From 46afde4c6d88d2d0f61fb66c8cd6cfcc5b1c21f8 Mon Sep 17 00:00:00 2001
From: "DODDA, PRATEEK REDDY (pd2839)" <pd2839@att.com>
Date: Mon, 20 Jul 2020 14:26:26 -0500
Subject: [PATCH] Add missing security context to Keystone pods/containers

This updates the Keystone chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to true

Change-Id: I655ef19a3c187e3462ff8ec1a54bc9691ca64d41
---
 keystone/templates/cron-job-fernet-rotate.yaml | 2 ++
 keystone/values.yaml                           | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/keystone/templates/cron-job-fernet-rotate.yaml b/keystone/templates/cron-job-fernet-rotate.yaml
index 3ae585fd38..1090dc7365 100644
--- a/keystone/templates/cron-job-fernet-rotate.yaml
+++ b/keystone/templates/cron-job-fernet-rotate.yaml
@@ -72,6 +72,7 @@ spec:
 {{ tuple $envAll "keystone" "fernet-rotate" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 12 }}
         spec:
           serviceAccountName: {{ $serviceAccountName }}
+{{ dict "envAll" $envAll "application" "fernet_rotate" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 10 }}
           initContainers:
 {{ tuple $envAll "fernet_rotate" $mounts_keystone_fernet_rotate_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 12 }}
           restartPolicy: OnFailure
@@ -81,6 +82,7 @@ spec:
             - name: keystone-fernet-rotate
 {{ tuple $envAll "keystone_fernet_rotate" | include "helm-toolkit.snippets.image" | indent 14 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.fernet_rotate | include "helm-toolkit.snippets.kubernetes_resources" | indent 14 }}
+{{ dict "envAll" $envAll "application" "fernet_rotate" "container" "keystone_fernet_rotate" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 14}}
               env:
                 - name: KEYSTONE_USER
                   value: {{ .Values.jobs.fernet_rotate.user | quote }}
diff --git a/keystone/values.yaml b/keystone/values.yaml
index 32d3dafa59..991e75438e 100644
--- a/keystone/values.yaml
+++ b/keystone/values.yaml
@@ -186,6 +186,13 @@ pod:
         keystone_fernet_setup:
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+    fernet_rotate:
+      pod:
+        runAsUser: 42424
+      container:
+        keystone_fernet_rotate:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
     domain_manage:
       pod:
         runAsUser: 42424