Restrict ArgoCD Redis ServiceAccount to restricted-v2 SCC #1668
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Mangaal
changed the title
Signed-off-by: Mangaal <angommeeteimangaal@gmail.com>
Mangaal
changed the title
controllers/argocd/policyrule.go
Outdated
| }, | ||
| } | ||
|
|
||
| // Need additional policy rules if we are running on openshift, else the stateful set won't have the right |
There was a problem hiding this comment.
Most probably this comment needs to be rewritten (mentioning that on OpenShift we make sure the Pods are running under the least allowed privilege) or dropped altogether.
Contributor
Author
There was a problem hiding this comment.
Thanks @EmmanuelKasper , I have added the suggested comment
svghadi
reviewed
Feb 19, 2025
controllers/argocd/deployment.go
Outdated
Comment on lines
470
to
535
| if IsOpenShiftCluster() { | ||
| deploy.Spec.Template.Spec.Containers = []corev1.Container{{ | ||
| Args: getArgoRedisArgs(useTLS), | ||
| Image: getRedisContainerImage(cr), | ||
| ImagePullPolicy: corev1.PullAlways, | ||
| Name: "redis", | ||
| Ports: []corev1.ContainerPort{ | ||
| { | ||
| ContainerPort: common.ArgoCDDefaultRedisPort, | ||
| }, | ||
| }, | ||
| }, | ||
| Resources: getRedisResources(cr), | ||
| Env: env, | ||
| SecurityContext: &corev1.SecurityContext{ | ||
| AllowPrivilegeEscalation: boolPtr(false), | ||
| Capabilities: &corev1.Capabilities{ | ||
| Drop: []corev1.Capability{ | ||
| "ALL", | ||
| Resources: getRedisResources(cr), | ||
| Env: env, | ||
| SecurityContext: &corev1.SecurityContext{ | ||
| AllowPrivilegeEscalation: boolPtr(false), | ||
| Capabilities: &corev1.Capabilities{ | ||
| Drop: []corev1.Capability{ | ||
| "ALL", | ||
| }, | ||
| }, | ||
| RunAsNonRoot: boolPtr(true), | ||
| SeccompProfile: &corev1.SeccompProfile{ | ||
| Type: "RuntimeDefault", | ||
| }, | ||
| }, | ||
| RunAsNonRoot: boolPtr(true), | ||
| RunAsUser: int64Ptr(999), | ||
| SeccompProfile: &corev1.SeccompProfile{ | ||
| Type: "RuntimeDefault", | ||
| VolumeMounts: []corev1.VolumeMount{ | ||
| { | ||
| Name: common.ArgoCDRedisServerTLSSecretName, | ||
| MountPath: "/app/config/redis/tls", | ||
| }, | ||
| }, | ||
| }, | ||
| VolumeMounts: []corev1.VolumeMount{ | ||
| { | ||
| Name: common.ArgoCDRedisServerTLSSecretName, | ||
| MountPath: "/app/config/redis/tls", | ||
| }} | ||
| } else { | ||
| deploy.Spec.Template.Spec.Containers = []corev1.Container{{ | ||
| Args: getArgoRedisArgs(useTLS), | ||
| Image: getRedisContainerImage(cr), | ||
| ImagePullPolicy: corev1.PullAlways, | ||
| Name: "redis", | ||
| Ports: []corev1.ContainerPort{ | ||
| { | ||
| ContainerPort: common.ArgoCDDefaultRedisPort, | ||
| }, | ||
| }, | ||
| }, | ||
| }} | ||
| Resources: getRedisResources(cr), | ||
| Env: env, | ||
| SecurityContext: &corev1.SecurityContext{ | ||
| AllowPrivilegeEscalation: boolPtr(false), | ||
| Capabilities: &corev1.Capabilities{ | ||
| Drop: []corev1.Capability{ | ||
| "ALL", | ||
| }, | ||
| }, | ||
| RunAsNonRoot: boolPtr(true), | ||
| RunAsUser: int64Ptr(999), | ||
| SeccompProfile: &corev1.SeccompProfile{ | ||
| Type: "RuntimeDefault", | ||
| }, | ||
| }, | ||
| VolumeMounts: []corev1.VolumeMount{ | ||
| { | ||
| Name: common.ArgoCDRedisServerTLSSecretName, | ||
| MountPath: "/app/config/redis/tls", | ||
| }, | ||
| }, | ||
| }} | ||
| } |
Collaborator
There was a problem hiding this comment.
The only thing that changes between k8s and openshift is
RunAsUser: int64Ptr(999),Can you simplify the if? Maybe try using deploy.Spec.Template.Spec.SecurityContext like redis ha statefulset or use a var for securitycontext value and set that in deploy.Spec.Template.Spec.Containers[*]
Also can we try changing the user to 1000 or 1001 if the redis image supports it on k8s?
Contributor
Author
There was a problem hiding this comment.
Thanks, @svghadi , its works with user 1000.
kubectl get po -n kuttl-test-tight-wallaby
NAME READY STATUS RESTARTS AGE
argocd-application-controller-0 1/1 Running 0 13s
argocd-redis-56996db676-nplfr 1/1 Running 0 14s
argocd-repo-server-7f864dd87b-x7r7x 1/1 Running 0 14s
argocd-server-8678799b84-c54dz 1/1 Running 0 14s
kubectl get po -n kuttl-test-tight-wallaby argocd-redis-56996db676-nplfr -o jsonpath={.spec.securityContext.runAsUser}
1000
Signed-off-by: Mangaal <angommeeteimangaal@gmail.com>
Signed-off-by: Mangaal <angommeeteimangaal@gmail.com>
Contributor
|
LGTM, Thanks @Mangaal |
This was referenced Feb 20, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
In OpenShift clusters using the GitOps Operator, the argocd-redis ServiceAccount currently inherits the nonroot-v2 SecurityContextConstraints (SCC). This grants more privileges than the standard restricted-v2 SCC, allowing other pods in the namespace to use this ServiceAccount with elevated permissions.
This PR updates both cluster-scoped and namespace-scoped ArgoCD instances to use the restricted-v2 SCC for the Redis ServiceAccount
/kind bug
Verification: No Issues Running with restricted-v2 SCC
To confirm that using restricted-v2 SCC does not cause any issues, we checked an ArgoCD instance in another namespace (test-argocd), where all components are running as expected under restricted-v2:
Checking the SCC assigned to the Redis components:
Fixes #?
#1662