From b6daa6d53f23b677e74d6c6947bd7fe81ea586bb Mon Sep 17 00:00:00 2001 From: fheslouin Date: Tue, 24 Mar 2026 12:01:09 +0100 Subject: [PATCH] :lock:(helm) add pod and container securityContext This commit aim at adding a securityContext for pod and container in Deployment and Job, it include livekit pods as well It adds 2 values : - podSecurityContext : for pods - securityContext : for containers Please note that `celeryBackend` Deployment does not have any values defined in `values.meet.yaml` at the moment. --- CHANGELOG.md | 1 + src/frontend/Dockerfile | 6 ++- src/helm/env.d/common.yaml.gotmpl | 38 +++++++++++++++++++ .../env.d/dev-dinum/values.egress.yaml.gotmpl | 12 ++++++ .../dev-dinum/values.livekit.yaml.gotmpl | 10 +++++ .../env.d/dev-dinum/values.meet.yaml.gotmpl | 2 +- .../dev-keycloak/values.egress.yaml.gotmpl | 12 ++++++ .../dev-keycloak/values.livekit.yaml.gotmpl | 10 +++++ .../dev-keycloak/values.meet.yaml.gotmpl | 3 +- src/helm/helmfile.yaml.gotmpl | 3 ++ .../meet/templates/agents_deployment.yaml | 4 ++ .../meet/templates/backend_deployment.yaml | 4 ++ .../backend_job_createsuperuser.yaml | 4 ++ .../meet/templates/backend_job_migrate.yaml | 4 ++ .../templates/celery_backend_deployment.yaml | 4 ++ .../celery_summarize_deployment.yaml | 4 ++ .../celery_transcribe_deployment.yaml | 4 ++ .../meet/templates/frontend_deployment.yaml | 4 ++ .../meet/templates/summary_deployment.yaml | 4 ++ src/helm/meet/values.yaml | 35 +++++++++++++---- 20 files changed, 157 insertions(+), 11 deletions(-) create mode 100644 src/helm/env.d/common.yaml.gotmpl diff --git a/CHANGELOG.md b/CHANGELOG.md index 181a3125..7f9c83ef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ and this project adheres to ### Fixed +- ⚡️(helm) Add pod and container securityContext #4805 - 🔒️(backend) fix email disclosure in room invitation endpoint #1200 - 🐛(backend) fix regression in update-participant endpoint #1204 diff --git a/src/frontend/Dockerfile b/src/frontend/Dockerfile index 5f2a9ded..12b972d1 100644 --- a/src/frontend/Dockerfile +++ b/src/frontend/Dockerfile @@ -1,5 +1,7 @@ FROM node:20-alpine AS frontend-deps +USER node + WORKDIR /home/frontend/ COPY ./src/frontend/package.json ./package.json @@ -8,7 +10,7 @@ COPY ./src/frontend/package-lock.json ./package-lock.json RUN npm ci COPY .dockerignore ./.dockerignore -COPY ./src/frontend/ . +COPY --chown=node:node ./src/frontend/ . ### ---- Front-end builder image ---- FROM frontend-deps AS meet @@ -17,6 +19,8 @@ WORKDIR /home/frontend FROM frontend-deps AS meet-dev +USER node + WORKDIR /home/frontend EXPOSE 8080 diff --git a/src/helm/env.d/common.yaml.gotmpl b/src/helm/env.d/common.yaml.gotmpl new file mode 100644 index 00000000..1a427b7f --- /dev/null +++ b/src/helm/env.d/common.yaml.gotmpl @@ -0,0 +1,38 @@ +.podSecurityContext: &podSecurityContext + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + fsGroupChangePolicy: "OnRootMismatch" + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + +.securityContext: &securityContext + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + +frontend: + podSecurityContext: *podSecurityContext + securityContext: *securityContext + +backend: + podSecurityContext: *podSecurityContext + securityContext: *securityContext + +summary: + podSecurityContext: *podSecurityContext + securityContext: *securityContext + +celeryTranscribe: + podSecurityContext: *podSecurityContext + securityContext: *securityContext + +celerySummarize: + podSecurityContext: *podSecurityContext + securityContext: *securityContext + +agents: + podSecurityContext: *podSecurityContext + securityContext: *securityContext diff --git a/src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl b/src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl index 5d09dfca..3635064f 100644 --- a/src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl +++ b/src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl @@ -23,6 +23,18 @@ egress: endpoint: http://minio:9000 force_path_style: true +podSecurityContext: + fsGroup: 1000 + fsGroupChangePolicy: "OnRootMismatch" + +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + loadBalancer: type: nginx annotations: diff --git a/src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl b/src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl index aac470fa..d51acf3c 100644 --- a/src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl +++ b/src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl @@ -28,6 +28,16 @@ livekit: urls: - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/ +podSecurityContext: + fsGroup: 2000 + +securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 loadBalancer: type: nginx diff --git a/src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl b/src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl index 661f83f8..ba12a38d 100644 --- a/src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl +++ b/src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl @@ -162,7 +162,7 @@ ingressWebhook: posthog: ingress: enabled: false - + ingressAssets: enabled: false diff --git a/src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl b/src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl index b295b5af..617bd0ef 100644 --- a/src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl +++ b/src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl @@ -26,6 +26,18 @@ egress: endpoint: http://minio:9000 force_path_style: true +podSecurityContext: + fsGroup: 1000 + fsGroupChangePolicy: "OnRootMismatch" + +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + loadBalancer: type: nginx annotations: diff --git a/src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl b/src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl index aac470fa..d51acf3c 100644 --- a/src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl +++ b/src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl @@ -28,6 +28,16 @@ livekit: urls: - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/ +podSecurityContext: + fsGroup: 2000 + +securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 loadBalancer: type: nginx diff --git a/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl b/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl index 2facede6..ad46f725 100644 --- a/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl +++ b/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl @@ -112,7 +112,6 @@ backend: CELERY_ENABLED: True CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1 - migrate: command: - "/bin/sh" @@ -180,7 +179,7 @@ ingressWebhook: posthog: ingress: enabled: false - + ingressAssets: enabled: false diff --git a/src/helm/helmfile.yaml.gotmpl b/src/helm/helmfile.yaml.gotmpl index a9e754e6..76e75be2 100644 --- a/src/helm/helmfile.yaml.gotmpl +++ b/src/helm/helmfile.yaml.gotmpl @@ -37,6 +37,7 @@ releases: missingFileHandler: Warn chart: ./meet values: + - env.d/common.yaml.gotmpl - env.d/{{ .Environment.Name }}/values.meet.yaml.gotmpl - env.d/{{ .Environment.Name }}/values.secrets.yaml secrets: @@ -48,6 +49,7 @@ releases: namespace: {{ .Namespace }} chart: livekit/livekit-server values: + - env.d/common.yaml.gotmpl - env.d/{{ .Environment.Name }}/values.livekit.yaml.gotmpl - env.d/{{ .Environment.Name }}/values.secrets.yaml secrets: @@ -59,6 +61,7 @@ releases: namespace: {{ .Namespace }} chart: livekit/egress values: + - env.d/common.yaml.gotmpl - env.d/{{ .Environment.Name }}/values.egress.yaml.gotmpl - env.d/{{ .Environment.Name }}/values.secrets.yaml secrets: diff --git a/src/helm/meet/templates/agents_deployment.yaml b/src/helm/meet/templates/agents_deployment.yaml index 56d8055c..4d62e49b 100644 --- a/src/helm/meet/templates/agents_deployment.yaml +++ b/src/helm/meet/templates/agents_deployment.yaml @@ -31,6 +31,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.agents.shareProcessNamespace }} + {{- with .Values.agents.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.agents.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/templates/backend_deployment.yaml b/src/helm/meet/templates/backend_deployment.yaml index 14468763..bb848ef4 100644 --- a/src/helm/meet/templates/backend_deployment.yaml +++ b/src/helm/meet/templates/backend_deployment.yaml @@ -31,6 +31,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }} + {{- with .Values.backend.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.backend.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/templates/backend_job_createsuperuser.yaml b/src/helm/meet/templates/backend_job_createsuperuser.yaml index 0203ce36..8ff654df 100644 --- a/src/helm/meet/templates/backend_job_createsuperuser.yaml +++ b/src/helm/meet/templates/backend_job_createsuperuser.yaml @@ -30,6 +30,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }} + {{- with .Values.backend.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.backend.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/templates/backend_job_migrate.yaml b/src/helm/meet/templates/backend_job_migrate.yaml index 8f05ec84..efc901b5 100644 --- a/src/helm/meet/templates/backend_job_migrate.yaml +++ b/src/helm/meet/templates/backend_job_migrate.yaml @@ -30,6 +30,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }} + {{- with .Values.backend.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.backend.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/templates/celery_backend_deployment.yaml b/src/helm/meet/templates/celery_backend_deployment.yaml index 32656a8d..0d413646 100644 --- a/src/helm/meet/templates/celery_backend_deployment.yaml +++ b/src/helm/meet/templates/celery_backend_deployment.yaml @@ -31,6 +31,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.celeryBackend.shareProcessNamespace }} + {{- with .Values.celeryBackend.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.celeryBackend.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/templates/celery_summarize_deployment.yaml b/src/helm/meet/templates/celery_summarize_deployment.yaml index 31993488..744f338a 100644 --- a/src/helm/meet/templates/celery_summarize_deployment.yaml +++ b/src/helm/meet/templates/celery_summarize_deployment.yaml @@ -31,6 +31,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.celerySummarize.shareProcessNamespace }} + {{- with .Values.celerySummarize.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.celerySummarize.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/templates/celery_transcribe_deployment.yaml b/src/helm/meet/templates/celery_transcribe_deployment.yaml index 3ab55fa9..db44cfc0 100644 --- a/src/helm/meet/templates/celery_transcribe_deployment.yaml +++ b/src/helm/meet/templates/celery_transcribe_deployment.yaml @@ -31,6 +31,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.celeryTranscribe.shareProcessNamespace }} + {{- with .Values.celeryTranscribe.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.celeryTranscribe.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/templates/frontend_deployment.yaml b/src/helm/meet/templates/frontend_deployment.yaml index ba508ca2..003a4619 100644 --- a/src/helm/meet/templates/frontend_deployment.yaml +++ b/src/helm/meet/templates/frontend_deployment.yaml @@ -31,6 +31,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.frontend.shareProcessNamespace }} + {{- with .Values.frontend.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.frontend.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/templates/summary_deployment.yaml b/src/helm/meet/templates/summary_deployment.yaml index b39497cf..4b5b0a3a 100644 --- a/src/helm/meet/templates/summary_deployment.yaml +++ b/src/helm/meet/templates/summary_deployment.yaml @@ -31,6 +31,10 @@ spec: - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }} {{- end }} shareProcessNamespace: {{ .Values.summary.shareProcessNamespace }} + {{- with .Values.summary.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: {{- with .Values.summary.sidecars }} {{- toYaml . | nindent 8 }} diff --git a/src/helm/meet/values.yaml b/src/helm/meet/values.yaml index 05a12832..2a09fa89 100644 --- a/src/helm/meet/values.yaml +++ b/src/helm/meet/values.yaml @@ -216,9 +216,12 @@ backend: ttlSecondsAfterFinished: 30 backoffLimit: 2 - ## @param backend.securityContext Configure backend Pod security context + ## @param backend.securityContext Configure backend Container security context securityContext: null + ## @param backend.podSecurityContext Configure backend Pod security context + podSecurityContext: null + ## @param backend.envVars Configure backend container environment variables ## @extra backend.envVars.BY_VALUE Example environment variable by setting value directly ## @extra backend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap @@ -359,9 +362,12 @@ frontend: ## @param frontend.sidecars Add sidecars containers to frontend deployment sidecars: [] - ## @param frontend.securityContext Configure frontend Pod security context + ## @param frontend.securityContext Configure frontend Container security context securityContext: null + ## @param frontend.podSecurityContext Configure frontend Pod security context + podSecurityContext: null + ## @param frontend.envVars Configure frontend container environment variables ## @extra frontend.envVars.BY_VALUE Example environment variable by setting value directly ## @extra frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap @@ -533,9 +539,12 @@ summary: ## @param summary.migrateJobAnnotations Annotations for the migrate job migrateJobAnnotations: {} - ## @param summary.securityContext Configure summary Pod security context + ## @param summary.securityContext Configure summary Container security context securityContext: null + ## @param summary.podSecurityContext Configure summary Pod security context + podSecurityContext: null + ## @param summary.envVars Configure summary container environment variables ## @extra summary.envVars.BY_VALUE Example environment variable by setting value directly ## @extra summary.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap @@ -646,9 +655,12 @@ celeryBackend: ## @param celeryBackend.migrateJobAnnotations Annotations for the migrate job migrateJobAnnotations: {} - ## @param celeryBackend.securityContext Configure celeryBackend Pod security context + ## @param celeryBackend.securityContext Configure celeryBackend Container security context securityContext: null + ## @param celeryBackend.podSecurityContext Configure celeryBackend Pod security context + podSecurityContext: null + ## @param celeryBackend.envVars Configure celeryBackend container environment variables ## @extra celeryBackend.envVars.BY_VALUE Example environment variable by setting value directly ## @extra celeryBackend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap @@ -755,9 +767,12 @@ celeryTranscribe: ## @param celeryTranscribe.migrateJobAnnotations Annotations for the migrate job migrateJobAnnotations: {} - ## @param celeryTranscribe.securityContext Configure celeryTranscribe Pod security context + ## @param celeryTranscribe.securityContext Configure celeryTranscribe Container security context securityContext: null + ## @param celeryTranscribe.podSecurityContext Configure celeryTranscribe Pod security context + podSecurityContext: null + ## @param celeryTranscribe.envVars Configure celeryTranscribe container environment variables ## @extra celeryTranscribe.envVars.BY_VALUE Example environment variable by setting value directly ## @extra celeryTranscribe.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap @@ -864,9 +879,12 @@ celerySummarize: ## @param celerySummarize.migrateJobAnnotations Annotations for the migrate job migrateJobAnnotations: {} - ## @param celerySummarize.securityContext Configure celerySummarize Pod security context + ## @param celerySummarize.securityContext Configure celerySummarize Container security context securityContext: null + ## @param celerySummarize.podSecurityContext Configure celerySummarize Pod security context + podSecurityContext: null + ## @param celerySummarize.envVars Configure celerySummarize container environment variables ## @extra celerySummarize.envVars.BY_VALUE Example environment variable by setting value directly ## @extra celerySummarize.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap @@ -963,9 +981,12 @@ agents: ## @param agents.sidecars Add sidecars containers to agents deployment sidecars: [] - ## @param agents.securityContext Configure agents Pod security context + ## @param agents.securityContext Configure agents Container security context securityContext: null + ## @param agents.podSecurityContext Configure agents Pod security context + podSecurityContext: null + ## @param agents.envVars Configure agents container environment variables ## @extra agents.envVars.BY_VALUE Example environment variable by setting value directly ## @extra agents.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap