Decorating devpod and builder pod with security context in kubernetes?

[arheom]

Ask a question

In order to run Karavan inside our environment, we need to pass some security policies. Some of them, need some changes inside the pod / deployment files. Is there any way I can make those changes (under securityContext) for the builder pod and demo / dev pod? For the actual project, I know, I can use the jkube files to ensure the settings, but not sure about the builder and the dev run ones?

Variant

Web Application

Container Management (if applicable)

Kubernetes

Operating System (if applicable)

MacOS

Version

4.7.0

[mgubaidullin]

Resources menu -> configuration project -> builder.pod.jkube.yaml
Set securityContext and it should apply to DevMode and builder

[schoettkert]

I tried this solution, but i assume securityContext on container level is overwritten by KubernetesService:

Container container = new ContainerBuilder()
                .withName(name)
                .withImage(projectDevmodeImage != null ? projectDevmodeImage : devmodeImage)
                .withPorts(port)
                .withResources(resources)
                .withImagePullPolicy(devmodeImagePullPolicy.orElse("IfNotPresent"))
                .withEnv(new EnvVarBuilder().withName(ENV_VAR_JBANG_OPTIONS).withValue(jbangOptions).build())
                .withVolumeMounts(volumeMounts)
                .build();

spec:
  replicas: 1
  template:
    spec:
      securityContext:
        runAsUser: 1000
        runAsNonRoot: true
        runAsGroup: 1000
      containers:
        - securityContext:
          runAsUser: 1000
          runAsNonRoot: true
          runAsGroup: 1000
          capabilities:
            add:
              - CHOWN
            drop:
              - ALL

So my changes for capabilities to deployment.jkube.yaml are not transferred to the resulting deployment.

Which results in this error:
require-drop-all: 'validation failure: Containers must drop ALL capabilities.'

Is this correct?

[arheom]

For the builder, I cannot make it working as well. From what I can see in the code (KubernetesServices.java / getBuilderPod):

Pod pod = Serialization.unmarshal(configFragment, Pod.class);
Container container = new ContainerBuilder()
              .withName(name)
              .withImage(devmodeImage)
              .withPorts(port)
              .withImagePullPolicy(devmodeImagePullPolicy.orElse("IfNotPresent"))
              .withEnv(pod.getSpec().getContainers().get(0).getEnv())
              .withCommand("/bin/sh", "-c", "/karavan/builder/build.sh")
              .withVolumeMounts(volumeMounts)
              .build();

It loads into pod the securityContext, but it does not use it inside the container. Only the environment variables are used from the config fragment.

For the DevMode, the securityContext set outside of the containers is working, but the one inside the containers is overwritten in the code, indeed:

Deployment deployment = Serialization.unmarshal(deploymentFragment, Deployment.class);
...
podSpec = deployment.getSpec().getTemplate().getSpec();
....

Container container = new ContainerBuilder()
                .withName(name)
                .withImage(projectDevmodeImage != null ? projectDevmodeImage : devmodeImage)
                .withPorts(port)
                .withResources(resources)
                .withImagePullPolicy(devmodeImagePullPolicy.orElse("IfNotPresent"))
                .withEnv(new EnvVarBuilder().withName(ENV_VAR_JBANG_OPTIONS).withValue(jbangOptions).build())
                .withVolumeMounts(volumeMounts)
                .build();
...
podSpec.setContainers(List.of(container));
...
return new PodBuilder()
                .withMetadata(meta)
                .withSpec(podSpec)
                .build();

So, unfortunately both the dev mode and the builder cannot take the securityContext configured.

[arheom]

@mgubaidullin Would be OK if I open a new issue about this, and I can do PR to fix it?

[mgubaidullin]

Yes @arheom! You are welcome to contribute!