From 2e752d180a0dea47db1256d443df4ad1231bc064 Mon Sep 17 00:00:00 2001
From: "DODDA, PRATEEK REDDY (PD2839)" <pd2839@att.com>
Date: Wed, 1 Jul 2020 10:57:40 -0500
Subject: [PATCH] Add missing security context to Heat pods/containers

This updates the heat chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to true

Change-Id: I7ba17382059dfc23ab125a49b2b302166915c350
---
 heat/templates/cron-job-engine-cleaner.yaml |  2 ++
 heat/templates/job-ks-user-domain.yaml      |  2 ++
 heat/templates/job-trusts.yaml              |  2 ++
 heat/values.yaml                            | 21 +++++++++++++++++++++
 4 files changed, 27 insertions(+)

diff --git a/heat/templates/cron-job-engine-cleaner.yaml b/heat/templates/cron-job-engine-cleaner.yaml
index 6da474083f..2ebfaaff82 100644
--- a/heat/templates/cron-job-engine-cleaner.yaml
+++ b/heat/templates/cron-job-engine-cleaner.yaml
@@ -53,6 +53,7 @@ spec:
 {{ dict "envAll" $envAll "podName" "heat-engine-cleaner" "containerNames" (list "heat-engine-cleaner" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
         spec:
           serviceAccountName: {{ $serviceAccountName }}
+{{ dict "envAll" $envAll "application" "engine_cleaner" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 10 }}
           restartPolicy: OnFailure
           nodeSelector:
             {{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }}
@@ -62,6 +63,7 @@ spec:
             - name: heat-engine-cleaner
 {{ tuple $envAll "heat_engine_cleaner" | include "helm-toolkit.snippets.image" | indent 14 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.engine_cleaner | include "helm-toolkit.snippets.kubernetes_resources" | indent 14 }}
+{{ dict "envAll" $envAll "application" "engine_cleaner" "container" "heat_engine_cleaner" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 14 }}
               command:
                 - /tmp/heat-engine-cleaner.sh
               volumeMounts:
diff --git a/heat/templates/job-ks-user-domain.yaml b/heat/templates/job-ks-user-domain.yaml
index 9158402092..c41ea881c2 100644
--- a/heat/templates/job-ks-user-domain.yaml
+++ b/heat/templates/job-ks-user-domain.yaml
@@ -36,6 +36,7 @@ spec:
 {{ dict "envAll" $envAll "podName" "heat-domain-ks-user" "containerNames" (list "heat-ks-domain-user" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}
+{{ dict "envAll" $envAll "application" "ks_user" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       restartPolicy: OnFailure
       nodeSelector:
         {{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }}
@@ -44,6 +45,7 @@ spec:
       containers:
         - name: heat-ks-domain-user
 {{ tuple $envAll "ks_user" | include "helm-toolkit.snippets.image" | indent 10 }}
+{{ dict "envAll" $envAll "application" "ks_user" "container" "heat_ks_domain_user" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
             - /tmp/ks-domain-user.sh
           volumeMounts:
diff --git a/heat/templates/job-trusts.yaml b/heat/templates/job-trusts.yaml
index 10f156d908..444f82f5af 100644
--- a/heat/templates/job-trusts.yaml
+++ b/heat/templates/job-trusts.yaml
@@ -38,6 +38,7 @@ spec:
 {{ dict "envAll" $envAll "podName" "heat-trusts" "containerNames" (list "heat-trusts" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}
+{{ dict "envAll" $envAll "application" "trusts" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       restartPolicy: OnFailure
       nodeSelector:
         {{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }}
@@ -47,6 +48,7 @@ spec:
         - name: heat-trusts
 {{ tuple $envAll "ks_service" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.trusts | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "trusts" "container" "heat_trusts" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
             - bash
             - /tmp/trusts.sh
diff --git a/heat/values.yaml b/heat/values.yaml
index 347858395f..660b7fb0bc 100644
--- a/heat/values.yaml
+++ b/heat/values.yaml
@@ -1044,6 +1044,27 @@ pod:
         heat_engine:
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+    trusts:
+      pod:
+        runAsUser: 42424
+      container:
+        heat_trusts:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+    ks_user:
+      pod:
+        runAsUser: 42424
+      container:
+        heat_ks_domain_user:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+    engine_cleaner:
+      pod:
+        runAsUser: 42424
+      container:
+        heat_engine_cleaner:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
   affinity:
     anti:
       type: