Add init container to load apparmor profile

This patch place in a sample for an init container, generated by
helm toolkit, to load an apparmor profile included in the chart.

Change-Id: I309e3b550fd1d683745c319aa39bcfb96b77ea14
Signed-off-by: Tin Lam <[email protected]>

helm-toolkit/templates/snippets/_kubernetes_apparmor_configmap.tpl

@@ -0,0 +1,70 @@
+{{/*
+Copyright 2017-2018 The Openstack-Helm Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http:https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+abstract: |
+ Renders a configmap used for loading custom AppArmor profiles.
+values: |
+ pod:
+ mandatory_access_control:
+ type: apparmor
+ configmap_apparmor: true
+ apparmor_profiles: |-
+ my_apparmor-v1.profile: |-
+ #include <tunables/global>
+ profile my-apparmor-v1 flags=(attach_disconnected,mediate_deleted) {
+ <profile_data>
+ }
+usage: |
+ {{ dict "envAll" . "component" "myComponent" | include "helm-toolkit.snippets.kubernetes_apparmor_configmap" }}
+return: |
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: releaseName-myComponent-apparmor
+ namespace: myNamespace
+data:
+ my_apparmor-v1.profile: |-
+ #include <tunables/global>
+ profile my-apparmor-v1 flags=(attach_disconnected,mediate_deleted) {
+ <profile_data>
+ }
+*/}}
+{{- define "helm-toolkit.snippets.kubernetes_apparmor_configmap" -}}
+{{- $envAll := index . "envAll" -}}
+{{- $component := index . "component" -}}
+{{- if hasKey $envAll.Values.pod "mandatory_access_control" -}}
+{{- if hasKey $envAll.Values.pod.mandatory_access_control "type" -}}
+{{- if eq $envAll.Values.pod.mandatory_access_control.type "apparmor" -}}
+{{- if hasKey $envAll.Values.pod.mandatory_access_control "configmap_apparmor" -}}
+{{- if $envAll.Values.pod.mandatory_access_control.configmap_apparmor }}
+{{- $mapName := printf "%s-%s-%s" $envAll.Release.Name $component "apparmor" -}}
+{{- if $envAll.Values.conf.apparmor_profiles }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ $mapName }}
+ namespace: {{ $envAll.Release.Namespace }}
+data:
+{{ $envAll.Values.conf.apparmor_profiles | toYaml | indent 2 }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

helm-toolkit/templates/snippets/_kubernetes_apparmor_loader_init_container.tpl

@@ -0,0 +1,77 @@
+{{/*
+Copyright 2017-2018 The Openstack-Helm Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http:https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+abstract: |
+ Renders the init container used for apparmor loading.
+values: |
+ images:
+ tags:
+ apparmor_loader: my-repo.io/apparmor-loader:1.0.0
+ pod:
+ mandatory_access_control:
+ type: apparmor
+ configmap_apparmor: true
+ apparmor-loader: unconfined
+usage: |
+ {{ dict "envAll" . | include "helm-toolkit.snippets.kubernetes_apparmor_loader_init_container" }}
+return: |
+ - name: apparmor-loader
+ image: my-repo.io/apparmor-loader:1.0.0
+ args:
+ - /profiles
+ securityContext:
+ privileged: true
+ volumeMounts:
+ - name: sys
+ mountPath: /sys
+ readOnly: true
+ - name: includes
+ mountPath: /etc/apparmor.d
+ readOnly: true
+ - name: profiles
+ mountPath: /profiles
+ readOnly: true
+*/}}
+{{- define "helm-toolkit.snippets.kubernetes_apparmor_loader_init_container" -}}
+{{- $envAll := index . "envAll" -}}
+{{- if hasKey $envAll.Values.pod "mandatory_access_control" -}}
+{{- if hasKey $envAll.Values.pod.mandatory_access_control "type" -}}
+{{- if hasKey $envAll.Values.pod.mandatory_access_control "configmap_apparmor" -}}
+{{- if eq $envAll.Values.pod.mandatory_access_control.type "apparmor" -}}
+{{- if $envAll.Values.pod.mandatory_access_control.configmap_apparmor }}
+- name: apparmor-loader
+ image: {{ $envAll.Values.images.tags.apparmor_loader }}
+ args:
+ - /profiles
+ securityContext:
+ privileged: true
+ volumeMounts:
+ - name: sys
+ mountPath: /sys
+ readOnly: true
+ - name: includes
+ mountPath: /etc/apparmor.d
+ readOnly: true
+ - name: profiles
+ mountPath: /profiles
+ readOnly: true
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

helm-toolkit/templates/snippets/_kubernetes_apparmor_volumes.tpl

@@ -0,0 +1,70 @@
+{{/*
+Copyright 2017-2018 The Openstack-Helm Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http:https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+abstract: |
+ Renders the volumes used by the apparmor loader.
+values: |
+ pod:
+ mandatory_access_control:
+ type: apparmor
+ configmap_apparmor: true
+inputs: |
+ envAll: "Environment or Context."
+ component: "Name of the component used for the name of configMap."
+ requireSys: "Boolean. True if it needs the hostpath /sys in volumes."
+usage: |
+ {{ dict "envAll" . "component" "keystone" "requireSys" true | include "helm-toolkit.snippets.kubernetes_apparmor_volumes" }}
+return: |
+- name: sys
+ hostPath:
+ path: /sys
+- name: includes
+ hostPath:
+ path: /etc/apparmor.d
+- name: profiles
+ configMap:
+ name: RELEASENAME-keystone-apparmor
+ defaultMode: 0555
+*/}}
+{{- define "helm-toolkit.snippets.kubernetes_apparmor_volumes" -}}
+{{- $envAll := index . "envAll" -}}
+{{- $component := index . "component" -}}
+{{- $requireSys := index . "requireSys" | default false -}}
+{{- $configName := printf "%s-%s-%s" $envAll.Release.Name $component "apparmor" -}}
+{{- if hasKey $envAll.Values.pod "mandatory_access_control" -}}
+{{- if hasKey $envAll.Values.pod.mandatory_access_control "type" -}}
+{{- if hasKey $envAll.Values.pod.mandatory_access_control "configmap_apparmor" -}}
+{{- if eq $envAll.Values.pod.mandatory_access_control.type "apparmor" -}}
+{{- if $envAll.Values.pod.mandatory_access_control.configmap_apparmor }}
+{{- if $requireSys }}
+- name: sys
+ hostPath:
+ path: /sys
+{{- end }}
+- name: includes
+ hostPath:
+ path: /etc/apparmor.d
+- name: profiles
+ configMap:
+ name: {{ $configName | quote }}
+ defaultMode: 0555
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

memcached/templates/configmap-apparmor.yaml

@@ -0,0 +1,17 @@
+{{/*
+Copyright 2017-2018 The Openstack-Helm Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http:https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- dict "envAll" . "component" "memcached" | include "helm-toolkit.snippets.kubernetes_apparmor_configmap" }}

memcached/templates/deployment.yaml

@@ -39,6 +39,7 @@ spec:
  template:
  metadata:
  annotations:
+{{- dict "envAll" $envAll "podName" "memcached" "containerNames" (list "apparmor-loader" "memcached") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
  configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
  labels:
 {{ tuple $envAll "memcached" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
@@ -53,6 +54,7 @@ spec:
  terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.memcached.timeout | default "30" }}
  initContainers:
 {{ tuple $envAll "memcached" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
+{{ dict "envAll" $envAll | include "helm-toolkit.snippets.kubernetes_apparmor_loader_init_container" | indent 8 }}
  containers:
  - name: memcached
 {{ tuple $envAll "memcached" | include "helm-toolkit.snippets.image" | indent 10 }}
@@ -81,4 +83,5 @@ spec:
  configMap:
  name: {{ $configMapBinName | quote }}
  defaultMode: 0555
+{{ dict "envAll" $envAll "component" "memcached" "requireSys" true | include "helm-toolkit.snippets.kubernetes_apparmor_volumes" | indent 8 }}
 {{- end }}

tools/deployment/apparmor/000-install-packages.sh

@@ -0,0 +1 @@
+../common/000-install-packages.sh

tools/deployment/apparmor/001-setup-apparmor-profiles.sh

@@ -0,0 +1 @@
+../common/001-setup-apparmor-profiles.sh

tools/deployment/apparmor/005-deploy-k8s.sh

@@ -0,0 +1 @@
+../common/005-deploy-k8s.sh