Add pod security context from func.yaml #2108

zalsader · 2023-12-20T05:25:21Z

It would be nice to be able to set the pod security context in func.yaml. I ran into this when I was trying to mount a pvc, and I could not write to the pvc. After a lot of digging, I fould that I needed to set fsGroup like this:

kubectl patch services.serving/<name> --type merge \
    -p '{"spec": {"template": {"spec": {"securityContext": {"fsGroup":1000}}}}}'

This is because the default group is 1000 (I used golang's os/user to find it). I would prefer to be able to set that from func.yaml, or have that set automatically to some sane default.

current func.yaml

specVersion: 0.35.0
name: consumer
runtime: go
registry: <redacted>
image: <redacted>
imageDigest: <redacted>
created: 2023-12-13T00:39:05.888786906-05:00
build:
  builder: pack
run:
  volumes:
  - presistentVolumeClaim:
      claimName: knative-pc-cephfs
    path: /files
deploy:
  namespace: default

Here's the currently generated service:

You can see that no securityContext data is in the podspec.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  annotations:
    dapr.io/app-id: consumer
    dapr.io/app-port: "8080"
    dapr.io/enable-api-logging: "true"
    dapr.io/enabled: "true"
    dapr.io/metrics-port: "9092"
    serving.knative.dev/creator: kubernetes-admin
    serving.knative.dev/lastModifier: kubernetes-admin
  creationTimestamp: "2023-12-20T05:20:10Z"
  generation: 1
  labels:
    boson.dev/function: "true"
    boson.dev/runtime: go
    function.knative.dev: "true"
    function.knative.dev/name: consumer
    function.knative.dev/runtime: go
  name: consumer
  namespace: default
  resourceVersion: "11510806"
  uid: ...
spec:
  template:
    metadata:
      annotations:
        dapr.io/app-id: consumer
        dapr.io/app-port: "8080"
        dapr.io/enable-api-logging: "true"
        dapr.io/enabled: "true"
        dapr.io/metrics-port: "9092"
      creationTimestamp: null
      labels:
        boson.dev/function: "true"
        boson.dev/runtime: go
        function.knative.dev: "true"
        function.knative.dev/name: consumer
        function.knative.dev/runtime: go
    spec:
      containerConcurrency: 0
      containers:
      - env:
        - name: BUILT
          value: 20231220T002010
        - name: ADDRESS
          value: 0.0.0.0
        image: <redacted>
        livenessProbe:
          httpGet:
            path: /health/liveness
            port: 0
        name: user-container
        readinessProbe:
          httpGet:
            path: /health/readiness
            port: 0
          successThreshold: 1
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /files
          name: pvc-knative-pc-cephfs
      enableServiceLinks: false
      timeoutSeconds: 300
      volumes:
      - name: pvc-knative-pc-cephfs
        persistentVolumeClaim:
          claimName: knative-pc-cephfs
  traffic:
  - latestRevision: true
    percent: 100

The text was updated successfully, but these errors were encountered:

lkingland · 2024-01-09T13:54:15Z

Agreed on both suggestions. I'll add this to our roadmap as a "ready to work" item.

gouthamhusky · 2024-01-11T23:11:25Z

Hello @zalsader! I'd like to work on this issue. Could you share some more context about how the func.yaml file is leveraged to generate the service definition? Perhaps pointing to the source code files would help too! This is my first issue and would love to contribute here!

zalsader · 2024-01-11T23:59:32Z

@gouthamhusky Sure, yeah. Looking at existing closed PRs is a good first step. For example, my first contribution to the library was to add pvc to the allowed volume options. I am happy to review any PRs you create. I'm not a maintainer, so those people could provide more guidance.

Sanket-0510 · 2024-02-18T22:50:37Z

hey @zalsader after digging into this issue I found out that the podSecurityContext is getting set from here -

func/pkg/k8s/persistent_volumes.go

Line 121 in d2fb76c

SecurityContext: defaultPodSecurityContext(),

and the DefaultPodSecurityContext is defined here -

func/pkg/k8s/security_context.go

Line 11 in d2fb76c

func defaultPodSecurityContext() *corev1.PodSecurityContext {

func defaultPodSecurityContext() *corev1.PodSecurityContext {
	// change ownership of the mounted volume to the first non-root user uid=1000
	if IsOpenShift() {
		return nil
	}
	runAsUser := int64(1001)
	runAsGroup := int64(1002)
	return &corev1.PodSecurityContext{
		RunAsUser:  &runAsUser,
		RunAsGroup: &runAsGroup,
		FSGroup:    &runAsGroup,
	}
}

if we have defined podSecurityContext then why is it not reflecting in service.yaml. like for containerSecurityContext

we do get the set fields like

securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault

as passed using this function -

func defaultSecurityContext(client *kubernetes.Clientset) *corev1.SecurityContext {
	runAsNonRoot := true
	sc := &corev1.SecurityContext{
		Privileged:               new(bool),
		AllowPrivilegeEscalation: new(bool),
		RunAsNonRoot:             &runAsNonRoot,
		Capabilities:             &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
		SeccompProfile:           nil,
	}
	if info, err := client.ServerVersion(); err == nil {
		var v *semver.Version
		v, err = semver.NewVersion(info.String())
		if err == nil && v.Compare(oneTwentyFour) >= 0 {
			sc.SeccompProfile = &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault}
		}
	}
	return sc
}

Sanket-0510 · 2024-02-18T23:01:04Z

still if we want to set the podSecurityContext explicitly will have to define new schema in func.yaml followed by creating new struct, setting the value of FSgroup using some function and passing it here -

func/pkg/k8s/persistent_volumes.go

Line 121 in d2fb76c

SecurityContext: defaultPodSecurityContext(),

am I on right track? If yes it would be nice if you could assign this issue to me.

Sanket-0510 · 2024-02-20T14:50:45Z

lets just say if I define the property PodSecurityContext in func.yaml should it be in RunSpec or in DeploySpec I have question over that!

lkingland · 2025-02-28T03:07:48Z

lets just say if I define the property PodSecurityContext in func.yaml should it be in RunSpec or in DeploySpec I have question over that!

Your PR is correctly adding it to the RunSpec.

lkingland added this to Functions WG Roadmap Jan 9, 2024

lkingland moved this to 🔖 Next in Functions WG Roadmap Jan 9, 2024

lkingland added the kind/good-first-issue Denotes an issue ready for a new contributor. label Jan 9, 2024

Sanket-0510 linked a pull request Feb 20, 2024 that will close this issue

added PodSecurityContext #2174

Open

github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 21, 2024

lkingland removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 28, 2024

github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 27, 2024

github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Sep 27, 2024

github-project-automation bot moved this from 🔖 Next to ✅ Done in Functions WG Roadmap Sep 27, 2024

lkingland removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 28, 2025

knative deleted a comment from github-actions bot Feb 28, 2025

lkingland reopened this Feb 28, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add pod security context from func.yaml #2108

Add pod security context from func.yaml #2108

zalsader commented Dec 20, 2023 •

edited

Loading

lkingland commented Jan 9, 2024

gouthamhusky commented Jan 11, 2024

zalsader commented Jan 11, 2024 •

edited

Loading

Sanket-0510 commented Feb 18, 2024 •

edited

Loading

Sanket-0510 commented Feb 18, 2024 •

edited

Loading

Sanket-0510 commented Feb 20, 2024

lkingland commented Feb 28, 2025

Add pod security context from func.yaml #2108

Add pod security context from func.yaml #2108

Comments

zalsader commented Dec 20, 2023 • edited Loading

lkingland commented Jan 9, 2024

gouthamhusky commented Jan 11, 2024

zalsader commented Jan 11, 2024 • edited Loading

Sanket-0510 commented Feb 18, 2024 • edited Loading

Sanket-0510 commented Feb 18, 2024 • edited Loading

Sanket-0510 commented Feb 20, 2024

lkingland commented Feb 28, 2025

zalsader commented Dec 20, 2023 •

edited

Loading

zalsader commented Jan 11, 2024 •

edited

Loading

Sanket-0510 commented Feb 18, 2024 •

edited

Loading

Sanket-0510 commented Feb 18, 2024 •

edited

Loading