Skip to content

Commit a1529b8

Browse files
tamalsahazhaohuabing
tamalsaha
authored and
zhaohuabing
committed
feat(chart): Make security context configurable (envoyproxy#4536)
* Make security context configurable Signed-off-by: Tamal Saha <[email protected]> * make gen-check Signed-off-by: Tamal Saha <[email protected]> * Update current.yaml Signed-off-by: Tamal Saha <[email protected]> --------- Signed-off-by: Tamal Saha <[email protected]> (cherry picked from commit 20a4622) Signed-off-by: Huabing Zhao <[email protected]>
1 parent eec1048 commit a1529b8

18 files changed

+677
-46
lines changed

‎charts/gateway-helm/README.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ To uninstall the chart:
5959

6060
| Key | Type | Default | Description |
6161
|-----|------|---------|-------------|
62-
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
62+
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
6363
| config.envoyGateway.gateway.controllerName | string | `"gateway.envoyproxy.io/gatewayclass-controller"` | |
6464
| config.envoyGateway.logging.level.default | string | `"info"` | |
6565
| config.envoyGateway.provider.type | string | `"Kubernetes"` | |
@@ -71,6 +71,13 @@ To uninstall the chart:
7171
| deployment.envoyGateway.resources.limits.memory | string | `"1024Mi"` | |
7272
| deployment.envoyGateway.resources.requests.cpu | string | `"100m"` | |
7373
| deployment.envoyGateway.resources.requests.memory | string | `"256Mi"` | |
74+
| deployment.envoyGateway.securityContext.allowPrivilegeEscalation | bool | `false` | |
75+
| deployment.envoyGateway.securityContext.capabilities.drop[0] | string | `"ALL"` | |
76+
| deployment.envoyGateway.securityContext.privileged | bool | `false` | |
77+
| deployment.envoyGateway.securityContext.runAsGroup | int | `65532` | |
78+
| deployment.envoyGateway.securityContext.runAsNonRoot | bool | `true` | |
79+
| deployment.envoyGateway.securityContext.runAsUser | int | `65532` | |
80+
| deployment.envoyGateway.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
7481
| deployment.pod.affinity | object | `{}` | |
7582
| deployment.pod.annotations."prometheus.io/port" | string | `"19001"` | |
7683
| deployment.pod.annotations."prometheus.io/scrape" | string | `"true"` | |

‎charts/gateway-helm/templates/certgen.yaml

+1-11
Original file line numberDiff line numberDiff line change
@@ -39,17 +39,7 @@ spec:
3939
{{- toYaml . | nindent 10 }}
4040
{{- end }}
4141
securityContext:
42-
allowPrivilegeEscalation: false
43-
capabilities:
44-
drop:
45-
- ALL
46-
privileged: false
47-
readOnlyRootFilesystem: true
48-
runAsNonRoot: true
49-
runAsGroup: 65534
50-
runAsUser: 65534
51-
seccompProfile:
52-
type: RuntimeDefault
42+
{{- toYaml .Values.certgen.job.securityContext | nindent 10 }}
5343
{{- include "eg.image.pullSecrets" . | nindent 6 }}
5444
{{- with .Values.certgen.job.affinity }}
5545
affinity:

‎charts/gateway-helm/templates/envoy-gateway-deployment.yaml

+4-13
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ spec:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
3232
{{- with .Values.deployment.pod.nodeSelector }}
33-
nodeSelector:
33+
nodeSelector:
3434
{{ toYaml . | nindent 8 }}
3535
{{- end }}
3636
{{- with .Values.deployment.pod.topologySpreadConstraints }}
@@ -73,19 +73,10 @@ spec:
7373
port: 8081
7474
initialDelaySeconds: 5
7575
periodSeconds: 10
76-
resources: {{- toYaml .Values.deployment.envoyGateway.resources | nindent 10
77-
}}
76+
resources:
77+
{{- toYaml .Values.deployment.envoyGateway.resources | nindent 10 }}
7878
securityContext:
79-
allowPrivilegeEscalation: false
80-
capabilities:
81-
drop:
82-
- ALL
83-
privileged: false
84-
runAsNonRoot: true
85-
runAsGroup: 65532
86-
runAsUser: 65532
87-
seccompProfile:
88-
type: RuntimeDefault
79+
{{- toYaml .Values.deployment.envoyGateway.securityContext | nindent 10 }}
8980
volumeMounts:
9081
- mountPath: /config
9182
name: envoy-gateway-config

‎charts/gateway-helm/values.tmpl.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,17 @@ deployment:
3535
requests:
3636
cpu: 100m
3737
memory: 256Mi
38+
securityContext:
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop:
42+
- ALL
43+
privileged: false
44+
runAsNonRoot: true
45+
runAsGroup: 65532
46+
runAsUser: 65532
47+
seccompProfile:
48+
type: RuntimeDefault
3849
ports:
3950
- name: grpc
4051
port: 18000
@@ -86,6 +97,18 @@ certgen:
8697
tolerations: []
8798
nodeSelector: {}
8899
ttlSecondsAfterFinished: 30
100+
securityContext:
101+
allowPrivilegeEscalation: false
102+
capabilities:
103+
drop:
104+
- ALL
105+
privileged: false
106+
readOnlyRootFilesystem: true
107+
runAsNonRoot: true
108+
runAsGroup: 65534
109+
runAsUser: 65534
110+
seccompProfile:
111+
type: RuntimeDefault
89112
rbac:
90113
annotations: {}
91114
labels: {}

‎release-notes/current.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ security updates: |
1010
1111
# New features or capabilities added in this release.
1212
new features: |
13-
Add a new feature here
13+
Add support for modifying container securityContext for Envoy Gateway deployment in Helm
1414
1515
# Fixes for bugs identified in previous versions.
1616
bug fixes: |

‎site/content/en/latest/install/gateway-helm-api.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ The Helm chart for Envoy Gateway
2323

2424
| Key | Type | Default | Description |
2525
|-----|------|---------|-------------|
26-
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
26+
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
2727
| config.envoyGateway.gateway.controllerName | string | `"gateway.envoyproxy.io/gatewayclass-controller"` | |
2828
| config.envoyGateway.logging.level.default | string | `"info"` | |
2929
| config.envoyGateway.provider.type | string | `"Kubernetes"` | |
@@ -35,6 +35,13 @@ The Helm chart for Envoy Gateway
3535
| deployment.envoyGateway.resources.limits.memory | string | `"1024Mi"` | |
3636
| deployment.envoyGateway.resources.requests.cpu | string | `"100m"` | |
3737
| deployment.envoyGateway.resources.requests.memory | string | `"256Mi"` | |
38+
| deployment.envoyGateway.securityContext.allowPrivilegeEscalation | bool | `false` | |
39+
| deployment.envoyGateway.securityContext.capabilities.drop[0] | string | `"ALL"` | |
40+
| deployment.envoyGateway.securityContext.privileged | bool | `false` | |
41+
| deployment.envoyGateway.securityContext.runAsGroup | int | `65532` | |
42+
| deployment.envoyGateway.securityContext.runAsNonRoot | bool | `true` | |
43+
| deployment.envoyGateway.securityContext.runAsUser | int | `65532` | |
44+
| deployment.envoyGateway.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
3845
| deployment.pod.affinity | object | `{}` | |
3946
| deployment.pod.annotations."prometheus.io/port" | string | `"19001"` | |
4047
| deployment.pod.annotations."prometheus.io/scrape" | string | `"true"` | |

‎site/content/zh/latest/install/gateway-helm-api.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ The Helm chart for Envoy Gateway
2323

2424
| Key | Type | Default | Description |
2525
|-----|------|---------|-------------|
26-
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
26+
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
2727
| config.envoyGateway.gateway.controllerName | string | `"gateway.envoyproxy.io/gatewayclass-controller"` | |
2828
| config.envoyGateway.logging.level.default | string | `"info"` | |
2929
| config.envoyGateway.provider.type | string | `"Kubernetes"` | |
@@ -35,6 +35,13 @@ The Helm chart for Envoy Gateway
3535
| deployment.envoyGateway.resources.limits.memory | string | `"1024Mi"` | |
3636
| deployment.envoyGateway.resources.requests.cpu | string | `"100m"` | |
3737
| deployment.envoyGateway.resources.requests.memory | string | `"256Mi"` | |
38+
| deployment.envoyGateway.securityContext.allowPrivilegeEscalation | bool | `false` | |
39+
| deployment.envoyGateway.securityContext.capabilities.drop[0] | string | `"ALL"` | |
40+
| deployment.envoyGateway.securityContext.privileged | bool | `false` | |
41+
| deployment.envoyGateway.securityContext.runAsGroup | int | `65532` | |
42+
| deployment.envoyGateway.securityContext.runAsNonRoot | bool | `true` | |
43+
| deployment.envoyGateway.securityContext.runAsUser | int | `65532` | |
44+
| deployment.envoyGateway.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
3845
| deployment.pod.affinity | object | `{}` | |
3946
| deployment.pod.annotations."prometheus.io/port" | string | `"19001"` | |
4047
| deployment.pod.annotations."prometheus.io/scrape" | string | `"true"` | |

‎test/helm/gateway-helm/certjen-custom-scheduling.out.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -432,8 +432,8 @@ spec:
432432
drop:
433433
- ALL
434434
privileged: false
435-
runAsNonRoot: true
436435
runAsGroup: 65532
436+
runAsNonRoot: true
437437
runAsUser: 65532
438438
seccompProfile:
439439
type: RuntimeDefault
@@ -563,8 +563,8 @@ spec:
563563
- ALL
564564
privileged: false
565565
readOnlyRootFilesystem: true
566-
runAsNonRoot: true
567566
runAsGroup: 65534
567+
runAsNonRoot: true
568568
runAsUser: 65534
569569
seccompProfile:
570570
type: RuntimeDefault

‎test/helm/gateway-helm/control-plane-with-pdb.out.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -447,8 +447,8 @@ spec:
447447
drop:
448448
- ALL
449449
privileged: false
450-
runAsNonRoot: true
451450
runAsGroup: 65532
451+
runAsNonRoot: true
452452
runAsUser: 65532
453453
seccompProfile:
454454
type: RuntimeDefault
@@ -578,8 +578,8 @@ spec:
578578
- ALL
579579
privileged: false
580580
readOnlyRootFilesystem: true
581-
runAsNonRoot: true
582581
runAsGroup: 65534
582+
runAsNonRoot: true
583583
runAsUser: 65534
584584
seccompProfile:
585585
type: RuntimeDefault

‎test/helm/gateway-helm/default-config.out.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -432,8 +432,8 @@ spec:
432432
drop:
433433
- ALL
434434
privileged: false
435-
runAsNonRoot: true
436435
runAsGroup: 65532
436+
runAsNonRoot: true
437437
runAsUser: 65532
438438
seccompProfile:
439439
type: RuntimeDefault
@@ -563,8 +563,8 @@ spec:
563563
- ALL
564564
privileged: false
565565
readOnlyRootFilesystem: true
566-
runAsNonRoot: true
567566
runAsGroup: 65534
567+
runAsNonRoot: true
568568
runAsUser: 65534
569569
seccompProfile:
570570
type: RuntimeDefault

‎test/helm/gateway-helm/deployment-custom-topology.out.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -460,8 +460,8 @@ spec:
460460
drop:
461461
- ALL
462462
privileged: false
463-
runAsNonRoot: true
464463
runAsGroup: 65532
464+
runAsNonRoot: true
465465
runAsUser: 65532
466466
seccompProfile:
467467
type: RuntimeDefault
@@ -591,8 +591,8 @@ spec:
591591
- ALL
592592
privileged: false
593593
readOnlyRootFilesystem: true
594-
runAsNonRoot: true
595594
runAsGroup: 65534
595+
runAsNonRoot: true
596596
runAsUser: 65534
597597
seccompProfile:
598598
type: RuntimeDefault

‎test/helm/gateway-helm/deployment-images-config.out.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -432,8 +432,8 @@ spec:
432432
drop:
433433
- ALL
434434
privileged: false
435-
runAsNonRoot: true
436435
runAsGroup: 65532
436+
runAsNonRoot: true
437437
runAsUser: 65532
438438
seccompProfile:
439439
type: RuntimeDefault
@@ -565,8 +565,8 @@ spec:
565565
- ALL
566566
privileged: false
567567
readOnlyRootFilesystem: true
568-
runAsNonRoot: true
569568
runAsGroup: 65534
569+
runAsNonRoot: true
570570
runAsUser: 65534
571571
seccompProfile:
572572
type: RuntimeDefault

‎test/helm/gateway-helm/deployment-priorityclass.out.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -432,8 +432,8 @@ spec:
432432
drop:
433433
- ALL
434434
privileged: false
435-
runAsNonRoot: true
436435
runAsGroup: 65532
436+
runAsNonRoot: true
437437
runAsUser: 65532
438438
seccompProfile:
439439
type: RuntimeDefault
@@ -564,8 +564,8 @@ spec:
564564
- ALL
565565
privileged: false
566566
readOnlyRootFilesystem: true
567-
runAsNonRoot: true
568567
runAsGroup: 65534
568+
runAsNonRoot: true
569569
runAsUser: 65534
570570
seccompProfile:
571571
type: RuntimeDefault

‎test/helm/gateway-helm/deployment-securitycontext.in.yaml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
global:
2+
images:
3+
envoyGateway:
4+
image: "docker.io/envoyproxy/gateway-dev:latest"
5+
pullPolicy: Always
6+
deployment:
7+
envoyGateway:
8+
securityContext:
9+
allowPrivilegeEscalation: false
10+
capabilities:
11+
drop:
12+
- ALL
13+
privileged: false
14+
runAsNonRoot: true
15+
runAsGroup: 1000
16+
runAsUser: 1000
17+
seccompProfile:
18+
type: RuntimeDefault
19+
certgen:
20+
job:
21+
securityContext:
22+
allowPrivilegeEscalation: false
23+
capabilities:
24+
drop:
25+
- ALL
26+
privileged: false
27+
readOnlyRootFilesystem: true
28+
runAsNonRoot: true
29+
runAsGroup: 1000
30+
runAsUser: 1000
31+
seccompProfile:
32+
type: RuntimeDefault

0 commit comments

Comments
 (0)