Skip to content

Commit e3bb558

Browse files
hamidossvghadi
hamidos
and
svghadi
authored
fix: add missing seccompProfile to comply with restricted policy (argoproj-labs#1493)
* fix: add missing seccompProfile to comply with restricted policy Signed-off-by: hamidos <ed.hamido@gmail.com> * Add kuttl e2e test Signed-off-by: Siddhesh Ghadi <sghadi1203@gmail.com> * Fix kuttl test Signed-off-by: Siddhesh Ghadi <sghadi1203@gmail.com> --------- Signed-off-by: hamidos <ed.hamido@gmail.com> Signed-off-by: Siddhesh Ghadi <sghadi1203@gmail.com> Co-authored-by: Siddhesh Ghadi <sghadi1203@gmail.com>
1 parent f6d77ef commit e3bb558

23 files changed

+237
-0
lines changed

‎bundle/manifests/argocd-operator.clusterserviceversion.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -1927,6 +1927,8 @@ spec:
19271927
- ALL
19281928
readOnlyRootFilesystem: true
19291929
runAsNonRoot: true
1930+
seccompProfile:
1931+
type: RuntimeDefault
19301932
securityContext:
19311933
runAsNonRoot: true
19321934
serviceAccountName: argocd-operator-controller-manager

‎config/default/manager_auth_proxy_patch.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,5 @@ spec:
3939
allowPrivilegeEscalation: false
4040
readOnlyRootFilesystem: true
4141
runAsNonRoot: true
42+
seccompProfile:
43+
type: RuntimeDefault

‎config/default/manager_config_patch.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ spec:
2121
allowPrivilegeEscalation: false
2222
readOnlyRootFilesystem: true
2323
runAsNonRoot: true
24+
seccompProfile:
25+
type: RuntimeDefault
2426
volumes:
2527
- name: manager-config
2628
configMap:

‎config/manager/manager.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ spec:
4040
allowPrivilegeEscalation: false
4141
readOnlyRootFilesystem: true
4242
runAsNonRoot: true
43+
seccompProfile:
44+
type: RuntimeDefault
4345
livenessProbe:
4446
httpGet:
4547
path: /healthz

‎controllers/argocd/applicationset.go

+3
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,9 @@ func (r *ReconcileArgoCD) applicationSetContainer(cr *argoproj.ArgoCD, addSCMGit
355355
AllowPrivilegeEscalation: boolPtr(false),
356356
ReadOnlyRootFilesystem: boolPtr(true),
357357
RunAsNonRoot: boolPtr(true),
358+
SeccompProfile: &corev1.SeccompProfile{
359+
Type: "RuntimeDefault",
360+
},
358361
},
359362
}
360363
if addSCMGitlabVolumeMount {

‎controllers/argocd/dex.go

+6
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,9 @@ func (r *ReconcileArgoCD) reconcileDexDeployment(cr *argoproj.ArgoCD) error {
271271
},
272272
},
273273
RunAsNonRoot: boolPtr(true),
274+
SeccompProfile: &corev1.SeccompProfile{
275+
Type: "RuntimeDefault",
276+
},
274277
},
275278
VolumeMounts: []corev1.VolumeMount{{
276279
Name: "static-files",
@@ -298,6 +301,9 @@ func (r *ReconcileArgoCD) reconcileDexDeployment(cr *argoproj.ArgoCD) error {
298301
},
299302
},
300303
RunAsNonRoot: boolPtr(true),
304+
SeccompProfile: &corev1.SeccompProfile{
305+
Type: "RuntimeDefault",
306+
},
301307
},
302308
VolumeMounts: []corev1.VolumeMount{{
303309
Name: "static-files",

‎controllers/argocd/dex_test.go

+18
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,9 @@ func TestReconcileArgoCD_reconcileDexDeployment(t *testing.T) {
280280
},
281281
},
282282
RunAsNonRoot: boolPtr(true),
283+
SeccompProfile: &corev1.SeccompProfile{
284+
Type: "RuntimeDefault",
285+
},
283286
},
284287
VolumeMounts: []corev1.VolumeMount{
285288
{
@@ -330,6 +333,9 @@ func TestReconcileArgoCD_reconcileDexDeployment(t *testing.T) {
330333
},
331334
},
332335
RunAsNonRoot: boolPtr(true),
336+
SeccompProfile: &corev1.SeccompProfile{
337+
Type: "RuntimeDefault",
338+
},
333339
},
334340
VolumeMounts: []corev1.VolumeMount{
335341
{Name: "static-files", MountPath: "/shared"},
@@ -401,6 +407,9 @@ func TestReconcileArgoCD_reconcileDexDeployment_withUpdate(t *testing.T) {
401407
},
402408
},
403409
RunAsNonRoot: boolPtr(true),
410+
SeccompProfile: &corev1.SeccompProfile{
411+
Type: "RuntimeDefault",
412+
},
404413
},
405414
VolumeMounts: []corev1.VolumeMount{
406415
{
@@ -451,6 +460,9 @@ func TestReconcileArgoCD_reconcileDexDeployment_withUpdate(t *testing.T) {
451460
},
452461
},
453462
RunAsNonRoot: boolPtr(true),
463+
SeccompProfile: &corev1.SeccompProfile{
464+
Type: "RuntimeDefault",
465+
},
454466
},
455467
VolumeMounts: []corev1.VolumeMount{
456468
{Name: "static-files", MountPath: "/shared"},
@@ -514,6 +526,9 @@ func TestReconcileArgoCD_reconcileDexDeployment_withUpdate(t *testing.T) {
514526
},
515527
},
516528
RunAsNonRoot: boolPtr(true),
529+
SeccompProfile: &corev1.SeccompProfile{
530+
Type: "RuntimeDefault",
531+
},
517532
},
518533
VolumeMounts: []corev1.VolumeMount{
519534
{
@@ -577,6 +592,9 @@ func TestReconcileArgoCD_reconcileDexDeployment_withUpdate(t *testing.T) {
577592
},
578593
},
579594
RunAsNonRoot: boolPtr(true),
595+
SeccompProfile: &corev1.SeccompProfile{
596+
Type: "RuntimeDefault",
597+
},
580598
},
581599
VolumeMounts: []corev1.VolumeMount{
582600
{Name: "static-files", MountPath: "/shared"},

‎controllers/argocd/keycloak.go

+24
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,18 @@ func getKeycloakContainer(cr *argoproj.ArgoCD) corev1.Container {
236236
{ContainerPort: 8443, Name: "https", Protocol: "TCP"},
237237
{ContainerPort: 8888, Name: "ping", Protocol: "TCP"},
238238
},
239+
SecurityContext: &corev1.SecurityContext{
240+
Capabilities: &corev1.Capabilities{
241+
Drop: []corev1.Capability{
242+
"ALL",
243+
},
244+
},
245+
AllowPrivilegeEscalation: boolPtr(false),
246+
RunAsNonRoot: boolPtr(true),
247+
SeccompProfile: &corev1.SeccompProfile{
248+
Type: "RuntimeDefault",
249+
},
250+
},
239251
ReadinessProbe: &corev1.Probe{
240252
TimeoutSeconds: 240,
241253
InitialDelaySeconds: 120,
@@ -627,6 +639,18 @@ func newKeycloakDeployment(cr *argoproj.ArgoCD) *k8sappsv1.Deployment {
627639
{Name: "http", ContainerPort: httpPort},
628640
{Name: "https", ContainerPort: portTLS},
629641
},
642+
SecurityContext: &corev1.SecurityContext{
643+
Capabilities: &corev1.Capabilities{
644+
Drop: []corev1.Capability{
645+
"ALL",
646+
},
647+
},
648+
AllowPrivilegeEscalation: boolPtr(false),
649+
RunAsNonRoot: boolPtr(true),
650+
SeccompProfile: &corev1.SeccompProfile{
651+
Type: "RuntimeDefault",
652+
},
653+
},
630654
ReadinessProbe: &corev1.Probe{
631655
ProbeHandler: corev1.ProbeHandler{
632656
HTTPGet: &corev1.HTTPGetAction{

‎controllers/argocd/notifications.go

+3
Original file line numberDiff line numberDiff line change
@@ -393,6 +393,9 @@ func (r *ReconcileArgoCD) reconcileNotificationsDeployment(cr *argoproj.ArgoCD,
393393
"ALL",
394394
},
395395
},
396+
SeccompProfile: &corev1.SeccompProfile{
397+
Type: "RuntimeDefault",
398+
},
396399
},
397400
VolumeMounts: []corev1.VolumeMount{
398401
{

‎controllers/argocd/notifications_test.go

+3
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,9 @@ func TestReconcileNotifications_CreateDeployments(t *testing.T) {
181181
"ALL",
182182
},
183183
},
184+
SeccompProfile: &corev1.SeccompProfile{
185+
Type: "RuntimeDefault",
186+
},
184187
},
185188
VolumeMounts: []corev1.VolumeMount{
186189
{

‎controllers/argocd/statefulset.go

+15
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,9 @@ func (r *ReconcileArgoCD) reconcileRedisStatefulSet(cr *argoproj.ArgoCD) error {
198198
},
199199
},
200200
RunAsNonRoot: boolPtr(true),
201+
SeccompProfile: &corev1.SeccompProfile{
202+
Type: "RuntimeDefault",
203+
},
201204
},
202205
VolumeMounts: []corev1.VolumeMount{
203206
{
@@ -270,6 +273,9 @@ func (r *ReconcileArgoCD) reconcileRedisStatefulSet(cr *argoproj.ArgoCD) error {
270273
},
271274
},
272275
RunAsNonRoot: boolPtr(true),
276+
SeccompProfile: &corev1.SeccompProfile{
277+
Type: "RuntimeDefault",
278+
},
273279
},
274280
VolumeMounts: []corev1.VolumeMount{
275281
{
@@ -332,6 +338,9 @@ func (r *ReconcileArgoCD) reconcileRedisStatefulSet(cr *argoproj.ArgoCD) error {
332338
},
333339
},
334340
RunAsNonRoot: boolPtr(true),
341+
SeccompProfile: &corev1.SeccompProfile{
342+
Type: "RuntimeDefault",
343+
},
335344
},
336345
VolumeMounts: []corev1.VolumeMount{
337346
{
@@ -618,6 +627,9 @@ func (r *ReconcileArgoCD) reconcileApplicationControllerStatefulSet(cr *argoproj
618627
},
619628
},
620629
RunAsNonRoot: boolPtr(true),
630+
SeccompProfile: &corev1.SeccompProfile{
631+
Type: "RuntimeDefault",
632+
},
621633
},
622634
VolumeMounts: controllerVolumeMounts,
623635
}}
@@ -703,6 +715,9 @@ func (r *ReconcileArgoCD) reconcileApplicationControllerStatefulSet(cr *argoproj
703715
},
704716
},
705717
RunAsNonRoot: boolPtr(true),
718+
SeccompProfile: &corev1.SeccompProfile{
719+
Type: "RuntimeDefault",
720+
},
706721
},
707722
VolumeMounts: getArgoImportVolumeMounts(),
708723
}}

‎controllers/argocdexport/job.go

+3
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,9 @@ func newExportPodSpec(cr *argoproj.ArgoCDExport, argocdName string, client clien
186186
},
187187
},
188188
RunAsNonRoot: boolPtr(true),
189+
SeccompProfile: &corev1.SeccompProfile{
190+
Type: "RuntimeDefault",
191+
},
189192
},
190193
VolumeMounts: getArgoExportVolumeMounts(),
191194
}}

‎deploy/olm-catalog/argocd-operator/0.12.0/argocd-operator.v0.12.0.clusterserviceversion.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -1927,6 +1927,8 @@ spec:
19271927
- ALL
19281928
readOnlyRootFilesystem: true
19291929
runAsNonRoot: true
1930+
seccompProfile:
1931+
type: RuntimeDefault
19301932
securityContext:
19311933
runAsNonRoot: true
19321934
serviceAccountName: argocd-operator-controller-manager

‎tests/k8s/1-042_restricted_pss_compliant/01-assert.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# test will fail on clusters with less than 3 nodes
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: test-1-042-restricted-pss-compliant
6+
labels:
7+
pod-security.kubernetes.io/enforce: restricted
8+
pod-security.kubernetes.io/enforce-version: latest
9+
pod-security.kubernetes.io/warn: restricted
10+
pod-security.kubernetes.io/warn-version: latest
11+
pod-security.kubernetes.io/audit: restricted
12+
pod-security.kubernetes.io/audit-version: latest
13+
---
14+
apiVersion: argoproj.io/v1beta1
15+
kind: ArgoCD
16+
metadata:
17+
name: argocd
18+
namespace: test-1-042-restricted-pss-compliant
19+
status:
20+
applicationController: Running
21+
applicationSetController: Running
22+
notificationsController: Running
23+
phase: Available
24+
redis: Running
25+
repo: Running
26+
server: Running
27+
sso: Running

‎tests/k8s/1-042_restricted_pss_compliant/01-install-argocd-in-restricted-pss-ns copy.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# test will fail on clusters with less than 3 nodes
2+
---
3+
apiVersion: v1
4+
kind: Namespace
5+
metadata:
6+
name: test-1-042-restricted-pss-compliant
7+
labels:
8+
pod-security.kubernetes.io/enforce: restricted
9+
pod-security.kubernetes.io/enforce-version: latest
10+
pod-security.kubernetes.io/warn: restricted
11+
pod-security.kubernetes.io/warn-version: latest
12+
pod-security.kubernetes.io/audit: restricted
13+
pod-security.kubernetes.io/audit-version: latest
14+
---
15+
apiVersion: argoproj.io/v1beta1
16+
kind: ArgoCD
17+
metadata:
18+
name: argocd
19+
namespace: test-1-042-restricted-pss-compliant
20+
spec:
21+
applicationSet:
22+
enabled: true
23+
notifications:
24+
enabled: true
25+
sso:
26+
provider: dex
27+
dex:
28+
openShiftOAuth: true

‎tests/k8s/1-042_restricted_pss_compliant/02-check-pod.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
commands:
4+
- script: sleep 10
5+
- script: kubectl get pods -n test-1-042-restricted-pss-compliant | grep 'argocd-application-controller'
6+
- script: kubectl get pods -n test-1-042-restricted-pss-compliant | grep 'argocd-applicationset-controller'
7+
- script: kubectl get pods -n test-1-042-restricted-pss-compliant | grep 'argocd-dex-server'
8+
- script: kubectl get pods -n test-1-042-restricted-pss-compliant | grep 'argocd-notifications-controller'
9+
- script: kubectl get pods -n test-1-042-restricted-pss-compliant | grep 'argocd-redis'
10+
- script: kubectl get pods -n test-1-042-restricted-pss-compliant | grep 'argocd-repo-server'
11+
- script: kubectl get pods -n test-1-042-restricted-pss-compliant | grep 'argocd-server'

‎tests/k8s/1-042_restricted_pss_compliant/03-assert.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: argoproj.io/v1beta1
2+
kind: ArgoCD
3+
metadata:
4+
name: argocd
5+
namespace: test-1-042-restricted-pss-compliant
6+
status:
7+
applicationController: Running
8+
phase: Available
9+
redis: Running
10+
repo: Running
11+
server: Running
12+
#sso: Running # due to bug in keycloak service code, status remains as Pending
13+
---
14+
apiVersion: apps/v1
15+
kind: Deployment
16+
metadata:
17+
name: keycloak
18+
namespace: test-1-042-restricted-pss-compliant

‎tests/k8s/1-042_restricted_pss_compliant/03-enable-keycloak-sso.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: argoproj.io/v1beta1
2+
kind: ArgoCD
3+
metadata:
4+
name: argocd
5+
namespace: test-1-042-restricted-pss-compliant
6+
spec:
7+
sso:
8+
provider: keycloak
9+
keycloak:
10+
verifyTLS: false
11+
---
12+
apiVersion: kuttl.dev/v1beta1
13+
kind: TestStep
14+
commands:
15+
- script: |
16+
kubectl patch -n test-1-042-restricted-pss-compliant argocd/argocd --type='json' -p='[{"op": "remove", "path": "/spec/sso/dex"}]'
17+

‎tests/k8s/1-042_restricted_pss_compliant/04-check-pod.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
commands:
4+
- script: sleep 10
5+
- script: kubectl get pods -n test-1-042-restricted-pss-compliant | grep 'keycloak'

‎tests/k8s/1-042_restricted_pss_compliant/05-assert.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: argoproj.io/v1beta1
2+
kind: ArgoCD
3+
metadata:
4+
name: argocd
5+
namespace: test-1-042-restricted-pss-compliant
6+
status:
7+
applicationController: Running
8+
#phase: Available
9+
#redis: Running
10+
repo: Running
11+
server: Running
12+
---
13+
apiVersion: apps/v1
14+
kind: StatefulSet
15+
metadata:
16+
name: argocd-redis-ha-server
17+
namespace: test-1-042-restricted-pss-compliant
18+
---
19+
apiVersion: apps/v1
20+
kind: Deployment
21+
metadata:
22+
name: argocd-redis-ha-haproxy
23+
namespace: test-1-042-restricted-pss-compliant
24+

‎tests/k8s/1-042_restricted_pss_compliant/05-enable-redis-ha.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# test will fail on clusters with less than 3 nodes
2+
apiVersion: argoproj.io/v1beta1
3+
kind: ArgoCD
4+
metadata:
5+
name: argocd
6+
namespace: test-1-042-restricted-pss-compliant
7+
spec:
8+
ha:
9+
enabled: true

0 commit comments

Comments
 (0)