[apm-server] run as non root user (#996)

elastic · Jan 12, 2021 · 425b74f · 425b74f
1 parent 2ce8f7f
commit 425b74f
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 6 deletions.
diff --git a/apm-server/templates/deployment.yaml b/apm-server/templates/deployment.yaml
@@ -30,6 +30,10 @@ spec:
         configChecksum: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }}
         {{- end }}
     spec:
+{{- if .Values.podSecurityContext }}
+      securityContext:
+{{ toYaml .Values.podSecurityContext | indent 10 }}
+{{- end }}
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
@@ -84,9 +88,9 @@ spec:
         envFrom:
 {{ toYaml .Values.envFrom | indent 10 }}
         {{- end }}
-{{- if .Values.podSecurityContext }}
+{{- if .Values.securityContext }}
         securityContext:
-{{ toYaml .Values.podSecurityContext | indent 10 }}
+{{ toYaml .Values.securityContext | indent 10 }}
 {{- end }}
         livenessProbe:
 {{ toYaml .Values.livenessProbe | indent 10 }}

diff --git a/apm-server/tests/apmserver_test.py b/apm-server/tests/apmserver_test.py
@@ -146,16 +146,26 @@ def test_self_managing_rbac_resources():
     assert "clusterrolebinding" not in r
 
 
+def test_setting_container_security_context():
+    config = """
+securityContext:
+  runAsUser: 1001
+  privileged: true
+"""
+    r = helm_template(config)
+    c = r["deployment"][name]["spec"]["template"]["spec"]["containers"][0]
+    assert c["securityContext"]["runAsUser"] == 1001
+    assert c["securityContext"]["privileged"] is True
+
+
 def test_setting_pod_security_context():
     config = """
 podSecurityContext:
   runAsUser: 1001
-  privileged: false
 """
     r = helm_template(config)
-    c = r["deployment"][name]["spec"]["template"]["spec"]["containers"][0]
+    c = r["deployment"][name]["spec"]["template"]["spec"]
     assert c["securityContext"]["runAsUser"] == 1001
-    assert c["securityContext"]["privileged"] is False
 
 
 def test_adding_in_apm_config():

diff --git a/apm-server/values.yaml b/apm-server/values.yaml
@@ -82,8 +82,15 @@ podAnnotations: {}
 labels: {}
 
 podSecurityContext:
-  runAsUser: 0
+  fsGroup: 1000
+  runAsUser: 1000
+  runAsGroup: 0
+
+securityContext:
   privileged: false
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 0
 
 livenessProbe:
   httpGet: