Skip to content

Commit b7da0a8

Browse files
rehanshaikh1207bettrhqjoeldsouza28
authored
Add securityContext for improved container security (#473)
* feat: add pod-level security contexts to all deployments - Add runAsNonRoot, runAsUser (999), runAsGroup (999), fsGroup (999) - Add seccompProfile with RuntimeDefault type - Enforce security hardening across preview, production, and cronjob specs * feat: implement Kubernetes security context hardening - Add readOnlyRootFilesystem, runAsNonRoot, drop all capabilities - Add volume mounts for writable directories (/tmp, /logs, config) - Add USER environment variable for temporal user detection - Add init container for temporal config copying - Ensure all containers work with hardened security context * fix: restore temporal config volumes under security hardening * feat: sync temporal deployments with init containers and consistent volume mounts - Add init container to production temporal deployment - Add explanatory comment for init container purpose - Standardize temporal-ui-config volume usage across environments - Ensure consistent security contexts between preview and production * fix: remove duplicate volumes in production temporal deployment - Remove duplicate temporal-config and temporal-ui-config volume entries - Remove unused temporal-var volume mount from temporal-server container - Ensure production temporal deployment matches debugged preview configuration --------- Co-authored-by: Better <[email protected]> Co-authored-by: Joel Dsouza <[email protected]>
1 parent f2c1524 commit b7da0a8

File tree

5 files changed

+274
-0
lines changed

5 files changed

+274
-0
lines changed

‎lib/kube/preview/deployment.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,15 @@ spec:
2828
app: $KUBE_APP
2929
spec:
3030
priorityClassName: $KUBE_APP-$KUBE_DEPLOY_ID-priority
31+
# Security: Run all containers as non-root user 999 to prevent privilege escalation
32+
securityContext:
33+
runAsNonRoot: true
34+
runAsUser: 999
35+
runAsGroup: 999
36+
fsGroup: 999
37+
# Security: Enable kernel-level syscall filtering to reduce attack surface
38+
seccompProfile:
39+
type: RuntimeDefault
3140
affinity:
3241
nodeAffinity:
3342
requiredDuringSchedulingIgnoredDuringExecution:
@@ -43,6 +52,14 @@ spec:
4352
- name: $KUBE_APP
4453
image: $KUBE_DEPLOYMENT_IMAGE
4554
imagePullPolicy: Always
55+
# Security: Block privilege escalation, make filesystem read-only, drop all capabilities
56+
securityContext:
57+
allowPrivilegeEscalation: false
58+
readOnlyRootFilesystem: true
59+
runAsNonRoot: true
60+
capabilities:
61+
drop:
62+
- ALL
4663
resources:
4764
requests:
4865
memory: '400Mi'
@@ -56,6 +73,14 @@ spec:
5673
envFrom:
5774
- secretRef:
5875
name: $DOPPLER_MANAGED_SECRET_NAME
76+
volumeMounts:
77+
# Security: Use temporary volumes for writable directories since root filesystem is read-only
78+
- name: tmp
79+
mountPath: /opt/app/tmp
80+
- name: logs
81+
mountPath: /opt/app/logs
82+
- name: system-tmp
83+
mountPath: /tmp
5984
startupProbe:
6085
httpGet:
6186
path: /
@@ -72,3 +97,10 @@ spec:
7297
path: /
7398
port: 8080
7499
initialDelaySeconds: 30
100+
volumes:
101+
- name: tmp
102+
emptyDir: {}
103+
- name: logs
104+
emptyDir: {}
105+
- name: system-tmp
106+
emptyDir: {}

‎lib/kube/preview/temporal-deployment.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,15 @@ spec:
2323
labels:
2424
app: temporal
2525
spec:
26+
# Security: Run all containers as non-root user 999 to prevent privilege escalation
27+
securityContext:
28+
runAsNonRoot: true
29+
runAsUser: 999
30+
runAsGroup: 999
31+
fsGroup: 999
32+
# Security: Enable kernel-level syscall filtering to reduce attack surface
33+
seccompProfile:
34+
type: RuntimeDefault
2635
affinity:
2736
nodeAffinity:
2837
requiredDuringSchedulingIgnoredDuringExecution:
@@ -34,16 +43,51 @@ spec:
3443
- platform-cluster-01-staging-pool
3544
imagePullSecrets:
3645
- name: regcred
46+
47+
# Init container: Copies Temporal configuration files to shared volumes before main containers start
48+
initContainers:
49+
- name: copy-temporal-config
50+
image: temporalio/auto-setup:1.27.2
51+
command: ['sh', '-c', 'cp -r /etc/temporal/config/* /tmp/config/ && mkdir -p /tmp/ui-config']
52+
volumeMounts:
53+
- name: temporal-config
54+
mountPath: /tmp/config
55+
- name: temporal-ui-config
56+
mountPath: /tmp/ui-config
57+
securityContext:
58+
allowPrivilegeEscalation: false
59+
readOnlyRootFilesystem: true
60+
runAsNonRoot: true
61+
capabilities:
62+
drop:
63+
- ALL
3764

3865
containers:
3966
- name: temporal-server
4067
image: temporalio/auto-setup:1.27.2
4168
imagePullPolicy: Always
69+
# Security: Block privilege escalation, make filesystem read-only, drop all capabilities
70+
securityContext:
71+
allowPrivilegeEscalation: false
72+
readOnlyRootFilesystem: true
73+
runAsNonRoot: true
74+
capabilities:
75+
drop:
76+
- ALL
4277
ports:
4378
- containerPort: 7233
79+
# Security: USER env var required when running as non-root with dropped capabilities
80+
env:
81+
- name: USER
82+
value: "temporal"
4483
envFrom:
4584
- secretRef:
4685
name: $DOPPLER_MANAGED_SECRET_NAME
86+
volumeMounts:
87+
- name: tmp
88+
mountPath: /tmp
89+
- name: temporal-config
90+
mountPath: /etc/temporal/config
4791
resources:
4892
requests:
4993
memory: '200Mi'
@@ -52,9 +96,20 @@ spec:
5296
- name: temporal-admin-tools
5397
image: temporalio/admin-tools:1.27.2-tctl-1.18
5498
imagePullPolicy: Always
99+
# Security: Block privilege escalation, make filesystem read-only, drop all capabilities
100+
securityContext:
101+
allowPrivilegeEscalation: false
102+
readOnlyRootFilesystem: true
103+
runAsNonRoot: true
104+
capabilities:
105+
drop:
106+
- ALL
55107
envFrom:
56108
- secretRef:
57109
name: $DOPPLER_MANAGED_SECRET_NAME
110+
volumeMounts:
111+
- name: tmp
112+
mountPath: /tmp
58113
stdin: true
59114
tty: true
60115
resources:
@@ -66,11 +121,24 @@ spec:
66121
- name: temporal-ui
67122
image: temporalio/ui:2.37.2
68123
imagePullPolicy: Always
124+
# Security: Block privilege escalation, make filesystem read-only, drop all capabilities
125+
securityContext:
126+
allowPrivilegeEscalation: false
127+
readOnlyRootFilesystem: true
128+
runAsNonRoot: true
129+
capabilities:
130+
drop:
131+
- ALL
69132
ports:
70133
- containerPort: 8080
71134
envFrom:
72135
- secretRef:
73136
name: $DOPPLER_MANAGED_SECRET_NAME
137+
volumeMounts:
138+
- name: tmp
139+
mountPath: /tmp
140+
- name: temporal-ui-config
141+
mountPath: /home/ui-server/config
74142
resources:
75143
requests:
76144
memory: '200Mi'
@@ -93,12 +161,35 @@ spec:
93161
- name: python-worker
94162
image: $KUBE_DEPLOYMENT_IMAGE
95163
workingDir: /opt/app/src/apps/backend
164+
# Security: Block privilege escalation, make filesystem read-only, drop all capabilities
165+
securityContext:
166+
allowPrivilegeEscalation: false
167+
readOnlyRootFilesystem: true
168+
runAsNonRoot: true
169+
capabilities:
170+
drop:
171+
- ALL
96172
command: ['pipenv', 'run', 'python', 'temporal_server.py']
97173
envFrom:
98174
- secretRef:
99175
name: $DOPPLER_MANAGED_SECRET_NAME
176+
volumeMounts:
177+
# Security: Use temporary volumes for writable directories since root filesystem is read-only
178+
- name: tmp
179+
mountPath: /opt/app/tmp
180+
- name: logs
181+
mountPath: /opt/app/logs
100182
resources:
101183
requests:
102184
memory: '150Mi'
103185
limits:
104186
memory: '300Mi'
187+
volumes:
188+
- name: tmp
189+
emptyDir: {}
190+
- name: logs
191+
emptyDir: {}
192+
- name: temporal-config
193+
emptyDir: {}
194+
- name: temporal-ui-config
195+
emptyDir: {}

‎lib/kube/production/deployment.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,15 @@ spec:
1818
labels:
1919
app: $KUBE_APP
2020
spec:
21+
# Security: Run all containers as non-root user 999 to prevent privilege escalation
22+
securityContext:
23+
runAsNonRoot: true
24+
runAsUser: 999
25+
runAsGroup: 999
26+
fsGroup: 999
27+
# Security: Enable kernel-level syscall filtering to reduce attack surface
28+
seccompProfile:
29+
type: RuntimeDefault
2130
affinity:
2231
nodeAffinity:
2332
requiredDuringSchedulingIgnoredDuringExecution:
@@ -33,6 +42,14 @@ spec:
3342
- name: $KUBE_APP
3443
image: $KUBE_DEPLOYMENT_IMAGE
3544
imagePullPolicy: Always
45+
# Security: Block privilege escalation, make filesystem read-only, drop all capabilities
46+
securityContext:
47+
allowPrivilegeEscalation: false
48+
readOnlyRootFilesystem: true
49+
runAsNonRoot: true
50+
capabilities:
51+
drop:
52+
- ALL
3653
resources:
3754
requests:
3855
memory: '400Mi'
@@ -46,6 +63,14 @@ spec:
4663
envFrom:
4764
- secretRef:
4865
name: $DOPPLER_MANAGED_SECRET_NAME
66+
volumeMounts:
67+
# Security: Use temporary volumes for writable directories since root filesystem is read-only
68+
- name: tmp
69+
mountPath: /opt/app/tmp
70+
- name: logs
71+
mountPath: /opt/app/logs
72+
- name: system-tmp
73+
mountPath: /tmp
4974
startupProbe:
5075
httpGet:
5176
path: /
@@ -62,3 +87,10 @@ spec:
6287
path: /
6388
port: 8080
6489
initialDelaySeconds: 30
90+
volumes:
91+
- name: tmp
92+
emptyDir: {}
93+
- name: logs
94+
emptyDir: {}
95+
- name: system-tmp
96+
emptyDir: {}

0 commit comments

Comments
 (0)