bryopsida / psa-restricted-patcher

Automatically patches resources on admission to meet PSA restricted requirements

psa-restricted-patcher

NPM Scripts

The following scripts are available

• lint lints the source code using eslint
• lint:fix automatically fixes any lint errors that can be fixed automatically
• test uses jest to run test suites
• test:e2e runs e2e test suite, this requires an active helm:deploy
• build compiles the typescript into js and places it in the dist folder
• build:image builds the container image
• build:docs builds the api docs
• minikube:start create a minikube k8s cluster
• minikube:stop stop minikube but do not delete
• minikube:delete delete the minikube cluster
• helm:addRepos adds helm repos
• helm:deployCertManager deploy cert-manager for TLS
• helm:deploy deploy the app to k8s using helm
• helm:template print the k8s yaml that would be applied to k8s when using helm:deploy
• helm:uninstall remove the app from k8s
• helm:uninstallCertManager remove cert-manager from the k8s cluster

Deploy it

If you don't already have cert manager installed you will need to run:

helm repo add jetstack https://charts.jetstack.io && helm repo update && \
  helm upgrade --install --namespace cert-manager --create-namespace \
  cert-manager jetstack/cert-manager --set installCRDs=true --debug --wait

Add the helm repos helm repo add psa https://bryopsida.github.io/psa-restricted-patcher fetch updates helm repo update.

Verify it worked helm search repo psa and you should see something like.

NAME                                                    CHART VERSION   APP VERSION     DESCRIPTION
psa/psa-restricted-patcher...      0.1.0           0.1.0          ...

Deploy the app helm upgrade --install starter psa/psa-restricted-patcher

Verify it worked kubectl run testpod --image=busybox, this will be changed, fetch it's yaml kubectl get testpod -o yaml you will see its securityContext's have been enhanced.

psa-restricted-patcher's Issues

Allow upgrading when using certmanager

Currently after doing a default install with certmanager to get the TLS trust with the api server, the next upgrade requires updating the helm value set to include the public cert. Instead of doing this and making the user do something, we should do the following.

• Allow omitting the public cert
• Add watching of the TLS object or files and update the mutating webhook configuration, this is needed for rotations anyways

Add ignored/passthrough pod annotations

Add configurable map of annotations and values that when present on the pod will not be mutated.

Add targetted override capability

Add the ability to define a matcher as a key in a map, when a pod matches the key, use the override set for securityContexts to override the defaults. The intent here is to provide way to handle workloads that don't function with the default settings (perhaps UID:GID conflicts) where mechanisms to harden the securityContext are not available (third party tools that don't expose setting securityContexts).

Increase default allocations

Increase the default allocations to give a bit more head room, also wire readiness/liveness probes in to be better than just a socket check.

Add hook selector and match configurations

Add ability to scope requests sent to hook using selectors.

Object level:
https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector

Namespace level: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector

Conditions:
https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions

These should be optional pass through defines

Add option to randomly override UID/GID

As a maintainer I want an option to scramble the GID/UID of workloads that support it.

AC

1. Must have a global option to enable/disable the behavior
2. Must have an option to set the UID/GID ranges
3. Must have an annotation that can be set on the pod to disable the behavior.
4. Must have an option to only do this for workloads that do not specify a UID/GID

Options.

• .enableRandomUID (boolean)
• .enableOverridingExistingUID (boolean)
• .UIDRanges (array of objects containging start, stop numbers)
• .ignoreRandomUIDAnnotation (string) default 'github.io/bryopsida/psa-restricted-patcher/disable-random-uid'

Randomizer will randomly pick a range pool, and then randomly get a range from that pool, if Redis is available it will check to see if the UID/GID has recently been used and retry.

Add configuration of reinvocationPolicy

Add the ability to config the desired behavior of reinvocation: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions

Failure policy: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions

and timouts: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions

Define defaults in values.yaml and set values on manifest.

Update kubernetes client

Update to version 1.0.x of the node kubernetes client when its out of RC.

kubernetes-client/javascript#290

Add artifacthub-repo.yaml

Add artifacthub metadata file: https://github.com/artifacthub/hub/blob/master/docs/metadata/artifacthub-repo.yml

• Verified
• Official

Add capabilities drop

When capabilities or capabilities.dropis not provided, automatically setcapabilities.drop = ["ALL"]`

Add topologySpread

Add a topology spread: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ to encourage spreading the pods across nodes for a higher fault tolerance on node failure. Make permissive so if only one node is available the desired pod counts can still be obtained.