation{
 					"spiloRunAsGroup": {
 						Type: "integer",
 					},
+					"spiloRunAsNonRoot": {


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:12:32Z

pkg/apis/acid.zalan.do/v1/operator_configuration_type.go

@@ -64,8 +64,11 @@ type KubernetesMetaConfiguration struct {
 	SpiloAllowPrivilegeEscalation          *bool                        `json:"spilo_allow_privilege_escalation,omitempty"`
 	SpiloRunAsUser                         *int64                       `json:"spilo_runasuser,omitempty"`
 	SpiloRunAsGroup                        *int64                       `json:"spilo_runasgroup,omitempty"`
+	SpiloRunAsNonRoot                      *bool                        `json:"spilo_runasnonroot,omitempty"`


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:13:16Z

pkg/util/config/config.go

@@ -32,12 +32,15 @@ type Resources struct {
 	PodTerminateGracePeriod       time.Duration       `name:"pod_terminate_grace_period" default:"5m"`
 	SpiloRunAsUser                *int64              `name:"spilo_runasuser"`
 	SpiloRunAsGroup               *int64              `name:"spilo_runasgroup"`
+	SpiloRunAsNonRoot             *bool               `name:"spilo_runasnonroot"`


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:14:19Z

pkg/cluster/k8sres.go

@@ -2346,6 +2396,8 @@ func (c *Cluster) generateLogicalBackupPodEnvVars() []v1.EnvVar {
 		envVars = append(envVars, v1.EnvVar{Name: "AWS_SECRET_ACCESS_KEY", Value: c.OpConfig.LogicalBackup.LogicalBackupS3SecretAccessKey})
 	}

+	c.logger.Debugf("Generated logical backup env vars")
+	c.logger.Debugf("%v", envVars)


hmm, not sure if I would like this as security enhancement

szuecs · 2024-08-29T17:18:27Z

I am not part of postgres-operator maintainers, but from kubernetes point of view I have some idea. I hope my questions are fine and help to get some things sorted out.

Hanna Shmilo added 2 commits February 24, 2023 15:06

pod+containers securityContext

0619032

add securityContext to postgresql.crd.yaml

2d93111

hshmilo requested review from sdudoladov, Jan-M, FxKu, jopadi, idanovinda and hughcapet as code owners February 27, 2023 10:11

hshmilo mentioned this pull request Feb 27, 2023

Custom Security Context in postgresql #2223

Open

add runAsNonRoot

8fe3817

FxKu added this to the 1.14.0 milestone Aug 21, 2024

FxKu added the minor label Aug 23, 2024

szuecs reviewed Aug 29, 2024

View reviewed changes

FxKu modified the milestones: 1.14.0, 2.0 Nov 11, 2024

Custom SecurityContext in Postgresql, OperatorConfiguration CRDs #2244

Are you sure you want to change the base?

Custom SecurityContext in Postgresql, OperatorConfiguration CRDs #2244

Conversation

hshmilo commented Feb 27, 2023 • edited Loading

EmilMunksoe commented Apr 27, 2023

x3rus commented May 17, 2023

ugur99 commented Aug 8, 2023

m1m1x commented Sep 17, 2023

mattwing commented Dec 6, 2023

Tahedah commented Apr 17, 2024

sj-porter-knime commented Apr 22, 2024

BalintCsonka commented Apr 23, 2024

mrpainte commented May 2, 2024

bumarcell commented May 13, 2024

ajchiarello commented May 13, 2024

sdesbure commented May 14, 2024

zacharyljones commented Aug 9, 2024

mheers commented Aug 9, 2024

ajchiarello commented Aug 9, 2024

mheers commented Aug 9, 2024

chef-6229 commented Aug 15, 2024

sj-porter-knime commented Aug 27, 2024

Choose a reason for hiding this comment

tomsozolins Aug 29, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

szuecs commented Aug 29, 2024

hshmilo commented Feb 27, 2023 •

edited

Loading

tomsozolins Aug 29, 2024 •

edited

Loading