[cherry-pick] add scc and update deployment (#5940)

nginxinc · Jul 3, 2024 · 08c9884 · 08c9884
1 parent 522bc0b
commit 08c9884
Show file tree

Hide file tree

Showing 3 changed files with 103 additions and 54 deletions.
diff --git a/docs/content/usage-reporting.md b/docs/content/usage-reporting.md
@@ -117,6 +117,10 @@ Download and save the deployment file [cluster-connector.yaml](https://raw.githu
 - `-nms-server-address` should be the address of the Usage Reporting API, which will be the combination of NGINX Management Suite server hostname and the URI `api/platform/v1`
 - `nms-basic-auth-secret` should be the namespace/name of the secret created in step 3: `nginx-cluster-connector/nms-basic-auth`.
 
+{{< note >}}  OpenShift requires a SecurityContextConstraints object for NGINX Cluster Connector. 
+
+It can be created with the command `oc create -f scc.yaml`, using the file found in `shared-examples/` {{< /note >}}
+
 For more information, read the [Command-line arguments](#command-line-arguments) section of this page.
 
 ---

diff --git a/examples/shared-examples/usage-reporting/cluster-connector.yaml b/examples/shared-examples/usage-reporting/cluster-connector.yaml
@@ -14,65 +14,76 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: nginx-cluster-connector
 rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-      - list
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-      - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - list
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - create
+- apiGroups:
+  - security.openshift.io
+  verbs:
+  - create
+  - delete
+  - get
+  - use
+  resources:
+  - securitycontextconstraints
+  resourceNames:
+  - nginx-cluster-connector
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: nginx-cluster-connector
 subjects:
-  - kind: ServiceAccount
-    name: nginx-cluster-connector
-    namespace: nginx-cluster-connector
+- kind: ServiceAccount
+  name: nginx-cluster-connector
+  namespace: nginx-cluster-connector
 roleRef:
   kind: ClusterRole
   name: nginx-cluster-connector
@@ -95,8 +106,11 @@ spec:
     spec:
       serviceAccountName: nginx-cluster-connector
       automountServiceAccountToken: true
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       containers:
-        - image: docker-registry.nginx.com/cluster-connector/cluster-connector:0.1.0
+        - image: docker-registry.nginx.com/cluster-connector/cluster-connector:0.2.0
           imagePullPolicy: IfNotPresent
           name: nginx-cluster-connector
           resources:
@@ -107,6 +121,7 @@ spec:
             #  cpu: "1"
             #  memory: "1Gi"
           securityContext:
+            allowPrivilegeEscalation: false
             runAsUser: 101 #nginx
             runAsNonRoot: true
             capabilities:

diff --git a/examples/shared-examples/usage-reporting/scc.yaml b/examples/shared-examples/usage-reporting/scc.yaml
@@ -0,0 +1,30 @@
+kind: SecurityContextConstraints
+apiVersion: security.openshift.io/v1
+metadata:
+  name: nginx-cluster-connector
+allowPrivilegedContainer: false
+runAsUser:
+  type: MustRunAs
+  uid: 101
+seLinuxContext:
+  type: MustRunAs
+fsGroup:
+  type: MustRunAs
+supplementalGroups:
+  type: MustRunAs
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+readOnlyRootFilesystem: false
+seccompProfiles:
+- runtime/default
+volumes:
+ - secret
+requiredDropCapabilities:
+ - ALL
+users:
+ - 'system:serviceaccount:*:nginx-cluster-connector'
+allowedCapabilities:
+  - NET_BIND_SERVICE