Skip to content

Commit c224a45

Browse files
csatib02csatib02
authored
Merge pull request #2119 from kube-logging/copilot/fix-da90e475-f896-4ae8-af46-0cc6d4fe3890
fix: buffer-metrics-sidecar running as root user
2 parents 0fad6c6 + 4a3670d commit c224a45

File tree

5 files changed

+64
-17
lines changed

5 files changed

+64
-17
lines changed

‎images/node-exporter/Dockerfile‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,14 @@ COPY --from=custom-runner /runner /
66

77
USER root
88

9-
RUN mkdir -p /prometheus/node_exporter/textfile_collector
9+
RUN mkdir -p /prometheus/node_exporter/textfile_collector && \
10+
chown -R nobody:nobody /prometheus
1011

1112
COPY buffer-size.sh /prometheus/buffer-size.sh
12-
RUN chmod 0744 /prometheus/buffer-size.sh
13+
RUN chmod 0755 /prometheus/buffer-size.sh && \
14+
chown nobody:nobody /prometheus/buffer-size.sh
15+
16+
USER nobody:nobody
1317

1418
WORKDIR /
1519

‎pkg/resources/fluentbit/daemonset.go‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,16 @@ func (r *Reconciler) bufferMetricsSidecarContainer() *corev1.Container {
316316
nodeExporterCmd := fmt.Sprintf("nodeexporter -> ./bin/node_exporter %v", strings.Join(args, " "))
317317
bufferSizeCmd := "buffersize -> /prometheus/buffer-size.sh"
318318

319+
securityContext := &corev1.SecurityContext{
320+
RunAsNonRoot: util.BoolPointer(true),
321+
RunAsUser: util.IntPointer64(65534),
322+
RunAsGroup: util.IntPointer64(65534),
323+
AllowPrivilegeEscalation: util.BoolPointer(false),
324+
Capabilities: &corev1.Capabilities{
325+
Drop: []corev1.Capability{"ALL"},
326+
},
327+
}
328+
319329
return &corev1.Container{
320330
Name: "buffer-metrics-sidecar",
321331
Image: r.fluentbitSpec.BufferVolumeImage.RepositoryWithTag(),
@@ -338,7 +348,7 @@ func (r *Reconciler) bufferMetricsSidecarContainer() *corev1.Container {
338348
},
339349
},
340350
Resources: r.fluentbitSpec.BufferVolumeResources,
341-
SecurityContext: r.fluentbitSpec.Security.SecurityContext,
351+
SecurityContext: securityContext,
342352
LivenessProbe: r.fluentbitSpec.BufferVolumeLivenessProbe,
343353
}
344354
}

‎pkg/resources/fluentd/statefulset.go‎

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ func generateVolumeMounts(spec *v1beta1.FluentdSpec) []corev1.VolumeMount {
281281
MountPath: "/fluentd/tls/",
282282
})
283283
}
284-
if isFluentdReadOnlyRootFilesystem(spec) {
284+
if spec.Security.IsReadOnlyRootFilesystem() {
285285
res = append(res, corev1.VolumeMount{
286286
Name: "tmp",
287287
SubPath: "fluentd",
@@ -311,7 +311,7 @@ func (r *Reconciler) generateVolume() (v []corev1.Volume) {
311311
},
312312
}
313313

314-
if isFluentdReadOnlyRootFilesystem(r.fluentdSpec) {
314+
if r.fluentdSpec.Security.IsReadOnlyRootFilesystem() {
315315
v = append(v, corev1.Volume{
316316
Name: "tmp",
317317
VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}},
@@ -359,7 +359,7 @@ func (r *Reconciler) generateVolume() (v []corev1.Volume) {
359359
}
360360

361361
func (r *Reconciler) tmpDirHackContainer() *corev1.Container {
362-
if isFluentdReadOnlyRootFilesystem(r.fluentdSpec) {
362+
if r.fluentdSpec.Security.IsReadOnlyRootFilesystem() {
363363
return &corev1.Container{
364364
Command: []string{"sh", "-c", "mkdir -p /mnt/tmp/fluentd/; chmod +t /mnt/tmp/fluentd"},
365365
Image: r.fluentdSpec.Image.RepositoryWithTag(),
@@ -412,6 +412,28 @@ func (r *Reconciler) bufferMetricsSidecarContainer() *corev1.Container {
412412
nodeExporterCmd := fmt.Sprintf("nodeexporter -> ./bin/node_exporter %v", strings.Join(args, " "))
413413
bufferSizeCmd := "buffersize -> /prometheus/buffer-size.sh"
414414

415+
securityContext := &corev1.SecurityContext{
416+
RunAsNonRoot: util.BoolPointer(true),
417+
RunAsUser: util.IntPointer64(65534),
418+
RunAsGroup: util.IntPointer64(65534),
419+
AllowPrivilegeEscalation: util.BoolPointer(false),
420+
Capabilities: &corev1.Capabilities{
421+
Drop: []corev1.Capability{"ALL"},
422+
},
423+
}
424+
// Allow override from fluentdSpec if SecurityContext is explicitly set
425+
if r.fluentdSpec.Security.SecurityContext != nil {
426+
// Check if RunAsUser or RunAsGroup is explicitly set to something other than the fluentd defaults
427+
if r.fluentdSpec.Security.SecurityContext.RunAsUser != nil && *r.fluentdSpec.Security.SecurityContext.RunAsUser != 100 &&
428+
r.fluentdSpec.Security.SecurityContext.RunAsGroup != nil && *r.fluentdSpec.Security.SecurityContext.RunAsGroup != 101 {
429+
securityContext = r.fluentdSpec.Security.SecurityContext
430+
}
431+
432+
if r.fluentdSpec.Security.IsReadOnlyRootFilesystem() {
433+
r.Log.Info("ReadOnlyRootFilesystem is set, buffer-metrics-sidecar could fail!")
434+
}
435+
}
436+
415437
return &corev1.Container{
416438
Name: "buffer-metrics-sidecar",
417439
Image: r.fluentdSpec.BufferVolumeImage.RepositoryWithTag(),
@@ -434,7 +456,7 @@ func (r *Reconciler) bufferMetricsSidecarContainer() *corev1.Container {
434456
},
435457
},
436458
Resources: r.fluentdSpec.BufferVolumeResources,
437-
SecurityContext: r.fluentdSpec.Security.SecurityContext,
459+
SecurityContext: securityContext,
438460
LivenessProbe: r.fluentdSpec.BufferVolumeLivenessProbe,
439461
}
440462
}
@@ -514,11 +536,3 @@ func generateInitContainer(spec v1beta1.FluentdSpec) *corev1.Container {
514536
}
515537
return nil
516538
}
517-
518-
func isFluentdReadOnlyRootFilesystem(spec *v1beta1.FluentdSpec) bool {
519-
if spec.Security.SecurityContext.ReadOnlyRootFilesystem != nil {
520-
return *spec.Security.SecurityContext.ReadOnlyRootFilesystem
521-
}
522-
523-
return false
524-
}

‎pkg/resources/syslogng/statefulset.go‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,16 @@ func (r *Reconciler) bufferMetricsSidecarContainer() *corev1.Container {
266266
nodeExporterCmd := fmt.Sprintf("nodeexporter -> ./bin/node_exporter %v", strings.Join(args, " "))
267267
bufferSizeCmd := "buffersize -> /prometheus/buffer-size.sh"
268268

269+
securityContext := &corev1.SecurityContext{
270+
RunAsNonRoot: util.BoolPointer(true),
271+
RunAsUser: util.IntPointer64(65534),
272+
RunAsGroup: util.IntPointer64(65534),
273+
AllowPrivilegeEscalation: util.BoolPointer(false),
274+
Capabilities: &corev1.Capabilities{
275+
Drop: []corev1.Capability{"ALL"},
276+
},
277+
}
278+
269279
return &corev1.Container{
270280
Name: "buffer-metrics-sidecar",
271281
Image: r.syslogNGSpec.BufferVolumeMetricsImage.RepositoryWithTag(),
@@ -288,8 +298,9 @@ func (r *Reconciler) bufferMetricsSidecarContainer() *corev1.Container {
288298
MountPath: BufferPath,
289299
},
290300
},
291-
Resources: r.syslogNGSpec.BufferVolumeMetricsResources,
292-
LivenessProbe: r.syslogNGSpec.BufferVolumeMetricsLivenessProbe,
301+
Resources: r.syslogNGSpec.BufferVolumeMetricsResources,
302+
SecurityContext: securityContext,
303+
LivenessProbe: r.syslogNGSpec.BufferVolumeMetricsLivenessProbe,
293304
}
294305
}
295306
return nil

‎pkg/sdk/logging/api/v1beta1/common_types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,14 @@ type Security struct {
159159
CreateOpenShiftSCC *bool `json:"createOpenShiftSCC,omitempty"`
160160
}
161161

162+
func (s *Security) IsReadOnlyRootFilesystem() bool {
163+
if s.SecurityContext.ReadOnlyRootFilesystem != nil {
164+
return *s.SecurityContext.ReadOnlyRootFilesystem
165+
}
166+
167+
return false
168+
}
169+
162170
// ReadinessDefaultCheck Enable default readiness checks
163171
type ReadinessDefaultCheck struct {
164172
// Enable default Readiness check it'll fail if the buffer volume free space exceeds the `readinessDefaultThreshold` percentage (90%).

0 commit comments

Comments
 (0)