Skip to content

Commit 5ade34b

Browse files
yetoneyetone
committed
feat: restricted security context
1 parent 4dc695c commit 5ade34b

File tree

9 files changed

+77
-30
lines changed

9 files changed

+77
-30
lines changed

bento-downloader/Dockerfile renamed to container_images/bento-downloader/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,13 @@ RUN curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud
1111
&& tar -xf google-cloud-cli-410.tar.gz \
1212
&& ./google-cloud-sdk/install.sh \
1313
&& rm google-cloud-cli-410.tar.gz
14+
15+
ARG USERNAME=yetone
16+
ARG USER_UID=1000
17+
ARG USER_GID=$USER_UID
18+
19+
# Create the user
20+
RUN groupadd --gid $USER_GID $USERNAME \
21+
&& useradd --uid $USER_UID --gid $USER_GID -m $USERNAME
22+
23+
USER $USER_UID:$USER_GID

bento-downloader/Makefile renamed to container_images/bento-downloader/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
IMAGE := quay.io/bentoml/bento-downloader:0.0.1
1+
IMAGE := quay.io/bentoml/bento-downloader:0.0.3
22

33
build:
44
docker build -t ${IMAGE} .

‎container_images/buildah/Dockerfile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
FROM quay.io/buildah/stable:v1.23.1
2+
3+
ARG BENTO_USER_UID=1034
4+
ARG BENTO_USER_GID=1034
5+
6+
RUN touch /etc/subgid /etc/subuid \
7+
&& chmod g=u /etc/subgid /etc/subuid /etc/passwd \
8+
&& echo build:$BENTO_USER_UID:$BENTO_USER_GID > /etc/subuid \
9+
&& echo build:$BENTO_USER_UID:$BENTO_USER_GID > /etc/subgid
10+
11+
# Use chroot since the default runc does not work when running rootless
12+
RUN echo "export BUILDAH_ISOLATION=chroot" >> /home/build/.bashrc
13+
14+
USER $BENTO_USER_UID:$BENTO_USER_GID
15+
WORKDIR /home/build
16+

‎container_images/buildah/Makefile‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
IMAGE := quay.io/bentoml/bentoml-buildah:0.0.1
2+
3+
build:
4+
docker build -t ${IMAGE} .
5+
docker push ${IMAGE}

‎controllers/resources/bentorequest_controller.go‎

Lines changed: 29 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1200,6 +1200,17 @@ echo "Done"
12001200
})
12011201
}
12021202

1203+
restrictedSecurityContext := &corev1.SecurityContext{
1204+
AllowPrivilegeEscalation: pointer.BoolPtr(false),
1205+
RunAsNonRoot: pointer.BoolPtr(true),
1206+
SeccompProfile: &corev1.SeccompProfile{
1207+
Type: corev1.SeccompProfileTypeRuntimeDefault,
1208+
},
1209+
Capabilities: &corev1.Capabilities{
1210+
Drop: []corev1.Capability{"ALL"},
1211+
},
1212+
}
1213+
12031214
initContainers := []corev1.Container{
12041215
{
12051216
Name: "bento-downloader",
@@ -1209,9 +1220,10 @@ echo "Done"
12091220
"-c",
12101221
bentoDownloadCommand,
12111222
},
1212-
VolumeMounts: volumeMounts,
1213-
Resources: downloaderContainerResources,
1214-
EnvFrom: downloaderContainerEnvFrom,
1223+
VolumeMounts: volumeMounts,
1224+
Resources: downloaderContainerResources,
1225+
EnvFrom: downloaderContainerEnvFrom,
1226+
SecurityContext: restrictedSecurityContext,
12151227
},
12161228
}
12171229

@@ -1329,9 +1341,10 @@ echo "Done"
13291341
"-c",
13301342
modelDownloadCommand,
13311343
},
1332-
VolumeMounts: volumeMounts,
1333-
Resources: downloaderContainerResources,
1334-
EnvFrom: downloaderContainerEnvFrom,
1344+
VolumeMounts: volumeMounts,
1345+
Resources: downloaderContainerResources,
1346+
EnvFrom: downloaderContainerEnvFrom,
1347+
SecurityContext: restrictedSecurityContext,
13351348
})
13361349
}
13371350

@@ -1488,14 +1501,11 @@ echo "Done"
14881501
Privileged: pointer.BoolPtr(true),
14891502
}
14901503
} else if buildEngine == BentoImageBuildEngineBuildkitRootless {
1491-
kubeAnnotations["container.apparmor.security.beta.kubernetes.io/builder"] = "unconfined"
1492-
builderContainerSecurityContext = &corev1.SecurityContext{
1493-
SeccompProfile: &corev1.SeccompProfile{
1494-
Type: corev1.SeccompProfileTypeUnconfined,
1495-
},
1496-
RunAsUser: pointer.Int64Ptr(1000),
1497-
RunAsGroup: pointer.Int64Ptr(1000),
1504+
kubeAnnotations["container.apparmor.security.beta.kubernetes.io/builder"] = "runtime/default"
1505+
for _, container := range initContainers {
1506+
kubeAnnotations[fmt.Sprintf("container.apparmor.security.beta.kubernetes.io/%s", container.Name)] = "runtime/default"
14981507
}
1508+
builderContainerSecurityContext = restrictedSecurityContext.DeepCopy()
14991509
}
15001510

15011511
// add build args to pass via --build-arg
@@ -1614,6 +1624,12 @@ echo "Done"
16141624
Containers: []corev1.Container{
16151625
container,
16161626
},
1627+
SecurityContext: &corev1.PodSecurityContext{
1628+
RunAsNonRoot: pointer.BoolPtr(true),
1629+
SeccompProfile: &corev1.SeccompProfile{
1630+
Type: corev1.SeccompProfileTypeRuntimeDefault,
1631+
},
1632+
},
16171633
},
16181634
}
16191635

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.18
44

55
require (
66
github.com/aws/aws-sdk-go v1.44.152
7-
github.com/bentoml/yatai-common v0.0.0-20230108151027-0a54d02e79b1
7+
github.com/bentoml/yatai-common v0.0.0-20230109041943-798ca210a16d
88
github.com/bentoml/yatai-schemas v0.0.0-20221123041958-d3ff9b721451
99
github.com/huandu/xstrings v1.3.2
1010
github.com/iancoleman/strcase v0.2.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,8 @@ github.com/aws/aws-sdk-go v1.44.152 h1:L9aaepO8wHB67gwuGD8VgIYH/cmQDxieCt7FeLa0+
7777
github.com/aws/aws-sdk-go v1.44.152/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
7878
github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
7979
github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
80-
github.com/bentoml/yatai-common v0.0.0-20230108151027-0a54d02e79b1 h1:VgN2DLopHoMaEVOiD8J4bZO0L1BGXLRSmNSs7GkfbHo=
81-
github.com/bentoml/yatai-common v0.0.0-20230108151027-0a54d02e79b1/go.mod h1:pox0XYk/bVUwKkadn0XwWHEbJmxSEeN3+HwGA4a8uOQ=
80+
github.com/bentoml/yatai-common v0.0.0-20230109041943-798ca210a16d h1:r+iumKOD+Ri4u2NggQYudjQurIYN2Rs0nOW48faSt9E=
81+
github.com/bentoml/yatai-common v0.0.0-20230109041943-798ca210a16d/go.mod h1:pox0XYk/bVUwKkadn0XwWHEbJmxSEeN3+HwGA4a8uOQ=
8282
github.com/bentoml/yatai-schemas v0.0.0-20221123041958-d3ff9b721451 h1:FNxCbN61Ev8ea6BXzlfmRUT5CYNmqlOv8zDRGs8ufVE=
8383
github.com/bentoml/yatai-schemas v0.0.0-20221123041958-d3ff9b721451/go.mod h1:q7tt064G8YIiAwQabKyVaKEdSIHYDQA9Oyt+kyCsflU=
8484
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=

‎helm/yatai-image-builder/values.yaml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,16 +27,16 @@ serviceAccount:
2727

2828
podAnnotations: {}
2929

30-
podSecurityContext: {}
31-
# fsGroup: 2000
30+
podSecurityContext:
31+
runAsNonRoot: true
32+
seccompProfile:
33+
type: RuntimeDefault
3234

33-
securityContext: {}
34-
# capabilities:
35-
# drop:
36-
# - ALL
37-
# readOnlyRootFilesystem: true
38-
# runAsNonRoot: true
39-
# runAsUser: 1000
35+
securityContext:
36+
allowPrivilegeEscalation: false
37+
capabilities:
38+
drop:
39+
- ALL
4040

4141
service:
4242
type: ClusterIP
@@ -96,7 +96,7 @@ aws:
9696
secretAccessKeyExistingSecretKey: ''
9797

9898
internalImages:
99-
bentoDownloader: quay.io/bentoml/bento-downloader:0.0.1
99+
bentoDownloader: quay.io/bentoml/bento-downloader:0.0.3
100100
kaniko: quay.io/bentoml/kaniko:1.9.1
101101
buildkit: quay.io/bentoml/buildkit:master
102102
buildkitRootless: quay.io/bentoml/buildkit:master-rootless

‎tests/e2e/e2e_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,9 @@ var _ = Describe("yatai-image-builder", Ordered, func() {
4949
cmd = exec.Command("kubectl", "-n", "yatai-image-builder", "logs", "--tail", "200", "-l", "app.kubernetes.io/name=yatai-image-builder")
5050
logs, _ = utils.Run(cmd)
5151
fmt.Println(string(logs))
52-
By("Cleaning up BentoRequest resources")
53-
cmd = exec.Command("kubectl", "delete", "-f", "tests/e2e/example.yaml")
54-
_, _ = utils.Run(cmd)
52+
// By("Cleaning up BentoRequest resources")
53+
// cmd = exec.Command("kubectl", "delete", "-f", "tests/e2e/example.yaml")
54+
// _, _ = utils.Run(cmd)
5555
})
5656

5757
Context("BentoRequest Operator", func() {

0 commit comments

Comments
 (0)