kyvernoPolicies update to 3.3.4-bb.1

Package Merge Request

Package Changes

https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/3.3.4-bb.1/CHANGELOG.md Adds default security context that does not run as root.

Package MR

big-bang/product/packages/kyverno-policies!219 (merged)

Policy exceptions for add-defaultsecuritycontext policy were copied from require-non-rootgroup policy in Bigbang

For Issue

Closes (big-bang/product/packages/kyverno-policies#141 (closed))

Upgrade Notices

BigBang users should be aware that a new mutating kyverno policy has been added. This policy will effect ALL pods not specifically excluded and will mutate the securityContext of ALL non-excluded pods to match the following non-root user securitycontext: '{"fsGroup":65534,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534}' . Default exclusions were added mirroring the existing policy require-non-root-user. To add additional exclusions go to bigbang/chart/templates/kyverno-policies/values.yaml and under add-default-securitycontext: look for exclude: then add the exception.

chart/templates/kyverno-policies/values.yaml

@@ -279,6 +279,98 @@ policies:
           - istio-operator
           - istio-system
 
+  add-default-securitycontext:
+    validationFailureAction: Enforce
+    {{ if .Values.istio.enabled }}
+    parameters:
+      excludeContainers:
+        - istio-init
+        {{ if not .Values.addons.holocron.database.host }}
+        - init-chmod-data
+        {{- end }}
+    {{ else if not .Values.addons.holocron.database.host }}
+    parameters:
+      excludeContainers:
+        - init-chmod-data
+    {{- end }}
+    {{- if or $deployNodeAgent .Values.twistlock.enabled .Values.fluentbit.enabled .Values.promtail.enabled .Values.neuvector.enabled }}
+    exclude:
+      any:
+      - resources:
+          namespaces:
+          - kube-system
+      {{- if $deployNodeAgent }}
+      # Velero.  The node agent backup tool requires root group access to see the host's runtime pod directory which is
+      # mounted inside velero/node agent pods.
+      - resources:
+          namespaces:
+          - velero
+          names:
+          - node-agent*
+      {{- end }}
+      {{- if .Values.twistlock.enabled }}
+      # Twistlock Defenders run as root to perform real time scanning on the nodes/cluster, including:
+      # - read logs from `/var/log` to watch for malicious processes
+      # - audit modifications to `/etc/passwd` (watching for suspicious changes)
+      # - access the container runtime socket (observing all running containers on a node)
+      - resources:
+          namespaces:
+          - twistlock
+          names:
+          - twistlock-defender-ds*
+          - volume-upgrade-job*
+      {{- end }}
+      # For GitLab runner CI jobs that require root access
+      {{- if .Values.addons.gitlabRunner.enabled }}
+      - resources:
+          namespaces:
+          - gitlab-runner
+          names:
+          - runner-*
+      {{- end }}
+      {{- if .Values.fluentbit.enabled }}
+      # Fluentbit requires access to journalctl as well as /var/log.  This would require modifications
+      # to the host operating system, creating a user, adding that user to the  systemd-journal user group
+      # and then granting permissions recursively on /var/log.
+      - resources:
+          namespaces:
+          - fluentbit
+          names:
+          - fluentbit-fluent-bit*
+      {{- end }}
+      {{- if .Values.promtail.enabled }}
+      # promtail requires access to journalctl as well as /var/log.  This would require modifications
+      # to the host operating system, creating a user, adding that user to the  systemd-journal user group
+      # and then granting permissions recursively on /var/log.
+      # promtail requires access to /run/promtail for its buffering and persistent state.
+      - resources:
+          namespaces:
+          - promtail
+          names:
+          - promtail-promtail*
+      {{- end }}
+      {{- if .Values.neuvector.enabled }}
+      # neuvector enforcers run as root to perform real time scanning on the nodes/cluster
+      - resources:
+          namespaces:
+          - neuvector
+          names:
+          - neuvector-enforcer-pod-*
+          - neuvector-controller-pod-*
+          - neuvector-cert-upgrader-job-*
+      {{- end }}
+      {{- if .Values.addons.mattermost.enabled }}
+        # Mattermost fails when policy was implemented
+      - resources:
+          namespaces:
+          - mattermost
+          - mattermost-operator
+          names:
+          - mattermost-*
+      {{- end }}
+    {{- end }}
+
+
   require-non-root-group:
     validationFailureAction: Enforce
     {{ if .Values.istio.enabled }}