Skip to content

Commit a4abe35

Browse files
bpowbpow
committed
chmod secrets in an emptyDir (avoiding need for root to chown to running user)
This relies on the fact that an emptyDir is set up with appropriate permissions for whichever userid is running in the pod. The prior solution required running chown/chmod by root in the init container. This obviates the need for root, which is not permitted in many kubernetes installs as a security precaution. Fixes zitadel#177 and also fixes zitadel#178 (since there is no chown anymore).
1 parent 6256125 commit a4abe35

File tree

6 files changed

+41
-48
lines changed

6 files changed

+41
-48
lines changed

‎charts/zitadel/templates/_helpers.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ Create copy command or empty string
7272
*/}}
7373
{{- define "zitadel.makecpcommand" -}}
7474
{{- if .value -}}
75-
{{ printf "cp -r %s /chowned-secrets/" .path }}
75+
{{ printf "cp -rL %s /copied-secrets/" .path }}
7676
{{- end -}}
7777
{{- end -}}
7878

‎charts/zitadel/templates/debug_replicaset.yaml

+9-11
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,9 @@ spec:
6363
volumeMounts:
6464
- name: zitadel-config-yaml
6565
mountPath: /config
66-
- name: chowned-secrets
66+
- name: copied-secrets
6767
mountPath: /.secrets
68+
readOnly: true
6869
{{- if or .Values.zitadel.secretConfig .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret .Values.zitadel.dbSslUserCrtSecret .Values.zitadel.configSecretName }}
6970
initContainers:
7071
- args:
@@ -73,16 +74,16 @@ spec:
7374
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.configSecretName "path" "/zitadel-secret-config-yaml/" ))
7475
(include "zitadel.makecpcommand" (dict "value" (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) "path" "/db-ssl-ca-crt/" ))
7576
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslUserCrtSecret "path" "/db-ssl-user-crt/" ))
76-
)) }} chown -R 1000:1000 /chowned-secrets/ && find /chowned-secrets/ -type f -exec chmod 400 -- {} + "
77+
)) }} find /copied-secrets/ -type f -exec chmod 400 -- {} + "
7778
command:
7879
- sh
7980
- -c
80-
image: "{{ .Values.chownImage.repository }}:{{ .Values.chownImage.tag }}"
81-
imagePullPolicy: {{ .Values.chownImage.pullPolicy }}
82-
name: chown
81+
image: "{{ .Values.copySecretsImage.repository }}:{{ .Values.copySecretsImage.tag }}"
82+
imagePullPolicy: {{ .Values.copySecretsImage.pullPolicy }}
83+
name: copy-secrets
8384
volumeMounts:
84-
- name: chowned-secrets
85-
mountPath: /chowned-secrets
85+
- name: copied-secrets
86+
mountPath: /copied-secrets
8687
{{- if .Values.zitadel.secretConfig }}
8788
- name: zitadel-secrets-yaml
8889
mountPath: /zitadel-secrets-yaml
@@ -99,9 +100,6 @@ spec:
99100
- name: db-ssl-user-crt
100101
mountPath: /db-ssl-user-crt
101102
{{- end }}
102-
securityContext:
103-
runAsNonRoot: false
104-
runAsUser: 0
105103
{{- end }}
106104
volumes:
107105
- name: zitadel-config-yaml
@@ -132,7 +130,7 @@ spec:
132130
secret:
133131
secretName: {{ .Values.zitadel.dbSslUserCrtSecret }}
134132
{{- end }}
135-
- name: chowned-secrets
133+
- name: copied-secrets
136134
emptyDir: {}
137135
{{- with .Values.nodeSelector }}
138136
nodeSelector:

‎charts/zitadel/templates/deployment.yaml

+11-12
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,9 @@ spec:
154154
volumeMounts:
155155
- name: zitadel-config-yaml
156156
mountPath: /config
157-
- name: chowned-secrets
157+
- name: copied-secrets
158158
mountPath: /.secrets
159+
readOnly: true
159160
{{- if .Values.zitadel.selfSignedCert.enabled }}
160161
- name: tls
161162
mountPath: /etc/tls
@@ -165,6 +166,7 @@ spec:
165166
{{- end }}
166167
resources:
167168
{{- toYaml .Values.resources | nindent 14 }}
169+
{{- if or .Values.zitadel.secretConfig .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret .Values.zitadel.dbSslUserCrtSecret .Values.zitadel.configSecretName }}
168170
initContainers:
169171
- args:
170172
- "{{ include "zitadel.joincpcommands" (dict "commands" (list
@@ -173,16 +175,16 @@ spec:
173175
(include "zitadel.makecpcommand" (dict "value" (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) "path" "/db-ssl-ca-crt/" ))
174176
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslUserCrtSecret "path" "/db-ssl-user-crt/" ))
175177
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.serverSslCrtSecret "path" "/server-ssl-crt/" ))
176-
)) }} chown -R 1000:1000 /chowned-secrets/ && find /chowned-secrets/ -type f -exec chmod 400 -- {} + "
178+
)) }} find /copied-secrets/ -type f -exec chmod 400 -- {} + "
177179
command:
178180
- sh
179181
- -c
180-
image: "{{ .Values.chownImage.repository }}:{{ .Values.chownImage.tag }}"
181-
imagePullPolicy: {{ .Values.chownImage.pullPolicy }}
182-
name: chown
182+
image: "{{ .Values.copySecretsImage.repository }}:{{ .Values.copySecretsImage.tag }}"
183+
imagePullPolicy: {{ .Values.copySecretsImage.pullPolicy }}
184+
name: copy-secrets
183185
volumeMounts:
184-
- name: chowned-secrets
185-
mountPath: /chowned-secrets
186+
- name: copied-secrets
187+
mountPath: /copied-secrets
186188
{{- if .Values.zitadel.secretConfig }}
187189
- name: zitadel-secrets-yaml
188190
mountPath: /zitadel-secrets-yaml
@@ -203,9 +205,6 @@ spec:
203205
- name: server-ssl-crt
204206
mountPath: /server-ssl-crt
205207
{{- end }}
206-
securityContext:
207-
runAsNonRoot: false
208-
runAsUser: 0
209208
{{- if .Values.zitadel.selfSignedCert.enabled }}
210209
- name: generate-self-signed-cert
211210
image: alpine/openssl
@@ -229,8 +228,8 @@ spec:
229228
readOnlyRootFilesystem: true
230229
runAsNonRoot: true
231230
privileged: false
232-
runAsUser: 1000
233231
{{- end }}
232+
{{- end }}
234233
volumes:
235234
- name: zitadel-config-yaml
236235
configMap:
@@ -265,7 +264,7 @@ spec:
265264
secret:
266265
secretName: {{ .Values.zitadel.serverSslCrtSecret }}
267266
{{- end }}
268-
- name: chowned-secrets
267+
- name: copied-secrets
269268
emptyDir: {}
270269
{{- if .Values.zitadel.selfSignedCert.enabled }}
271270
- name: tls

‎charts/zitadel/templates/initjob.yaml

+8-10
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,9 @@ spec:
9292
volumeMounts:
9393
- name: zitadel-config-yaml
9494
mountPath: /config
95-
- name: chowned-secrets
95+
- name: copied-secrets
9696
mountPath: /.secrets
97+
readOnly: true
9798
{{- with .Values.extraVolumeMounts }}
9899
{{- toYaml . | nindent 10 }}
99100
{{- end }}
@@ -111,16 +112,16 @@ spec:
111112
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslAdminCrtSecret "path" "/db-ssl-admin-crt/" ))
112113
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslUserCrtSecret "path" "/db-ssl-user-crt/" ))
113114
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.configSecretName "path" "/zitadel-secret-config-yaml/" ))
114-
)) }} chown -R 1000:1000 /chowned-secrets/ && find /chowned-secrets/ -type f -exec chmod 400 -- {} + "
115+
)) }} find /copied-secrets/ -type f -exec chmod 400 -- {} + "
115116
command:
116117
- sh
117118
- -c
118-
image: "{{ .Values.chownImage.repository }}:{{ .Values.chownImage.tag }}"
119-
imagePullPolicy: {{ .Values.chownImage.pullPolicy }}
119+
image: "{{ .Values.copySecretsImage.repository }}:{{ .Values.copySecretsImage.tag }}"
120+
imagePullPolicy: {{ .Values.copySecretsImage.pullPolicy }}
120121
name: chown
121122
volumeMounts:
122-
- name: chowned-secrets
123-
mountPath: /chowned-secrets
123+
- name: copied-secrets
124+
mountPath: /copied-secrets
124125
{{- if .Values.zitadel.secretConfig }}
125126
- name: zitadel-secrets-yaml
126127
mountPath: /zitadel-secrets-yaml
@@ -141,9 +142,6 @@ spec:
141142
- name: db-ssl-user-crt
142143
mountPath: /db-ssl-user-crt
143144
{{- end }}
144-
securityContext:
145-
runAsNonRoot: false
146-
runAsUser: 0
147145
{{- end}}
148146
volumes:
149147
- name: zitadel-config-yaml
@@ -179,7 +177,7 @@ spec:
179177
secret:
180178
secretName: {{ .Values.zitadel.dbSslUserCrtSecret }}
181179
{{- end }}
182-
- name: chowned-secrets
180+
- name: copied-secrets
183181
emptyDir: {}
184182
{{- with .Values.extraVolumes }}
185183
{{- toYaml . | nindent 6 }}

‎charts/zitadel/templates/setupjob.yaml

+9-11
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,9 @@ spec:
9595
volumeMounts:
9696
- name: zitadel-config-yaml
9797
mountPath: /config
98-
- name: chowned-secrets
98+
- name: copied-secrets
9999
mountPath: /.secrets
100+
readOnly: true
100101
{{- if include "deepCheck" (dict "root" .Values "path" (splitList "." "zitadel.configmapConfig.FirstInstance.Org.Machine")) }}
101102
- name: machinekey
102103
mountPath: "/machinekey"
@@ -138,16 +139,16 @@ spec:
138139
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.configSecretName "path" "/zitadel-secret-config-yaml/" ))
139140
(include "zitadel.makecpcommand" (dict "value" (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) "path" "/db-ssl-ca-crt/" ))
140141
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslUserCrtSecret "path" "/db-ssl-user-crt/" ))
141-
)) }} chown -R 1000:1000 /chowned-secrets/ && find /chowned-secrets/ -type f -exec chmod 400 -- {} + "
142+
)) }} find /copied-secrets/ -type f -exec chmod 400 -- {} + "
142143
command:
143144
- sh
144145
- -c
145-
image: "{{ .Values.chownImage.repository }}:{{ .Values.chownImage.tag }}"
146-
imagePullPolicy: {{ .Values.chownImage.pullPolicy }}
147-
name: chown
146+
image: "{{ .Values.copySecretsImage.repository }}:{{ .Values.copySecretsImage.tag }}"
147+
imagePullPolicy: {{ .Values.copySecretsImage.pullPolicy }}
148+
name: copy-secrets
148149
volumeMounts:
149-
- name: chowned-secrets
150-
mountPath: /chowned-secrets
150+
- name: copied-secrets
151+
mountPath: /copied-secrets
151152
{{- if .Values.zitadel.secretConfig }}
152153
- name: zitadel-secrets-yaml
153154
mountPath: /zitadel-secrets-yaml
@@ -164,9 +165,6 @@ spec:
164165
- name: db-ssl-user-crt
165166
mountPath: /db-ssl-user-crt
166167
{{- end }}
167-
securityContext:
168-
runAsNonRoot: false
169-
runAsUser: 0
170168
{{- end }}
171169
volumes:
172170
- name: zitadel-config-yaml
@@ -201,7 +199,7 @@ spec:
201199
- name: machinekey
202200
emptyDir: { }
203201
{{- end }}
204-
- name: chowned-secrets
202+
- name: copied-secrets
205203
emptyDir: {}
206204
{{- with .Values.extraVolumes }}
207205
{{- toYaml . | nindent 6 }}

‎charts/zitadel/values.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ image:
8282
# Overrides the image tag whose default is the chart appVersion.
8383
tag: ""
8484

85-
chownImage:
85+
copySecretsImage:
8686
repository: alpine
8787
pullPolicy: IfNotPresent
8888
tag: "3.19"
@@ -119,9 +119,9 @@ podAdditionalLabels: {}
119119

120120
podSecurityContext:
121121
runAsNonRoot: true
122-
runAsUser: 1000
123122

124-
securityContext: {}
123+
securityContext:
124+
runAsNonRoot: true
125125

126126
# Additional environment variables
127127
env:

0 commit comments

Comments
 (0)