Security context of init containers #671

New Issue

2024-07-02T06:50:40Z

inzanez commented

2024-07-02 06:50:40 +00:00

(Migrated from gitea.com)

Hi

I just tried installling the latest Gitea version with the chart on a hardened RKE2 cluster. I set:

securityContext:
  allowPrivilegeEscalation: false
  runAsUser: 1000
  capabilities:
    drop:
    - ALL

but it seems that this does not apply to the init containers:

W0702 08:42:08.699388    5916 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "init-directories", "init-app-ini", "configure-gitea", "gitea" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "init-directories", "init-app-ini", "configure-gitea", "gitea" must set securityContext.capabilities.drop=["ALL"])

Is there a way to configure these settings for the init containers at all?

Hi I just tried installling the latest Gitea version with the chart on a hardened RKE2 cluster. I set: ``` securityContext: allowPrivilegeEscalation: false runAsUser: 1000 capabilities: drop: - ALL ``` but it seems that this does not apply to the init containers: ``` W0702 08:42:08.699388 5916 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "init-directories", "init-app-ini", "configure-gitea", "gitea" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "init-directories", "init-app-ini", "configure-gitea", "gitea" must set securityContext.capabilities.drop=["ALL"]) ``` Is there a way to configure these settings for the init containers at all?

pat-s commented

2024-07-02 08:52:00 +00:00

(Migrated from gitea.com)

1ac39a6f5d/templates/gitea/deployment.yaml (L92-L93)

https://gitea.com/gitea/helm-chart/src/commit/1ac39a6f5dd0dc09c2fd933f79d75d883bf4278d/templates/gitea/deployment.yaml#L92-L93

loic-seguin commented

2024-07-24 14:45:24 +00:00

(Migrated from gitea.com)

Same problem here, I have tried this in the values.yml

containerSecurityContext:
  runAsUser: 1002260000
  fsGroup: 1002260000

and it seems that only the value runAsUser is taken in account.

Same problem here, I have tried this in the values.yml ``` containerSecurityContext: runAsUser: 1002260000 fsGroup: 1002260000 ``` and it seems that only the value runAsUser is taken in account.

pat-s commented

2024-08-29 09:53:55 +00:00

(Migrated from gitea.com)

The values should be inserted as-is based on the template logic.
Can you show that these are not injected into the pod spec at runtime?

Note that "having an/the desired effect" is different again compared to the values not being injected in the first place.

@inzanez It seems you've used the deprecated securityContext which is not taken care of in all init containers. Using containerSecurityContext should do it.

The values should be inserted as-is based on the template logic. Can you show that these are not injected into the pod spec at runtime? Note that "having an/the desired effect" is different again compared to the values not being injected in the first place. @inzanez It seems you've used the deprecated `securityContext` which is not taken care of in all init containers. Using `containerSecurityContext` should do it.

justusbunsi commented

2024-11-10 14:13:44 +00:00

(Migrated from gitea.com)

Same problem here, I have tried this in the values.yml
containerSecurityContext:
  runAsUser: 1002260000
  fsGroup: 1002260000
and it seems that only the value runAsUser is taken in account.

To my knowledge, Kubernetes only takes fsGroup into account on pod-level securityContext.

> Same problem here, I have tried this in the values.yml > > ``` > containerSecurityContext: > runAsUser: 1002260000 > fsGroup: 1002260000 > ``` > > and it seems that only the value runAsUser is taken in account. To my knowledge, Kubernetes only takes `fsGroup` into account on pod-level `securityContext`.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lunny/helm-chart#671