forked from bpfman/bpfman
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request bpfman#1097 from astoycos/ocp-privs
Start providing manifests for running our eBPF example applications as truly non-root
- Loading branch information
Showing
45 changed files
with
783 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| dependencies: | ||
| - type: olm.gvk | ||
| value: | ||
| group: security-profiles-operator.x-k8s.io | ||
| kind: SelinuxProfile | ||
| version: v1alpha2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -33,3 +33,4 @@ resources: | |
| - ../bpfman-operator-deployment | ||
| - ../bpfman-deployment | ||
| - rbac.yaml | ||
| - user-scc.yaml | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| --- | ||
| apiVersion: security.openshift.io/v1 | ||
| kind: SecurityContextConstraints | ||
| metadata: | ||
| name: restricted | ||
| allowHostDirVolumePlugin: false | ||
| allowHostIPC: false | ||
| allowHostNetwork: false | ||
| allowHostPID: false | ||
| allowHostPorts: false | ||
| allowPrivilegeEscalation: false | ||
| allowPrivilegedContainer: false | ||
| allowedCapabilities: null | ||
| defaultAddCapabilities: null | ||
| groups: [] | ||
| priority: null | ||
| readOnlyRootFilesystem: false | ||
| requiredDropCapabilities: | ||
| - ALL | ||
| runAsUser: | ||
| type: RunAsAny | ||
| seLinuxContext: | ||
| type: RunAsAny | ||
| seccompProfiles: null | ||
| supplementalGroups: | ||
| type: MustRunAs | ||
| fsGroup: | ||
| type: RunAsAny | ||
| volumes: | ||
| - configMap | ||
| - csi | ||
| - downwardAPI | ||
| - emptyDir | ||
| - ephemeral | ||
| - persistentVolumeClaim | ||
| - projected | ||
| - secret | ||
| --- | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| name: user | ||
| rules: | ||
| - apiGroups: | ||
| - security.openshift.io | ||
| resourceNames: | ||
| - bpfman-restricted | ||
| resources: | ||
| - securitycontextconstraints | ||
| verbs: | ||
| - use | ||
| --- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| # Running the Examples as Non-Root on Selinux Distributions | ||
|
|
||
| Developer instances of Kubernetes such as kind often set SElinux to permissive | ||
| mode, ensuring the security subsystem does not interfere with the local | ||
| cluster operations. However, in production distributions such as | ||
| Openshift, EKS, GKE and AWS where security is paramount, selinux and other | ||
| security subsystems are often enabled by default. This among other things | ||
| presents unique challenges when determining how to deploy unprivileged applications | ||
| with bpfman. | ||
|
|
||
| In order to deploy the provided examples on selinux distributions, users must | ||
| first install the [security-profiles-operator](https://github.com/kubernetes-sigs/security-profiles-operator). | ||
| This will allow bpfman to deploy custom SELinux policies which will allow container users | ||
| access to bpf maps (i.e `map_read` and `map_write` actions). | ||
|
|
||
| It can easily be installed via operatorhub.io from [here](https://operatorhub.io/operator/security-profiles-operator). | ||
|
|
||
| Once the security-profiles-operator and bpfman are installed simply deploy desired | ||
| examples: | ||
|
|
||
| ```bash | ||
| cd examples/ | ||
| make deploy-tc-selinux | ||
| make deploy-xdp-selinux | ||
| : | ||
| make undeploy-tc-selinux | ||
| make undeploy-xdp-selinux | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: kprobe-binding | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: bpfman-user | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: bpfman-app-go-kprobe-counter | ||
| namespace: go-kprobe-counter |
Oops, something went wrong.