Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-2627

containers violate PodSecurity -- Loki

XMLWordPrintable

    • Log Storage - Sprint 221, Log Storage - Sprint 222

      From https://kubernetes.io/docs/concepts/security/pod-security-admission/
      In v1.23(OCP 4.11), the PodSecurity feature gate is a Beta feature and is enabled by default.

      The below logging containers violate PodSecurity
      #lokistack-sample-distributor

      allowPrivilegeEscalation != false (container "loki-distributor" must set securityContext.allowPrivilegeEscalation=false), 
 unrestricted capabilities (container "loki-distributor" must set securityContext.capabilities.drop=["ALL"]), 
 runAsNonRoot != true (pod or container "loki-distributor" must set securityContext.runAsNonRoot=true), 
 seccompProfile (pod or container "loki-distributor" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      #lokistack-sample-gateway 

      allowPrivilegeEscalation != false (containers "gateway", "opa" must set securityContext.allowPrivilegeEscalation=false), 
unrestricted capabilities (containers "gateway", "opa" must set securityContext.capabilities.drop=["ALL"]), 
runAsNonRoot != true (pod or containers "gateway", "opa" must set securityContext.runAsNonRoot=true), 
seccompProfile (pod or containers "gateway", "opa" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      #lokistack-sample-querier 

      allowPrivilegeEscalation != false (container "loki-querier" must set securityContext.allowPrivilegeEscalation=false), 
unrestricted capabilities (container "loki-querier" must set securityContext.capabilities.drop=["ALL"]), 
runAsNonRoot != true (pod or container "loki-querier" must set securityContext.runAsNonRoot=true), 
seccompProfile (pod or container "loki-querier" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      #lokistack-sample-query-frontend 

      allowPrivilegeEscalation != false (container "loki-query-frontend" must set securityContext.allowPrivilegeEscalation=false), 
unrestricted capabilities (container "loki-query-frontend" must set securityContext.capabilities.drop=["ALL"]), 
runAsNonRoot != true (pod or container "loki-query-frontend" must set securityContext.runAsNonRoot=true), 
seccompProfile (pod or container "loki-query-frontend" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      #lokistack-sample-compactor

      allowPrivilegeEscalation != false (container "loki-compactor" must set securityContext.allowPrivilegeEscalation=false), 
unrestricted capabilities (container "loki-compactor" must set securityContext.capabilities.drop=["ALL"]), 
runAsNonRoot != true (pod or container "loki-compactor" must set securityContext.runAsNonRoot=true), 
seccompProfile (pod or container "loki-compactor" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      #lokistack-sample-index-gateway

      allowPrivilegeEscalation != false (container "loki-index-gateway" must set securityContext.allowPrivilegeEscalation=false), 
unrestricted capabilities (container "loki-index-gateway" must set securityContext.capabilities.drop=["ALL"]), 
runAsNonRoot != true (pod or container "loki-index-gateway" must set securityContext.runAsNonRoot=true), 
seccompProfile (pod or container "loki-index-gateway" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      #lokistack-sample-ingester 

      allowPrivilegeEscalation != false (container "loki-ingester" must set securityContext.allowPrivilegeEscalation=false), 
unrestricted capabilities (container "loki-ingester" must set securityContext.capabilities.drop=["ALL"]), 
runAsNonRoot != true (pod or container "loki-ingester" must set securityContext.runAsNonRoot=true), 
seccompProfile (pod or container "loki-ingester" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      #loki-operator-controller-manager: 

      allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), 
unrestricted capabilities (containers "manager", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), 
runAsNonRoot != true (pod or containers "manager", "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), 
seccompProfile (pod or containers "manager", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

            gvanloo Gerard Vanloo (Inactive)
            rhn-support-anli Anping Li
            Anping Li Anping Li
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: