feat(vpa/chart): harden securitycontext and allow customization of it

The security context could be tightened a bit without losing
functionality, making vpa fit into the PSS "restricted".

Author: jonkerj

vertical-pod-autoscaler/charts/vertical-pod-autoscaler/README.md

@@ -35,12 +35,23 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
 | admissionController.podDisruptionBudget.maxUnavailable | int or string | `nil` | Maximum number/percentage of pods that can be unavailable after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
 | admissionController.podDisruptionBudget.minAvailable | int or string | `1` | Minimum number/percentage of pods that must be available after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
 | admissionController.podLabels | object | `{}` |  |
+| admissionController.podSecurityContext.runAsGroup | int | `65534` |  |
+| admissionController.podSecurityContext.runAsNonRoot | bool | `true` |  |
+| admissionController.podSecurityContext.runAsUser | int | `65534` |  |
+| admissionController.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
 | admissionController.priorityClassName | string | `nil` |  |
 | admissionController.replicas | int | `2` |  |
 | admissionController.resources.limits.cpu | string | `"200m"` |  |
 | admissionController.resources.limits.memory | string | `"500Mi"` |  |
 | admissionController.resources.requests.cpu | string | `"50m"` |  |
 | admissionController.resources.requests.memory | string | `"200Mi"` |  |
+| admissionController.securityContext.allowPrivilegeEscalation | bool | `false` |  |
+| admissionController.securityContext.capabilities.add[0] | string | `"NET_BIND_SERVICE"` |  |
+| admissionController.securityContext.capabilities.drop[0] | string | `"ALL"` |  |
+| admissionController.securityContext.readOnlyRootFilesystem | bool | `true` |  |
+| admissionController.securityContext.runAsGroup | int | `65534` |  |
+| admissionController.securityContext.runAsNonRoot | bool | `true` |  |
+| admissionController.securityContext.runAsUser | int | `65534` |  |
 | admissionController.service.annotations | object | `{}` |  |
 | admissionController.service.name | string | `"vpa-webhook"` |  |
 | admissionController.service.ports[0].port | int | `443` |  |
@@ -85,12 +96,23 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
 | recommender.podDisruptionBudget.maxUnavailable | int or string | `nil` | Maximum number/percentage of pods that can be unavailable after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
 | recommender.podDisruptionBudget.minAvailable | int or string | `1` | Minimum number/percentage of pods that must be available after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
 | recommender.podLabels | object | `{}` |  |
+| recommender.podSecurityContext.runAsGroup | int | `65534` |  |
+| recommender.podSecurityContext.runAsNonRoot | bool | `true` |  |
+| recommender.podSecurityContext.runAsUser | int | `65534` |  |
+| recommender.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
 | recommender.priorityClassName | string | `nil` |  |
 | recommender.replicas | int | `2` |  |
 | recommender.resources.limits.cpu | string | `"200m"` |  |
 | recommender.resources.limits.memory | string | `"1000Mi"` |  |
 | recommender.resources.requests.cpu | string | `"50m"` |  |
 | recommender.resources.requests.memory | string | `"500Mi"` |  |
+| recommender.securityContext.allowPrivilegeEscalation | bool | `false` |  |
+| recommender.securityContext.capabilities.add[0] | string | `"NET_BIND_SERVICE"` |  |
+| recommender.securityContext.capabilities.drop[0] | string | `"ALL"` |  |
+| recommender.securityContext.readOnlyRootFilesystem | bool | `true` |  |
+| recommender.securityContext.runAsGroup | int | `65534` |  |
+| recommender.securityContext.runAsNonRoot | bool | `true` |  |
+| recommender.securityContext.runAsUser | int | `65534` |  |
 | recommender.serviceAccount.annotations | object | `{}` |  |
 | recommender.serviceAccount.create | bool | `true` |  |
 | recommender.serviceAccount.labels | object | `{}` |  |
@@ -101,8 +123,19 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
 | updater.image.tag | string | `nil` |  |
 | updater.podAnnotations | object | `{}` |  |
 | updater.podLabels | object | `{}` |  |
+| updater.podSecurityContext.runAsGroup | int | `65534` |  |
+| updater.podSecurityContext.runAsNonRoot | bool | `true` |  |
+| updater.podSecurityContext.runAsUser | int | `65534` |  |
+| updater.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
 | updater.priorityClassName | string | `nil` |  |
 | updater.replicas | int | `1` |  |
+| updater.securityContext.allowPrivilegeEscalation | bool | `false` |  |
+| updater.securityContext.capabilities.add[0] | string | `"NET_BIND_SERVICE"` |  |
+| updater.securityContext.capabilities.drop[0] | string | `"ALL"` |  |
+| updater.securityContext.readOnlyRootFilesystem | bool | `true` |  |
+| updater.securityContext.runAsGroup | int | `65534` |  |
+| updater.securityContext.runAsNonRoot | bool | `true` |  |
+| updater.securityContext.runAsUser | int | `65534` |  |
 | updater.serviceAccount.annotations | object | `{}` |  |
 | updater.serviceAccount.create | bool | `true` |  |
 | updater.serviceAccount.labels | object | `{}` |  |

vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-deployment.yaml

@@ -32,9 +32,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName:  {{ include "vertical-pod-autoscaler.admissionController.fullname" . }}
+      {{- with .Values.admissionController.podSecurityContext }}
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.admissionController.priorityClassName }}
       priorityClassName: {{ .Values.admissionController.priorityClassName | quote }}
       {{- end }}
@@ -95,6 +96,10 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with .Values.admissionController.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
       volumes:
         {{- toYaml .Values.admissionController.volumes | nindent 12 }}
 {{- end -}}

vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/recommender-deployment.yaml

@@ -32,9 +32,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "vertical-pod-autoscaler.recommender.fullname" . }}
+      {{- with .Values.recommender.podSecurityContext }}
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.recommender.priorityClassName }}
       priorityClassName: {{ .Values.recommender.priorityClassName | quote }}
       {{- end }}
@@ -92,6 +93,10 @@ spec:
         resources:
           {{- toYaml . | nindent 10 }}
         {{- end }}
+        {{- with .Values.recommender.securityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
       {{- with .Values.recommender.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/updater-deployment.yaml

@@ -28,9 +28,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
+      {{- with .Values.updater.podSecurityContext }}
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.updater.priorityClassName }}
       priorityClassName: {{ .Values.updater.priorityClassName | quote }}
       {{- end }}
@@ -61,4 +62,8 @@ spec:
               scheme: HTTP
             periodSeconds: 10
             failureThreshold: 3
+          {{- with .Values.updater.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
 {{- end -}}

vertical-pod-autoscaler/charts/vertical-pod-autoscaler/values.yaml

@@ -106,6 +106,27 @@ admissionController:
   priorityClassName:
   # priorityClassName : high-priority
 
+  # pod-level security context
+  podSecurityContext:
+    runAsUser: 65534
+    runAsGroup: 65534
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  
+  # container-level security context
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+      add:
+        - NET_BIND_SERVICE
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 65534
+    runAsGroup: 65534
+
 recommender:
   enabled: true
   image:
@@ -188,6 +209,27 @@ recommender:
   priorityClassName:
   # priorityClassName : high-priority
 
+  # pod-level security context
+  podSecurityContext:
+    runAsUser: 65534
+    runAsGroup: 65534
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  
+  # container-level security context
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+      add:
+        - NET_BIND_SERVICE
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 65534
+    runAsGroup: 65534
+
 updater:
   enabled: true
   image:
@@ -217,3 +259,24 @@ updater:
   # name of priorityclass for scheduling
   priorityClassName:
   # priorityClassName : high-priority
+
+  # pod-level security context
+  podSecurityContext:
+    runAsUser: 65534
+    runAsGroup: 65534
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  
+  # container-level security context
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+      add:
+        - NET_BIND_SERVICE
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 65534
+    runAsGroup: 65534