Merge pull request #1610 from ArthurSens/as/linux-hardening

Drop Linux capabilities

jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet

@@ -175,6 +175,7 @@ function(params) {
         runAsUser: 65534,
         allowPrivilegeEscalation: false,
         readOnlyRootFilesystem: true,
+        capabilities: { drop: ['ALL'] },
       },
       volumeMounts: [{
         mountPath: '/etc/blackbox_exporter/',
@@ -196,6 +197,7 @@ function(params) {
         runAsUser: 65534,
         allowPrivilegeEscalation: false,
         readOnlyRootFilesystem: true,
+        capabilities: { drop: ['ALL'] },
       },
       terminationMessagePath: '/dev/termination-log',
       terminationMessagePolicy: 'FallbackToLogsOnError',

jsonnet/kube-prometheus/components/grafana.libsonnet

@@ -87,6 +87,7 @@ function(params)
     // FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
     // 'allowPrivilegeEscalation: false' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/128 gets merged.
     // 'readOnlyRootFilesystem: true' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/129 gets merged.
+    // 'capabilities: { drop: ['ALL'] }' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/130 gets merged.
     deployment+: {
       spec+: {
         template+: {
@@ -95,6 +96,7 @@ function(params)
               securityContext+: {
                 allowPrivilegeEscalation: false,
                 readOnlyRootFilesystem: true,
+                capabilities: { drop: ['ALL'] },
               },
             }, super.containers),
           },

jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet

@@ -63,5 +63,6 @@ function(params) {
     runAsNonRoot: true,
     allowPrivilegeEscalation: false,
     readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
   },
 }

jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet

@@ -118,6 +118,8 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
     image: ksm._config.kubeRbacProxyImage,
   }),
 
+  // FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
+  // 'capabilities: { drop: ['ALL'] },' can be deleted when https://github.com/kubernetes/kube-state-metrics/pull/1674 gets merged.
   deployment+: {
     spec+: {
       template+: {
@@ -133,6 +135,9 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
             readinessProbe:: null,
             args: ['--host=127.0.0.1', '--port=8081', '--telemetry-host=127.0.0.1', '--telemetry-port=8082'],
             resources: ksm._config.resources,
+            securityContext+: {
+              capabilities: { drop: ['ALL'] },
+            },
           }, super.containers) + [kubeRbacProxyMain, kubeRbacProxySelf],
         },
       },

jsonnet/kube-prometheus/components/node-exporter.libsonnet

@@ -184,6 +184,7 @@ function(params) {
       securityContext: {
         allowPrivilegeEscalation: false,
         readOnlyRootFilesystem: true,
+        capabilities: { drop: ['ALL'], add: ['CAP_SYS_TIME'] },
       },
     };
 

jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet

@@ -229,6 +229,7 @@ function(params) {
       securityContext: {
         allowPrivilegeEscalation: false,
         readOnlyRootFilesystem: true,
+        capabilities: { drop: ['ALL'] },
       },
     };
 

jsonnet/kube-prometheus/components/prometheus-operator.libsonnet

@@ -125,11 +125,17 @@ function(params)
       image: po._config.kubeRbacProxyImage,
     }),
 
+    // FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
+    // 'capabilities: { drop: ['ALL'] },' can be deleted when https://github.com/prometheus-operator/prometheus-operator/pull/4546 gets merged.
     deployment+: {
       spec+: {
         template+: {
           spec+: {
-            containers+: [kubeRbacProxy],
+            containers: std.map(function(c) c {
+              securityContext+: {
+                capabilities: { drop: ['ALL'] },
+              },
+            }, super.containers) + [kubeRbacProxy],
           },
         },
       },