Skip to content

feat(chart): add optional readOnlyRootFilesystem hardening (empirically verified) #177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
danielqb wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(chart): add optional readOnlyRootFilesystem hardening (empirically verified) #177

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions kubernetes/glpi/templates/glpi-cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,10 @@ spec:
mountPath: /var/www/html/marketplace
- name: etc
mountPath: /etc/glpi
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
{{- end }}
resources:
{{- toYaml .Values.glpi.phpfpm.resources | nindent 16 }}
volumes:
Expand All @@ -70,5 +74,9 @@ spec:
- name: marketplace
persistentVolumeClaim:
claimName: glpi-marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
emptyDir: {}
{{- end }}
restartPolicy: OnFailure
{{- end }}
16 changes: 16 additions & 0 deletions kubernetes/glpi/templates/glpi-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,10 @@ spec:
mountPath: /etc/glpi
- name: marketplace
mountPath: /var/www/html/marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
{{- end }}
{{- if .Values.glpi.phpfpm.livenessProbe.enabled }}
livenessProbe:
tcpSocket:
Expand Down Expand Up @@ -100,6 +104,10 @@ spec:
- name: marketplace
persistentVolumeClaim:
claimName: glpi-marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
emptyDir: {}
{{- end }}


---
Expand Down Expand Up @@ -176,6 +184,10 @@ spec:
mountPath: /etc/glpi
- name: nginx-conf
mountPath: /etc/nginx/conf.d
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
{{- end }}
{{- if .Values.glpi.nginx.livenessProbe.enabled }}
livenessProbe:
httpGet:
Expand Down Expand Up @@ -212,6 +224,10 @@ spec:
configMap:
defaultMode: 420
name: nginx-conf
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
emptyDir: {}
{{- end }}


---
Expand Down
40 changes: 40 additions & 0 deletions kubernetes/glpi/templates/glpi-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,10 @@ spec:
mountPath: /var/www/html/marketplace
- name: etc
mountPath: /etc/glpi
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
{{- end }}
volumes:
- name: etc
persistentVolumeClaim:
Expand All @@ -58,6 +62,10 @@ spec:
- name: marketplace
persistentVolumeClaim:
claimName: glpi-marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
emptyDir: {}
{{- end }}
restartPolicy: OnFailure
parallelism: 1
completions: 1
Expand Down Expand Up @@ -137,6 +145,10 @@ spec:
mountPath: /var/www/html/marketplace
- name: etc
mountPath: /etc/glpi
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
{{- end }}
volumes:
- name: etc
persistentVolumeClaim:
Expand All @@ -147,6 +159,10 @@ spec:
- name: marketplace
persistentVolumeClaim:
claimName: glpi-marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
emptyDir: {}
{{- end }}
restartPolicy: OnFailure
parallelism: 1
completions: 1
Expand Down Expand Up @@ -226,6 +242,10 @@ spec:
mountPath: /var/www/html/marketplace
- name: etc
mountPath: /etc/glpi
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
{{- end }}
volumes:
- name: etc
persistentVolumeClaim:
Expand All @@ -236,6 +256,10 @@ spec:
- name: marketplace
persistentVolumeClaim:
claimName: glpi-marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
emptyDir: {}
{{- end }}
restartPolicy: OnFailure
parallelism: 1
completions: 1
Expand Down Expand Up @@ -315,6 +339,10 @@ spec:
mountPath: /var/lib/glpi
- name: marketplace
mountPath: /var/www/html/marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
{{- end }}
volumes:
- name: etc
persistentVolumeClaim:
Expand All @@ -325,6 +353,10 @@ spec:
- name: marketplace
persistentVolumeClaim:
claimName: glpi-marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
emptyDir: {}
{{- end }}
restartPolicy: OnFailure
parallelism: 1
completions: 1
Expand Down Expand Up @@ -381,6 +413,10 @@ spec:
mountPath: /var/lib/glpi
- name: marketplace
mountPath: /var/www/html/marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
{{- end }}
volumes:
- name: etc
persistentVolumeClaim:
Expand All @@ -391,6 +427,10 @@ spec:
- name: marketplace
persistentVolumeClaim:
claimName: glpi-marketplace
{{- if .Values.glpi.securityContext.readOnlyRootFilesystem }}
- name: tmp
emptyDir: {}
{{- end }}
restartPolicy: OnFailure
parallelism: 1
completions: 1
Expand Down
10 changes: 10 additions & 0 deletions kubernetes/glpi/templates/mariadb-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,16 @@ spec:
name: mariadb-glpi-secret
- configMapRef:
name: mariadb-glpi-config
{{- if .Values.mariadb.securityContext.readOnlyRootFilesystem }}
volumeMounts:
- name: tmp
mountPath: /tmp
{{- end }}
{{- if .Values.mariadb.securityContext.readOnlyRootFilesystem }}
volumes:
- name: tmp
emptyDir: {}
{{- end }}
restartPolicy: OnFailure
parallelism: 1
completions: 1
Expand Down
13 changes: 13 additions & 0 deletions kubernetes/glpi/templates/mariadb-statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,21 @@ spec:
volumeMounts:
- name: data
mountPath: "/var/lib/mysql"
{{- if .Values.mariadb.securityContext.readOnlyRootFilesystem }}
- name: tmp
mountPath: /tmp
- name: run-mysqld
mountPath: /run/mysqld
{{- end }}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
{{- if .Values.mariadb.securityContext.readOnlyRootFilesystem }}
volumes:
- name: tmp
emptyDir: {}
- name: run-mysqld
emptyDir: {}
{{- end }}
updateStrategy:
type: OnDelete
volumeClaimTemplates:
Expand Down
10 changes: 10 additions & 0 deletions kubernetes/glpi/templates/redis-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,4 +73,14 @@ spec:
failureThreshold: 3
resources:
{{- toYaml .Values.redis.resources | nindent 12 }}
{{- if .Values.redis.securityContext.readOnlyRootFilesystem }}
volumeMounts:
- name: data
mountPath: /data
{{- end }}
{{- if .Values.redis.securityContext.readOnlyRootFilesystem }}
volumes:
- name: data
emptyDir: {}
{{- end }}
{{- end }}
23 changes: 22 additions & 1 deletion kubernetes/glpi/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@ glpi:
fsGroup: 82

# -- GLPI Container Security Context
# Security settings applied at the container level
# Security settings applied at the container level (php-fpm, nginx, all init Jobs, cronjob)
securityContext:
# Run as non-root user
runAsNonRoot: true
Expand All @@ -218,6 +218,14 @@ glpi:
capabilities:
drop:
- ALL
# Mount the container's root filesystem as read-only. Verified against the actual
# eftechcombr/glpi:php-fpm and :nginx images (docker run --read-only): php-fpm starts
# cleanly with no extra writable paths; nginx needs /tmp writable (proxy_temp etc, used
# by nginx-unprivileged's default config). When enabled, this chart mounts an emptyDir
# at /tmp on every container that shares this securityContext (php-fpm, nginx, init
# Jobs, cronjob) to cover both cases uniformly. GLPI's own data (uploads, sessions,
# config, marketplace) already lives on PVCs, unaffected by this setting either way.
readOnlyRootFilesystem: false

# -- MariaDB Database Configuration
mariadb:
Expand Down Expand Up @@ -290,6 +298,12 @@ mariadb:
capabilities:
drop:
- ALL
# Mount the container's root filesystem as read-only. Verified against the official
# mariadb:11.4 image (docker run --read-only): in addition to /var/lib/mysql (already
# a PVC), it needs /tmp writable (InnoDB temp files) and /run/mysqld writable (unix
# socket) to start and accept connections. When enabled, this chart mounts emptyDirs
# at both paths.
readOnlyRootFilesystem: false

# -- Redis Cache Configuration
redis:
Expand Down Expand Up @@ -340,6 +354,13 @@ redis:
capabilities:
drop:
- ALL
# Mount the container's root filesystem as read-only. Verified against the official
# redis:7.0-alpine image (docker run --read-only): needs /data writable to persist its
# RDB snapshot. This chart does not provision a PVC for Redis (it's used purely as an
# ephemeral object cache for GLPI, data loss on restart is expected either way), so
# when enabled an emptyDir is mounted at /data - functionally equivalent to the
# container's own writable layer that would otherwise hold it.
readOnlyRootFilesystem: false

# -- Ingress Configuration
# Configure ingress to expose GLPI externally
Expand Down