fix: init container security hardened for operation permission error (#1680)

helm/rustfs/templates/deployment.yaml

@@ -1,3 +1,5 @@
+{{- $logDir := .Values.config.rustfs.obs_log_directory }}
+
 {{- if .Values.mode.standalone.enabled }}
 apiVersion: apps/v1
 kind: Deployment
@@ -55,40 +57,36 @@ spec:
       tolerations:
         {{- toYaml .Values.tolerations | nindent 8 }}
       {{- end }}
-      {{- if .Values.podSecurityContext }}
       securityContext:
-      {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- end }}
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       {{- if .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml .Values.imagePullSecrets | nindent 8 }}
       {{- end }}
       initContainers:
         - name: init-step
-          image: "{{ .Values.initStep.image.repository }}:{{ .Values.initStep.image.tag }}"
-          imagePullPolicy: {{ .Values.initStep.image.pullPolicy }}
+          image: "{{ .Values.image.initImage.repository }}:{{ .Values.image.initImage.tag }}"
+          imagePullPolicy: {{ .Values.image.initImage.pullPolicy }}
           securityContext:
-            {{- toYaml .Values.initStep.containerSecurityContext | nindent 12 }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
           command:
             - sh
             - -c
             - |
-              mkdir -p /data /logs
-              chown 10001:10001 /data /logs
+              mkdir -p /data /mnt/rustfs/logs
+              chmod 755 /mnt/rustfs/logs
           volumeMounts:
             - name: data
               mountPath: /data
             - name: logs
-              mountPath: /logs
+              mountPath: /mnt/rustfs
       containers:
         - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          image: "{{ .Values.image.rustfs.repository }}:{{ .Values.image.rustfs.tag | default .Chart.AppVersion }}"
           command: ["/usr/bin/rustfs"]
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- if .Values.containerSecurityContext }}
+          imagePullPolicy: {{ .Values.image.rustfs.pullPolicy }}
           securityContext:
-          {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- end }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
           ports:
             - name: endpoint
               containerPort: {{ .Values.service.endpoint.port }}
@@ -121,14 +119,11 @@ spec:
             failureThreshold: 3
           volumeMounts:
             - name: logs
-              mountPath: /logs
+              mountPath: {{ $logDir }}
+              subPath: logs
             - name: data
               mountPath: /data
-            - name: tmp
-              mountPath: /tmp
       volumes:
-        - name: tmp
-          emptyDir: {}
         - name: logs
           persistentVolumeClaim:
             claimName: {{ include "rustfs.fullname" . }}-logs

helm/rustfs/templates/statefulset.yaml

@@ -59,20 +59,18 @@ spec:
       tolerations:
         {{- toYaml .Values.tolerations | nindent 8 }}
       {{- end }}
-      {{- if .Values.podSecurityContext }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- end }}
       {{- if .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml .Values.imagePullSecrets | nindent 8 }}
       {{- end }}
       initContainers:
         - name: init-step
-          image: "{{ .Values.initStep.image.repository }}:{{ .Values.initStep.image.tag }}"
-          imagePullPolicy: {{ .Values.initStep.image.pullPolicy }}
+          image: "{{ .Values.image.initImage.repository }}:{{ .Values.image.initImage.tag }}"
+          imagePullPolicy: {{ .Values.image.initImage.pullPolicy }}
           securityContext:
-            {{- toYaml .Values.initStep.containerSecurityContext | nindent 12 }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
           env:
             - name: REPLICA_COUNT
               value: {{ .Values.replicaCount | quote }}
@@ -87,8 +85,8 @@ spec:
               elif [ "$REPLICA_COUNT" -eq 16 ]; then
                 mkdir -p /data
               fi
-              mkdir -p {{ $logDir }}
-              chown 10001:10001 /data {{ $logDir }}
+              mkdir -p /mnt/rustfs/logs
+              chmod 755 /mnt/rustfs/logs
           volumeMounts:
             {{- if eq (int .Values.replicaCount) 4 }}
             {{- range $i := until (int .Values.replicaCount) }}
@@ -100,16 +98,14 @@ spec:
               mountPath: /data
             {{- end }}
             - name: logs
-              mountPath: {{ $logDir }}
+              mountPath: /mnt/rustfs
       containers:
         - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          image: "{{ .Values.image.rustfs.repository }}:{{ .Values.image.rustfs.tag | default .Chart.AppVersion }}"
           command: ["/usr/bin/rustfs"]
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- if .Values.containerSecurityContext }}
+          imagePullPolicy: {{ .Values.image.rustfs.pullPolicy }}
           securityContext:
             {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- end }}
           ports:
             - name: endpoint
               containerPort: {{ .Values.service.endpoint.port }}
@@ -127,10 +123,9 @@ spec:
           readinessProbe:
             {{- toYaml .Values.readinessProbe | nindent 12 }}
           volumeMounts:
-            - name: tmp
-              mountPath: /tmp
             - name: logs
               mountPath: {{ $logDir }}
+              subPath: logs
             {{- if eq (int .Values.replicaCount) 4 }}
             {{- range $i := until (int .Values.replicaCount) }}
             - name: data-rustfs-{{ $i }}
@@ -140,9 +135,6 @@ spec:
             - name: data
               mountPath: /data
             {{- end }}
-      volumes:
-        - name: tmp
-          emptyDir: {}
   volumeClaimTemplates:
     - metadata:
         name: logs

helm/rustfs/templates/tests/test-connection.yaml

@@ -9,8 +9,8 @@ metadata:
 spec:
   containers:
     - name: wget
-      image: "{{ .Values.initStep.image.repository }}:{{ .Values.initStep.image.tag }}"
-      imagePullPolicy: {{ .Values.initStep.image.pullPolicy }}
+      image: "{{ .Values.image.initImage.repository }}:{{ .Values.image.initImage.tag }}"
+      imagePullPolicy: {{ .Values.image.initImage.pullPolicy }}
       command: ['wget']
       args: ['-O', '/dev/null', '{{ include "rustfs.fullname" . }}-svc:{{ .Values.service.endpoint.port }}/health']
-  restartPolicy: Never
+  restartPolicy: Never

helm/rustfs/values.yaml

@@ -7,11 +7,16 @@ replicaCount: 4
 
 # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
 image:
-  repository: rustfs/rustfs
-  # This sets the pull policy for images.
-  pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
+  rustfs: # This sets the rustfs image repository and tag.
+    repository: rustfs/rustfs
+    # This sets the pull policy for images.
+    pullPolicy: IfNotPresent
+    # Overrides the image tag whose default is the chart appVersion.
+    tag: ""
+  initImage: # This sets the init container image repository and tag.
+    repository: busybox
+    pullPolicy: IfNotPresent
+    tag: "stable"
 
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets: []
@@ -94,6 +99,7 @@ containerSecurityContext:
     drop:
       - ALL
   readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
   runAsNonRoot: true
 
 service:
@@ -193,16 +199,6 @@ storageclass:
   dataStorageSize: 256Mi
   logStorageSize: 256Mi
 
-# Init container parameters.
-initStep:
-  image:
-    repository: busybox
-    pullPolicy: IfNotPresent
-    tag: "latest"
-  containerSecurityContext:
-    runAsUser: 0
-    runAsGroup: 0
-
 pdb:
   create: false
   # Minimum number/percentage of pods that should remain scheduled