Tightening Pod/Container Security for All Workloads

charts/graylog/templates/_helpers.tpl

@@ -390,13 +390,17 @@ backoffLimit: 2
 activeDeadlineSeconds: 900
 template:
   spec:
+    {{- with index . 3 }}
     securityContext:
-      runAsUser: 1100
-      runAsGroup: 1100
-      fsGroup: 1100
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
     containers:
       - name: geoipupdate
         image: maxmindinc/geoipupdate:latest
+        {{- with index . 4 }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
         envFrom:
           - secretRef:
               name: {{ index . 0 }}

charts/graylog/templates/workload/cronjobs/geoip.yaml

@@ -15,6 +15,8 @@ data:
 {{- $claimName := printf "%s-%s" (include "graylog.volume.name" .) (include "graylog.fullname" .) }}
 {{- $cronSchedule := .Values.graylog.config.geolocation.maxmindGeoIp.cronSchedule | default "0 0 * * *" }}
 {{- $hookIsEnabled := .Values.graylog.config.geolocation.maxmindGeoIp.postInstallRun | default true }}
+{{- $podSecurityContext := .Values.graylog.podSecurityContext }}
+{{- $containerSecurityContext := .Values.graylog.containerSecurityContext }}
 {{- range $i := include "graylog.replicas" . | default 2 | int | until }}
 ---
 apiVersion: batch/v1
@@ -25,7 +27,7 @@ spec:
   schedule: {{ $cronSchedule }}
   jobTemplate:
     spec:
-      {{- list $geoSecretName $claimName $i | include "graylog.geoip.job.spec" | nindent 6 }}
+      {{- list $geoSecretName $claimName $i $podSecurityContext $containerSecurityContext | include "graylog.geoip.job.spec" | nindent 6 }}
 {{- if $hookIsEnabled }}
 ---
 apiVersion: batch/v1
@@ -37,7 +39,7 @@ metadata:
     "helm.sh/hook-weight": "0"
     "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
 spec:
-{{- list $geoSecretName $claimName $i | include "graylog.geoip.job.spec" | nindent 2 }}
+{{- list $geoSecretName $claimName $i $podSecurityContext $containerSecurityContext | include "graylog.geoip.job.spec" | nindent 2 }}
+{{- end }}
 {{- end }}
 {{- end }}
-{{- end }}

charts/graylog/templates/workload/statefulsets/datanode.yaml

@@ -47,10 +47,39 @@ spec:
       {{- if .Values.serviceAccount.create }}
       serviceAccountName: {{ include "graylog.serviceAccountName" . }}
       {{- end }}
+      {{- with .Values.datanode.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $dataMountPath := .Values.datanode.persistence.data.mountPath | default "/var/lib/graylog-datanode" }}
+      initContainers:
+        - name: data-chown
+          image: "{{ .Values.datanode.initContainerImage.repository }}:{{ .Values.datanode.initContainerImage.tag }}"
+          imagePullPolicy: {{ .Values.datanode.initContainerImage.imagePullPolicy }}
+          {{- with .Values.datanode.initContainerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p \
+                {{ $dataMountPath }}/opensearch/config \
+                {{ $dataMountPath }}/opensearch/data \
+                {{ $dataMountPath }}/opensearch/logs
+              chown -R 999:999 {{ $dataMountPath }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ $dataMountPath | quote }}
       containers:
         - name: graylog-datanode
           image: {{ include "graylog.datanode.image" . }}
           imagePullPolicy: {{ .Values.datanode.image.imagePullPolicy }}
+          {{- with .Values.datanode.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           envFrom:
             - configMapRef:
                 name: {{ include "graylog.datanode.configmap.name" . }}

charts/graylog/templates/workload/statefulsets/graylog.yaml

@@ -48,14 +48,18 @@ spec:
       {{- if .Values.serviceAccount.create }}
       serviceAccountName: {{ include "graylog.serviceAccountName" . }}
       {{- end }}
+      {{- with .Values.graylog.podSecurityContext }}
       securityContext:
-        runAsUser: 1100
-        runAsGroup: 1100
-        fsGroup: 1100
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       initContainers:
         - name: copy-data
           image: {{ include "graylog.image" . }}
           imagePullPolicy: {{ .Values.graylog.image.imagePullPolicy }}
+          {{- with .Values.graylog.initContainerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           command: [ "/bin/sh", "/scripts/init-script.sh" ]
           env:
             - name: INIT_GRAYLOG_PLUGIN_URLS
@@ -91,6 +95,10 @@ spec:
         {{- if empty .existingClaim | and .image }}
         - name: {{ printf "copy-plugin-%s" .name }}
           image: {{ .image }}
+          {{- with merge (dict "readOnlyRootFilesystem" true) $.Values.graylog.initContainerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           command: [ "/bin/sh", "-c", "cp *.jar /mnt/plugins/" ]
           volumeMounts:
             - name: init-plugins
@@ -102,6 +110,10 @@ spec:
         - name: graylog-app
           image: {{ include "graylog.image" . }}
           imagePullPolicy: {{ .Values.graylog.image.imagePullPolicy }}
+          {{- with .Values.graylog.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           env:
             - name: POD_NAME
               valueFrom:

charts/graylog/values.yaml

@@ -177,6 +177,28 @@ graylog:
   podDisruptionBudget:
     enabled: false
     minAvailable: 1
+  podSecurityContext:
+    runAsUser: 1100
+    runAsGroup: 1100
+    runAsNonRoot: true
+    fsGroup: 1100
+    seccompProfile:
+      type: RuntimeDefault
+  initContainerSecurityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    seccompProfile:
+      type: RuntimeDefault
+  containerSecurityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+      add: ["NET_BIND_SERVICE"]
+    seccompProfile:
+      type: RuntimeDefault
   podAnnotations: {}
   nodeSelector: {}
   tolerations: []
@@ -262,6 +284,31 @@ datanode:
   podDisruptionBudget:
     enabled: false
     minAvailable: 2
+  podSecurityContext:
+    fsGroup: 999
+    fsGroupChangePolicy: "OnRootMismatch"
+    seccompProfile:
+      type: RuntimeDefault
+  initContainerImage:
+    repository: "busybox"
+    tag: "latest"
+    imagePullPolicy: IfNotPresent
+  initContainerSecurityContext:
+    runAsUser: 0
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: ["ALL"]
+      add: ["CHOWN", "DAC_OVERRIDE"]
+    seccompProfile:
+      type: RuntimeDefault
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+      add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETUID", "SETGID"]
+    seccompProfile:
+      type: RuntimeDefault
   podAnnotations: {}
   nodeSelector: {}
   tolerations: []