Skip to content

Commit 2631195

Browse files
Simon Emmsroboquat
Simon Emms
authored and
roboquat
committed
[installer]: fix incorrectly configured pod security policies
This now makes Gitpod work in a cluster with pod security policies enabled.
1 parent 537672b commit 2631195

File tree

17 files changed

+168
-8
lines changed

17 files changed

+168
-8
lines changed

‎installer/pkg/common/constants.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ const (
3434
RegistryAuthSecret = "builtin-registry-auth"
3535
RegistryTLSCertSecret = "builtin-registry-certs"
3636
RegistryFacadeComponent = "registry-facade"
37-
RegistryFacadeServicePort = 3000
37+
RegistryFacadeServicePort = 30000
3838
RegistryFacadeTLSCertSecret = "builtin-registry-facade-cert"
3939
ServerComponent = "server"
4040
SystemNodeCritical = "system-node-critical"

‎installer/pkg/components/components.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ var MetaObjects = common.CompositeRenderFunc(
3838
database.Objects,
3939
imagebuildermk3.Objects,
4040
migrations.Objects,
41+
minio.Objects,
4142
openvsxproxy.Objects,
4243
rabbitmq.Objects,
4344
server.Objects,

‎installer/pkg/components/database/cloudsql/objects.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
var Objects = common.CompositeRenderFunc(
1313
deployment,
1414
dbinit.Objects,
15+
rolebinding,
1516
common.DefaultServiceAccount(Component),
1617
common.GenerateService(Component, map[string]common.ServicePort{
1718
Component: {

‎installer/pkg/components/database/cloudsql/rolebinding.go

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License-AGPL.txt in the project root for license information.
4+
5+
package cloudsql
6+
7+
import (
8+
"fmt"
9+
"github.com/gitpod-io/gitpod/installer/pkg/common"
10+
rbacv1 "k8s.io/api/rbac/v1"
11+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
12+
"k8s.io/apimachinery/pkg/runtime"
13+
)
14+
15+
func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
16+
return []runtime.Object{&rbacv1.RoleBinding{
17+
TypeMeta: common.TypeMetaRoleBinding,
18+
ObjectMeta: metav1.ObjectMeta{
19+
Name: Component,
20+
Namespace: ctx.Namespace,
21+
Labels: common.DefaultLabels(Component),
22+
},
23+
RoleRef: rbacv1.RoleRef{
24+
Kind: "ClusterRole",
25+
Name: fmt.Sprintf("%s-ns-psp:restricted-root-user", ctx.Namespace),
26+
APIGroup: "rbac.authorization.k8s.io",
27+
},
28+
Subjects: []rbacv1.Subject{{
29+
Kind: "ServiceAccount",
30+
Name: Component,
31+
}},
32+
}}, nil
33+
}

‎installer/pkg/components/database/incluster/objects.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010

1111
var Objects = common.CompositeRenderFunc(
1212
configmap,
13+
rolebinding,
1314
secrets,
1415
service,
1516
common.DefaultServiceAccount(Component),

‎installer/pkg/components/database/incluster/rolebinding.go

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License-AGPL.txt in the project root for license information.
4+
5+
package incluster
6+
7+
import (
8+
"fmt"
9+
"github.com/gitpod-io/gitpod/installer/pkg/common"
10+
rbacv1 "k8s.io/api/rbac/v1"
11+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
12+
"k8s.io/apimachinery/pkg/runtime"
13+
)
14+
15+
func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
16+
return []runtime.Object{
17+
&rbacv1.RoleBinding{
18+
TypeMeta: common.TypeMetaRoleBinding,
19+
ObjectMeta: metav1.ObjectMeta{
20+
Name: Component,
21+
Namespace: ctx.Namespace,
22+
Labels: common.DefaultLabels(Component),
23+
},
24+
RoleRef: rbacv1.RoleRef{
25+
Kind: "ClusterRole",
26+
Name: fmt.Sprintf("%s-ns-psp:restricted-root-user", ctx.Namespace),
27+
APIGroup: "rbac.authorization.k8s.io",
28+
},
29+
Subjects: []rbacv1.Subject{
30+
{
31+
Kind: "ServiceAccount",
32+
Name: Component,
33+
},
34+
},
35+
},
36+
}, nil
37+
}

‎installer/pkg/components/database/init/objects.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,6 @@ import (
1111
var Objects = common.CompositeRenderFunc(
1212
configmap,
1313
job,
14+
rolebinding,
1415
common.DefaultServiceAccount(Component),
1516
)

‎installer/pkg/components/database/init/rolebinding.go

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License-AGPL.txt in the project root for license information.
4+
5+
package init
6+
7+
import (
8+
"fmt"
9+
"github.com/gitpod-io/gitpod/installer/pkg/common"
10+
rbacv1 "k8s.io/api/rbac/v1"
11+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
12+
"k8s.io/apimachinery/pkg/runtime"
13+
)
14+
15+
func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
16+
return []runtime.Object{&rbacv1.RoleBinding{
17+
TypeMeta: common.TypeMetaRoleBinding,
18+
ObjectMeta: metav1.ObjectMeta{
19+
Name: Component,
20+
Namespace: ctx.Namespace,
21+
Labels: common.DefaultLabels(Component),
22+
},
23+
RoleRef: rbacv1.RoleRef{
24+
Kind: "ClusterRole",
25+
Name: fmt.Sprintf("%s-ns-psp:restricted-root-user", ctx.Namespace),
26+
APIGroup: "rbac.authorization.k8s.io",
27+
},
28+
Subjects: []rbacv1.Subject{{
29+
Kind: "ServiceAccount",
30+
Name: Component,
31+
}},
32+
}}, nil
33+
}

‎installer/pkg/components/image-builder-mk3/clusterrole.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ func clusterrole(ctx *common.RenderContext) ([]runtime.Object, error) {
1818
return []runtime.Object{&rbacv1.ClusterRole{
1919
TypeMeta: common.TypeMetaClusterRole,
2020
ObjectMeta: metav1.ObjectMeta{
21-
Name: Component,
21+
Name: fmt.Sprintf("%s-ns-%s", ctx.Namespace, Component),
2222
Namespace: ctx.Namespace,
2323
Labels: common.DefaultLabels(Component),
2424
},

‎installer/pkg/components/image-builder-mk3/rolebinding.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
2727
},
2828
RoleRef: rbacv1.RoleRef{
2929
Kind: "ClusterRole",
30-
Name: fmt.Sprintf("%s-ns-image-builder-mk3", ctx.Namespace),
30+
Name: fmt.Sprintf("%s-ns-%s", ctx.Namespace, Component),
3131
APIGroup: "rbac.authorization.k8s.io",
3232
},
3333
Subjects: []rbacv1.Subject{{

‎installer/pkg/components/minio/objects.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License-AGPL.txt in the project root for license information.
4+
5+
package minio
6+
7+
import (
8+
"github.com/gitpod-io/gitpod/installer/pkg/common"
9+
)
10+
11+
const Component = "minio"
12+
13+
var Objects = common.CompositeRenderFunc(
14+
rolebinding,
15+
)

‎installer/pkg/components/minio/rolebinding.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License-AGPL.txt in the project root for license information.
4+
5+
package minio
6+
7+
import (
8+
"fmt"
9+
"github.com/gitpod-io/gitpod/installer/pkg/common"
10+
rbacv1 "k8s.io/api/rbac/v1"
11+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
12+
"k8s.io/apimachinery/pkg/runtime"
13+
)
14+
15+
func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
16+
return []runtime.Object{
17+
&rbacv1.RoleBinding{
18+
TypeMeta: common.TypeMetaRoleBinding,
19+
ObjectMeta: metav1.ObjectMeta{
20+
Name: Component,
21+
Namespace: ctx.Namespace,
22+
Labels: common.DefaultLabels(Component),
23+
},
24+
RoleRef: rbacv1.RoleRef{
25+
Kind: "ClusterRole",
26+
Name: fmt.Sprintf("%s-ns-psp:unprivileged", ctx.Namespace),
27+
APIGroup: "rbac.authorization.k8s.io",
28+
},
29+
Subjects: []rbacv1.Subject{{
30+
Kind: "ServiceAccount",
31+
Name: Component,
32+
}},
33+
},
34+
}, nil
35+
}

‎installer/pkg/components/rabbitmq/helm.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,7 @@ var Helm = common.CompositeHelmFunc(
277277
helm.KeyValue("rabbitmq.auth.password", password),
278278
helm.KeyValue("rabbitmq.auth.existingErlangSecret", CookieSecret),
279279
helm.KeyValue("rabbitmq.auth.tls.existingSecret", TLSSecret),
280+
helm.KeyValue("rabbitmq.serviceAccount.name", Component),
280281
helm.KeyValue(fmt.Sprintf("rabbitmq.extraSecrets.%s.username", InClusterDbSecret), username),
281282
helm.KeyValue(fmt.Sprintf("rabbitmq.extraSecrets.%s.password", InClusterDbSecret), password),
282283
helm.ImagePullSecrets("rabbitmq.image.pullSecrets", cfg),

‎installer/pkg/components/registry-facade/clusterrole.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@ func clusterrole(ctx *common.RenderContext) ([]runtime.Object, error) {
1919
&rbacv1.ClusterRole{
2020
TypeMeta: common.TypeMetaClusterRole,
2121
ObjectMeta: metav1.ObjectMeta{
22-
Name: Component,
22+
Name: fmt.Sprintf("%s-ns-%s", ctx.Namespace, Component),
2323
Namespace: ctx.Namespace,
2424
Labels: common.DefaultLabels(Component),
2525
},
2626
Rules: []rbacv1.PolicyRule{{
2727
APIGroups: []string{"policy"},
2828
Resources: []string{"podsecuritypolicies"},
2929
Verbs: []string{"use"},
30-
ResourceNames: []string{fmt.Sprintf("%s-ns-registry-facade", ctx.Namespace)},
30+
ResourceNames: []string{fmt.Sprintf("%s-ns-%s", ctx.Namespace, Component)},
3131
}},
3232
},
3333
}, nil

‎installer/pkg/components/registry-facade/rolebinding.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
2727
},
2828
RoleRef: rbacv1.RoleRef{
2929
Kind: "ClusterRole",
30-
Name: fmt.Sprintf("%s-ns-registry-facade", ctx.Namespace),
30+
Name: fmt.Sprintf("%s-ns-%s", ctx.Namespace, Component),
3131
APIGroup: "rbac.authorization.k8s.io",
3232
},
3333
Subjects: []rbacv1.Subject{{

‎installer/pkg/components/server/rolebinding.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
6161
},
6262
RoleRef: rbacv1.RoleRef{
6363
Kind: "ClusterRole",
64-
Name: Component,
64+
Name: fmt.Sprintf("%s-ns-psp:unprivileged", ctx.Namespace),
6565
APIGroup: "rbac.authorization.k8s.io",
6666
},
6767
Subjects: []rbacv1.Subject{{

‎installer/third_party/charts/jaeger-operator/values.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,6 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License-AGPL.txt in the project root for license information.
44

5-
jaeger-operator: {}
5+
jaeger-operator:
6+
rbac:
7+
pspEnabled: true

0 commit comments

Comments
 (0)