Make privilege escalation configurable in Helm (#7521)

Disabling privilege escalation is a security best practice. But currently this is not supported when installing from Helm. A parameter called `privilegeEscalationEnabled` is added to the Helm chart. The default value is `true`to avoid breaking changes to the Helm chart. Fixes #7282 Signed-off-by: Kim Christensen <[email protected]>
linkerd · Jan 3, 2022 · 75903af · 75903af
1 parent c2eac91
commit 75903af
Show file tree

Hide file tree

Showing 21 changed files with 107 additions and 0 deletions.
diff --git a/charts/linkerd-control-plane/templates/destination.yaml b/charts/linkerd-control-plane/templates/destination.yaml
@@ -218,6 +218,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
       - args:
         - sp-validator
         - -log-level={{.Values.controllerLogLevel}}
@@ -245,6 +246,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/run/linkerd/tls
           name: sp-tls
@@ -289,6 +291,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/run/linkerd/tls
           name: policy-tls

diff --git a/charts/linkerd-control-plane/templates/heartbeat.yaml b/charts/linkerd-control-plane/templates/heartbeat.yaml
@@ -63,4 +63,5 @@ spec:
             {{- end }}
             securityContext:
               runAsUser: {{.Values.controllerUID}}
+              allowPrivilegeEscalation: false
 {{- end }}
diff --git a/charts/linkerd-control-plane/templates/identity.yaml b/charts/linkerd-control-plane/templates/identity.yaml
@@ -179,6 +179,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/issuer
           name: identity-issuer

diff --git a/charts/linkerd-control-plane/templates/proxy-injector.yaml b/charts/linkerd-control-plane/templates/proxy-injector.yaml
@@ -97,6 +97,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/run/linkerd/config
           name: config

diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden