DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 26 Packages Projects Releases 1 Wiki Activity

Add ReadOnlyRoot mitigation for S6 overlay (#1030)

Browse Source 
* Add ReadOnlyRoot mitigation for S6 overlay

* try to fix some tests
This commit is contained in:
Kjeld Schouten-Lebbing
2021-09-25 15:11:51 +02:00
committed by GitHub
parent 9bd2cf2de1
commit 37963de155
3 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/library/common/Chart.yaml
+1 -1
View File
@@ -15,4 +15,4 @@ maintainers:
name: common name: common
sources: null sources: null
type: library type: library
version: 8.0.1 version: 8.0.2
charts/library/common/templates/lib/controller/_container.tpl
+4
View File
@@ -35,6 +35,10 @@
{{- end }} {{- end }}
env: env:
{{- if .Values.securityContext.readOnlyRootFilesystem }}
- name: S6_READ_ONLY_ROOT
value: "1"
{{- end }}
{{- range $key, $value := .Values.envTpl }} {{- range $key, $value := .Values.envTpl }}
- name: {{ $key }} - name: {{ $key }}
value: {{ tpl $value $ | quote }} value: {{ tpl $value $ | quote }}
charts/library/common/tests/container_test.go
+9 -8
View File
@@ -98,14 +98,14 @@ func (suite *ContainerTestSuite) TestEnv() {
values []string values []string
expectedEnv map[string]string expectedEnv map[string]string
}{ }{
"Default": {values: nil, expectedEnv: nil}, "Default": {values: nil, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1"}},
"KeyValueString": {values: []string{"env.string=value_of_env"}, expectedEnv: map[string]string{"string": "value_of_env"}}, "KeyValueString": {values: []string{"env.string=value_of_env"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "string": "value_of_env"}},
"KeyValueFloat": {values: []string{"env.float=4.2"}, expectedEnv: map[string]string{"float": "4.2"}}, "KeyValueFloat": {values: []string{"env.float=4.2"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "float": "4.2"}},
"KeyValueBool": {values: []string{"env.bool=false"}, expectedEnv: map[string]string{"bool": "false"}}, "KeyValueBool": {values: []string{"env.bool=false"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "bool":"false"}},
"KeyValueInt": {values: []string{"env.int=42"}, expectedEnv: map[string]string{"int": "42"}}, "KeyValueInt": {values: []string{"env.int=42"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "int": "42"}},
"KeyValue+ExplicitValueFrom": {values: []string{"env.STATIC_ENV=value_of_env", "env.STATIC_ENV_FROM.valueFrom.fieldRef.fieldPath=spec.nodeName"}, expectedEnv: map[string]string{"STATIC_ENV": "value_of_env", "STATIC_ENV_FROM": "spec.nodeName"}}, "KeyValue+ExplicitValueFrom": {values: []string{"env.STATIC_ENV=value_of_env", "env.STATIC_ENV_FROM.valueFrom.fieldRef.fieldPath=spec.nodeName"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "STATIC_ENV": "value_of_env", "STATIC_ENV_FROM": "spec.nodeName"}},
"ImplicitValueFrom": {values: []string{"env.NODE_NAME.fieldRef.fieldPath=spec.nodeName"}, expectedEnv: map[string]string{"NODE_NAME": "spec.nodeName"}}, "ImplicitValueFrom": {values: []string{"env.NODE_NAME.fieldRef.fieldPath=spec.nodeName"}, expectedEnv: map[string]string{"NODE_NAME": "spec.nodeName", "S6_READ_ONLY_ROOT":"1"}},
"Templated": {values: []string{`env.DYN_ENV=\{\{ .Release.Name \}\}-admin`}, expectedEnv: map[string]string{"DYN_ENV": "common-test-admin"}}, "Templated": {values: []string{`env.DYN_ENV=\{\{ .Release.Name \}\}-admin`}, expectedEnv: map[string]string{"DYN_ENV": "common-test-admin", "S6_READ_ONLY_ROOT":"1"}},
"Mixed": { "Mixed": {
values: []string{ values: []string{
`env.DYN_ENV=\{\{ .Release.Name \}\}-admin`, `env.DYN_ENV=\{\{ .Release.Name \}\}-admin`,
@@ -115,6 +115,7 @@ func (suite *ContainerTestSuite) TestEnv() {
}, },
expectedEnv: map[string]string{ expectedEnv: map[string]string{
"DYN_ENV": "common-test-admin", "DYN_ENV": "common-test-admin",
"S6_READ_ONLY_ROOT": "1", "
"STATIC_ENV": "value_of_env", "STATIC_ENV": "value_of_env",
"STATIC_EXPLICIT_ENV_FROM": "spec.nodeName", "STATIC_EXPLICIT_ENV_FROM": "spec.nodeName",
"STATIC_IMPLICIT_ENV_FROM": "spec.nodeName", "STATIC_IMPLICIT_ENV_FROM": "spec.nodeName",