-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add seccompProfile
field in securityContext
instead of annotation
#118
Conversation
The kubeaudit-chart of CI failed. |
CI was failed as follows. And, I was able to reproduce the error in my local environment. The error is the following. $ kubeaudit all -k .github/kube-audit.yaml -f <(helm template --generate-name "charts/scalardb") -m error
---------------- Results for ---------------
apiVersion: apps/v1
kind: Deployment
metadata:
name: RELEASE-NAME-scalardb
namespace: default
--------------------------------------------
-- [error] SeccompAnnotationMissing
Message: Seccomp annotation is missing. The annotation seccomp.security.alpha.kubernetes.io/pod: runtime/default should be added.
Metadata:
MissingAnnotation: seccomp.security.alpha.kubernetes.io/pod The kubeaudit detects missing annotation And, I checked after disabling $ diff -u .github/kube-audit.yaml .github/kube-audit-disable-seccomp.yaml
--- .github/kube-audit.yaml 2022-07-20 15:31:05.908539923 +0900
+++ .github/kube-audit-disable-seccomp.yaml 2022-07-20 15:31:41.838540413 +0900
@@ -11,7 +11,7 @@
privesc: true
privileged: true
rootfs: false
- seccomp: true
+ seccomp: false
auditors:
capabilities:
allowAddList: ['NET_BIND_SERVICE'] As a result, there is no issue as follows. $ kubeaudit all -k .github/kube-audit-disable-seccomp.yaml -f <(helm template --generate-name "charts/scalardb") -m error
All checks completed. 0 high-risk vulnerabilities found Also, in the kubeaudit repository, this is a known issue and it is no fixed yet. So, we can ignore this CI error. |
I updated the CI (.github/kube-audit.yaml) in the following PR. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM! Thank you!
This PR adds
securityContext.seccompProfile
in each chart.In Scalar DB and Envoy chart, they are using annotation
seccomp.security.alpha.kubernetes.io/pod
for setting seccomp configuration.However, this annotation is deprecated and it will be not-functional in next Kubernetes release as follows.
Warning: spec.template.metadata.annotations[seccomp.security.alpha.kubernetes.io/pod]: deprecated since v1.19, non-functional in v1.25+; use the "seccompProfile" field instead
So, I removed deprecated annotation and added
securityContext.seccompProfile
for setting the same seccomp configuration.In Scalar DL (Ledger and Auditor) chart, there is no configuration related to the seccomp now.
So, I just added
securityContext.seccompProfile
for setting seccomp configuration to make them more secure.Please take a look!