Merge pull request #1593 from prometheus-operator/as/forbid-privilege-scalation

Explicitly declare allowPrivilegeEscalation to false in all components

Makefile

@@ -66,7 +66,7 @@ kubeconform: crdschemas manifests $(KUBECONFORM_BIN)
 
 .PHONY: kubescape
 kubescape: $(KUBESCAPE_BIN) ## Runs a security analysis on generated manifests - failing if risk score is above 40%
-	$(KUBESCAPE_BIN) scan -s framework -t 40 nsa manifests/*.yaml
+	$(KUBESCAPE_BIN) scan -s framework -t 30 nsa manifests/*.yaml
 
 .PHONY: fmt
 fmt: $(JSONNETFMT_BIN)

jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet

@@ -172,6 +172,7 @@ function(params) {
       } else {
         runAsNonRoot: true,
         runAsUser: 65534,
+        allowPrivilegeEscalation: false,
       },
       volumeMounts: [{
         mountPath: '/etc/blackbox_exporter/',
@@ -188,7 +189,11 @@ function(params) {
         '--volume-dir=/etc/blackbox_exporter/',
       ],
       resources: bb._config.resources,
-      securityContext: { runAsNonRoot: true, runAsUser: 65534 },
+      securityContext: {
+        runAsNonRoot: true,
+        runAsUser: 65534,
+        allowPrivilegeEscalation: false,
+      },
       terminationMessagePath: '/dev/termination-log',
       terminationMessagePolicy: 'FallbackToLogsOnError',
       volumeMounts: [{

jsonnet/kube-prometheus/components/grafana.libsonnet

@@ -83,4 +83,20 @@ function(params)
         }],
       },
     },
+
+    // FIXME(ArthurSens): The override adding 'allowPrivilegeEscalation: false' can be deleted when
+    // https://github.com/brancz/kubernetes-grafana/pull/128 gets merged.
+    deployment+: {
+      spec+: {
+        template+: {
+          spec+: {
+            containers: std.map(function(c) c {
+              securityContext+: {
+                allowPrivilegeEscalation: false,
+              },
+            }, super.containers),
+          },
+        },
+      },
+    },
   }

jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet

@@ -61,5 +61,6 @@ function(params) {
     runAsUser: 65532,
     runAsGroup: 65532,
     runAsNonRoot: true,
+    allowPrivilegeEscalation: false,
   },
 }

jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet

@@ -118,6 +118,8 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
     image: ksm._config.kubeRbacProxyImage,
   }),
 
+  // FIXME(ArthurSens): The override adding 'allowPrivilegeEscalation: false' can be deleted when
+  // https://github.com/kubernetes/kube-state-metrics/pull/1668 gets merged.
   deployment+: {
     spec+: {
       template+: {
@@ -133,6 +135,9 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
             readinessProbe:: null,
             args: ['--host=127.0.0.1', '--port=8081', '--telemetry-host=127.0.0.1', '--telemetry-port=8082'],
             resources: ksm._config.resources,
+            securityContext+: {
+              allowPrivilegeEscalation: false,
+            },
           }, super.containers) + [kubeRbacProxyMain, kubeRbacProxySelf],
         },
       },

jsonnet/kube-prometheus/components/node-exporter.libsonnet

@@ -181,6 +181,9 @@ function(params) {
         { name: 'root', mountPath: '/host/root', mountPropagation: 'HostToContainer', readOnly: true },
       ],
       resources: ne._config.resources,
+      securityContext: {
+        allowPrivilegeEscalation: false,
+      },
     };
 
     local kubeRbacProxy = krp({

jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet

@@ -226,6 +226,9 @@ function(params) {
         { name: 'volume-serving-cert', mountPath: '/var/run/serving-cert', readOnly: false },
         { name: 'config', mountPath: '/etc/adapter', readOnly: false },
       ],
+      securityContext: {
+        allowPrivilegeEscalation: false,
+      },
     };
 
     {

manifests/blackboxExporter-deployment.yaml

@@ -42,6 +42,7 @@ spec:
             cpu: 10m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
           runAsNonRoot: true
           runAsUser: 65534
         volumeMounts:
@@ -61,6 +62,7 @@ spec:
             cpu: 10m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
           runAsNonRoot: true
           runAsUser: 65534
         terminationMessagePath: /dev/termination-log
@@ -87,6 +89,7 @@ spec:
             cpu: 10m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532

manifests/grafana-deployment.yaml

@@ -45,6 +45,8 @@ spec:
           requests:
             cpu: 100m
             memory: 100Mi
+        securityContext:
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/lib/grafana
           name: grafana-storage

manifests/kubeStateMetrics-deployment.yaml

@@ -42,6 +42,7 @@ spec:
             cpu: 10m
             memory: 190Mi
         securityContext:
+          allowPrivilegeEscalation: false
           runAsUser: 65534
       - args:
         - --logtostderr
@@ -61,6 +62,7 @@ spec:
             cpu: 20m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
@@ -82,6 +84,7 @@ spec:
             cpu: 10m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532

manifests/nodeExporter-daemonset.yaml

@@ -43,6 +43,8 @@ spec:
           requests:
             cpu: 102m
             memory: 180Mi
+        securityContext:
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /host/sys
           mountPropagation: HostToContainer
@@ -76,6 +78,7 @@ spec:
             cpu: 10m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532

manifests/prometheusAdapter-deployment.yaml

@@ -47,6 +47,8 @@ spec:
           requests:
             cpu: 102m
             memory: 180Mi
+        securityContext:
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /tmp
           name: tmpfs

manifests/prometheusOperator-deployment.yaml

@@ -62,6 +62,7 @@ spec:
             cpu: 10m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532