Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add support for enabling shareProcessNamespace #408

Merged
merged 4 commits into from
Dec 16, 2022
Merged

add support for enabling shareProcessNamespace #408

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
06af380
add share-process-namespace annotation
wolffberg Apr 21, 2022
49fb5d7
Merge branch 'main' into VAULT-5889/fork-share-process-namespace
benashz Dec 15, 2022
468c33b
Fix semantic merge issue
benashz Dec 15, 2022
4168a2d
Update the changelog
benashz Dec 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion agent-inject/agent/agent.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ const (
DefaultAgentRunAsUser = 100
DefaultAgentRunAsGroup = 1000
DefaultAgentRunAsSameUser = false
DefaultAgentShareProcessNamespace = false
DefaultAgentAllowPrivilegeEscalation = false
DefaultAgentDropCapabilities = "ALL"
DefaultAgentSetSecurityContext = true
Expand Down Expand Up @@ -137,6 +138,9 @@ type Agent struct {
// same as the first application container
RunAsSameID bool

// ShareProcessNamespace sets the shareProcessNamespace value on the pod spec.
ShareProcessNamespace bool

// SetSecurityContext controls whether the injected containers have a
// SecurityContext set.
SetSecurityContext bool
Expand Down Expand Up @@ -433,6 +437,11 @@ func New(pod *corev1.Pod) (*Agent, error) {
return agent, err
}

agent.ShareProcessNamespace, err = agent.setShareProcessNamespace(pod)
if err != nil {
return agent, err
}

agent.SetSecurityContext, err = agent.setSecurityContext()
if err != nil {
return agent, err
Expand Down Expand Up @@ -607,7 +616,7 @@ func (a *Agent) Patch() ([]byte, error) {
// to run first.
if a.InitFirst {

// Remove all init containers from the document so we can re-add them after the agent.
// Remove all init containers from the document, so we can re-add them after the agent.
if len(a.Pod.Spec.InitContainers) != 0 {
patches = append(patches, removeContainers("/spec/initContainers")...)
}
Expand Down Expand Up @@ -636,6 +645,9 @@ func (a *Agent) Patch() ([]byte, error) {
a.ContainerVolumeMounts(),
fmt.Sprintf("/spec/initContainers/%d/volumeMounts", i))...)
}

// Add shareProcessNamespace
patches = append(patches, updateShareProcessNamespace(a.ShareProcessNamespace)...)
}

// Sidecar Container
Expand Down
26 changes: 26 additions & 0 deletions agent-inject/agent/annotations.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,9 @@ const (
// Pod Spec.
AnnotationAgentRunAsSameUser = "vault.hashicorp.com/agent-run-as-same-user"

// AnnotationAgentShareProcessNamespace sets the shareProcessNamespace value on the pod spec.
AnnotationAgentShareProcessNamespace = "vault.hashicorp.com/agent-share-process-namespace"

// AnnotationAgentSetSecurityContext controls whether a SecurityContext (uid
// and gid) is set on the injected Vault Agent containers
AnnotationAgentSetSecurityContext = "vault.hashicorp.com/agent-set-security-context"
Expand Down Expand Up @@ -312,6 +315,7 @@ type AgentConfig struct {
GroupID string
SameID bool
SetSecurityContext bool
ShareProcessNamespace bool
ProxyAddress string
DefaultTemplate string
ResourceRequestCPU string
Expand All @@ -336,6 +340,7 @@ func Init(pod *corev1.Pod, cfg AgentConfig) error {
var runAsUserIsSet bool
var runAsSameUserIsSet bool
var runAsGroupIsSet bool
var shareProcessNamespaceIsSet bool

if pod == nil {
return errors.New("pod is empty")
Expand Down Expand Up @@ -455,6 +460,10 @@ func Init(pod *corev1.Pod, cfg AgentConfig) error {
pod.ObjectMeta.Annotations[AnnotationAgentRunAsSameUser] = strconv.FormatBool(cfg.SameID)
}

if _, shareProcessNamespaceIsSet = pod.ObjectMeta.Annotations[AnnotationAgentShareProcessNamespace]; !shareProcessNamespaceIsSet {
pod.ObjectMeta.Annotations[AnnotationAgentShareProcessNamespace] = strconv.FormatBool(cfg.ShareProcessNamespace)
}

if _, runAsGroupIsSet = pod.ObjectMeta.Annotations[AnnotationAgentRunAsGroup]; !runAsGroupIsSet {
if cfg.GroupID == "" {
cfg.GroupID = strconv.Itoa(DefaultAgentRunAsGroup)
Expand Down Expand Up @@ -736,6 +745,23 @@ func (a *Agent) runAsSameID(pod *corev1.Pod) (bool, error) {
return runAsSameID, nil
}

func (a *Agent) setShareProcessNamespace(pod *corev1.Pod) (bool, error) {
raw, ok := a.Annotations[AnnotationAgentShareProcessNamespace]
if !ok {
return DefaultAgentShareProcessNamespace, nil
}
shareProcessNamespace, err := strconv.ParseBool(raw)
if err != nil {
return DefaultAgentShareProcessNamespace, err
}
if pod.Spec.ShareProcessNamespace != nil {
if *pod.Spec.ShareProcessNamespace == false && shareProcessNamespace == true {
return DefaultAgentShareProcessNamespace, errors.New("Will not override shareProcessNamespace already set to false")
}
}
return strconv.ParseBool(raw)
}

func (a *Agent) setSecurityContext() (bool, error) {
raw, ok := a.Annotations[AnnotationAgentSetSecurityContext]
if !ok {
Expand Down
12 changes: 12 additions & 0 deletions agent-inject/agent/annotations_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@ func TestInitDefaults(t *testing.T) {
{annotationKey: AnnotationAgentImage, annotationValue: DefaultVaultImage},
{annotationKey: AnnotationAgentRunAsUser, annotationValue: strconv.Itoa(DefaultAgentRunAsUser)},
{annotationKey: AnnotationAgentRunAsGroup, annotationValue: strconv.Itoa(DefaultAgentRunAsGroup)},
{annotationKey: AnnotationAgentShareProcessNamespace, annotationValue: strconv.FormatBool(DefaultAgentShareProcessNamespace)},
}

for _, tt := range tests {
Expand Down Expand Up @@ -704,6 +705,14 @@ func TestCouldErrorAnnotations(t *testing.T) {
{AnnotationAgentRunAsGroup, "100", true},
{AnnotationAgentRunAsGroup, "root", false},

{AnnotationAgentShareProcessNamespace, "true", true},
{AnnotationAgentShareProcessNamespace, "false", true},
{AnnotationAgentShareProcessNamespace, "TRUE", true},
{AnnotationAgentShareProcessNamespace, "FALSE", true},
{AnnotationAgentShareProcessNamespace, "tRuE", false},
{AnnotationAgentShareProcessNamespace, "fAlSe", false},
{AnnotationAgentShareProcessNamespace, "", false},

{AnnotationAgentSetSecurityContext, "true", true},
{AnnotationAgentSetSecurityContext, "false", true},
{AnnotationAgentSetSecurityContext, "secure", false},
Expand Down Expand Up @@ -976,6 +985,7 @@ func TestInjectContainers(t *testing.T) {
internal.AddOp("/spec/containers/1/volumeMounts/-", nil),
internal.AddOp("/spec/containers/2/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(AnnotationAgentStatus), nil),
},
Expand All @@ -990,6 +1000,7 @@ func TestInjectContainers(t *testing.T) {
internal.AddOp("/spec/volumes", nil),
internal.AddOp("/spec/containers/1/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(AnnotationAgentStatus), nil),
},
Expand All @@ -1005,6 +1016,7 @@ func TestInjectContainers(t *testing.T) {
internal.AddOp("/spec/containers/1/volumeMounts/-", nil),
internal.AddOp("/spec/containers/2/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(AnnotationAgentStatus), nil),
},
Expand Down
6 changes: 6 additions & 0 deletions agent-inject/agent/patch.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,3 +82,9 @@ func updateAnnotations(target, annotations map[string]string) jsonpatch.Patch {

return result
}

func updateShareProcessNamespace(shareProcessNamespace bool) jsonpatch.Patch {
return []jsonpatch.Operation{
internal.AddOp("/spec/shareProcessNamespace", shareProcessNamespace),
}
}
2 changes: 2 additions & 0 deletions agent-inject/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ type Handler struct {
UserID string
GroupID string
SameID bool
ShareProcessNamespace bool
SetSecurityContext bool
DefaultTemplate string
ResourceRequestCPU string
Expand Down Expand Up @@ -195,6 +196,7 @@ func (h *Handler) Mutate(req *admissionv1.AdmissionRequest) *admissionv1.Admissi
GroupID: h.GroupID,
SameID: h.SameID,
SetSecurityContext: h.SetSecurityContext,
ShareProcessNamespace: h.ShareProcessNamespace,
DefaultTemplate: h.DefaultTemplate,
ResourceRequestCPU: h.ResourceRequestCPU,
ResourceRequestMem: h.ResourceRequestMem,
Expand Down
8 changes: 7 additions & 1 deletion agent-inject/handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,7 @@ func TestHandlerHandle(t *testing.T) {
internal.AddOp("/spec/containers/0/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers/-", nil),
internal.AddOp("/spec/initContainers/0/volumeMounts/-", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(agent.AnnotationAgentStatus), nil),
},
Expand Down Expand Up @@ -188,6 +189,7 @@ func TestHandlerHandle(t *testing.T) {
internal.AddOp("/spec/initContainers", nil),
internal.AddOp("/spec/initContainers/-", nil),
internal.AddOp("/spec/initContainers/1/volumeMounts/-", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(agent.AnnotationAgentStatus), nil),
},
Expand Down Expand Up @@ -217,11 +219,11 @@ func TestHandlerHandle(t *testing.T) {
internal.AddOp("/spec/containers/0/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers/-", nil),
internal.AddOp("/spec/initContainers/0/volumeMounts/-", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(agent.AnnotationAgentStatus), nil),
},
},

{
"tls pod injection",
basicHandler(),
Expand All @@ -248,6 +250,7 @@ func TestHandlerHandle(t *testing.T) {
internal.AddOp("/spec/containers/0/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers/-", nil),
internal.AddOp("/spec/initContainers/0/volumeMounts/-", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(agent.AnnotationAgentStatus), nil),
},
Expand Down Expand Up @@ -278,6 +281,7 @@ func TestHandlerHandle(t *testing.T) {
internal.AddOp("/spec/containers/0/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers/-", nil),
internal.AddOp("/spec/initContainers/0/volumeMounts/-", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(agent.AnnotationAgentStatus), nil),
},
Expand Down Expand Up @@ -336,6 +340,7 @@ func TestHandlerHandle(t *testing.T) {
internal.AddOp("/spec/containers/0/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers/-", nil),
internal.AddOp("/spec/initContainers/0/volumeMounts/-", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(agent.AnnotationAgentStatus), nil),
},
},
Expand Down Expand Up @@ -364,6 +369,7 @@ func TestHandlerHandle(t *testing.T) {
internal.AddOp("/spec/containers/0/volumeMounts/-", nil),
internal.AddOp("/spec/initContainers/-", nil),
internal.AddOp("/spec/initContainers/0/volumeMounts/-", nil),
internal.AddOp("/spec/shareProcessNamespace", nil),
internal.AddOp("/spec/containers/-", nil),
internal.AddOp("/metadata/annotations/"+internal.EscapeJSONPointer(agent.AnnotationAgentStatus), nil),
},
Expand Down