GetSecurityContext return the proper SecurityContext in the cluster for Containers in Pods
(cluster *apiv1.Cluster)
| 62 | |
| 63 | // GetSecurityContext return the proper SecurityContext in the cluster for Containers in Pods |
| 64 | func GetSecurityContext(cluster *apiv1.Cluster) *corev1.SecurityContext { |
| 65 | trueValue := true |
| 66 | falseValue := false |
| 67 | |
| 68 | defaultContext := &corev1.SecurityContext{ |
| 69 | SeccompProfile: cluster.GetSeccompProfile(), |
| 70 | Capabilities: &corev1.Capabilities{ |
| 71 | Drop: []corev1.Capability{ |
| 72 | "ALL", |
| 73 | }, |
| 74 | }, |
| 75 | Privileged: &falseValue, |
| 76 | RunAsNonRoot: &trueValue, |
| 77 | ReadOnlyRootFilesystem: &trueValue, |
| 78 | AllowPrivilegeEscalation: &falseValue, |
| 79 | } |
| 80 | |
| 81 | if cluster.Spec.SecurityContext == nil { |
| 82 | return defaultContext |
| 83 | } |
| 84 | |
| 85 | // Create a copy to avoid mutating the cluster object |
| 86 | definedContext := cluster.Spec.SecurityContext.DeepCopy() |
| 87 | if definedContext.RunAsUser == nil { |
| 88 | definedContext.RunAsUser = defaultContext.RunAsUser |
| 89 | } |
| 90 | if definedContext.RunAsGroup == nil { |
| 91 | definedContext.RunAsGroup = defaultContext.RunAsGroup |
| 92 | } |
| 93 | if definedContext.SeccompProfile == nil { |
| 94 | definedContext.SeccompProfile = defaultContext.SeccompProfile |
| 95 | } |
| 96 | if definedContext.Capabilities == nil { |
| 97 | definedContext.Capabilities = defaultContext.Capabilities |
| 98 | } |
| 99 | if definedContext.Privileged == nil { |
| 100 | definedContext.Privileged = defaultContext.Privileged |
| 101 | } |
| 102 | if definedContext.RunAsNonRoot == nil { |
| 103 | definedContext.RunAsNonRoot = defaultContext.RunAsNonRoot |
| 104 | } |
| 105 | if definedContext.ReadOnlyRootFilesystem == nil { |
| 106 | definedContext.ReadOnlyRootFilesystem = defaultContext.ReadOnlyRootFilesystem |
| 107 | } |
| 108 | if definedContext.AllowPrivilegeEscalation == nil { |
| 109 | definedContext.AllowPrivilegeEscalation = defaultContext.AllowPrivilegeEscalation |
| 110 | } |
| 111 | |
| 112 | return definedContext |
| 113 | } |
no test coverage detected