Roll out PSS Restricted profile. #1883

sengi · 2024-03-04T13:25:10Z

We currently enforce the PSS baseline profile.

We want tighten that up to Restricted where possible (e.g. apps namespace), so that we don't have to worry about regressions in container permissions — i.e. application containers unintentionally/unnecessarily being granted system privileges in future.

In other words, this:

prevents a set of potential misconfigurations in future
helps to "lock in" the benefits of the least-privilege configuration that we already have

We still have a couple of NFS clients (e.g. asset-manager), so we might need to work around that temporarily and/or pay down that tech debt and switch them to S3.

The text was updated successfully, but these errors were encountered:

sengi · 2024-05-01T10:16:29Z

Ah nuts, auto-closed this by mistake somehow or other.

sengi · 2024-05-01T10:17:47Z

It's not rolled out until we're in enforcement mode.

Should be mostly just trivial template fixes, plus the not-so-trivial NFS question.

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

@MahmudH

Description: - Enforce initContainers in the `app` namespace to be compliant when PSS is set to (restricted)[https://kubernetes.io/docs/concepts/security/pod-security-standards/] - Tested in integration and observed that `content-data-admin` initContainers were starting properly - `govuk-mirror-sync-cronjob` can't be tested in integration as this has no mirrors so the PR will have to be merged and we will have to manually inspect staging ot see if it succeeds. - As part of #1883 - Paired with @MahmudH

@MahmudH

Description: - Enforce initContainers in the `app` namespace to be compliant when PSS is set to [restricted](https://kubernetes.io/docs/concepts/security/pod-security-standards/) - Tested in integration and observed that `content-data-admin` initContainers were starting properly - `govuk-mirror-sync-cronjob` can't be tested in integration as this has no mirrors so the PR will have to be merged and we will have to manually inspect staging ot see if it succeeds. - As part of #1883 - Paired with @MahmudH

@MahmudH

Description: - Enforce initContainers in the `app` namespace to be compliant when PSS is set to [restricted](https://kubernetes.io/docs/concepts/security/pod-security-standards/) - Tested in integration and observed that `content-data-admin` initContainers were starting properly - `govuk-mirror-sync-cronjob` can't be tested in integration as this has no mirrors so the PR will have to be merged and we will have to manually inspect staging ot see if it succeeds. - As part of #1883 - Paired with @MahmudH

Description: - Enforces this container to be compliant when PSS is set to [restricted](https://kubernetes.io/docs/concepts/security/pod-security-standards/) - As part of #1883

Description: - Argo Bootstrap chart has been incremented in alphagov/govuk-helm-charts#2897 - As part of alphagov/govuk-helm-charts#1883

Description: - #2892 changed argo-bootstrap so changes need to be released in a new chart - As part of #1883

… PSS restricted Description: - PSS restricted doesn't allow volume types of `nfs`(see [here](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted)) but does allow `PersistentVolume` - Refactor the NFS volume to use a `PersistentVolume` of type NFS - Both `asset-manager` and `licensify` use `clamav` export in NFS. However there is a 1-1 relationship between `PersistentVolume` and `PersistentVolumeClaim` so there needs to be multiple `PersistentVolume`s to export the same directory to multiple applications. Hence the name is `licensify-clamav-db`. - As part of #1883

Description: - Currently the `licensify` namespace is created through ArgoCD [here](https://github.com/alphagov/govuk-helm-charts/blob/124ad9cfa5a25916d843838aa096dc0a5ab3f780/charts/app-config/templates/govuk-application.yaml#L61) - However in the case of the `apps` namespace the annotations set are managed by Terraform [here](https://github.com/alphagov/govuk-infrastructure/blob/00d22761c5d9e8cfde4dd517dd459ded54a87f37/terraform/deployments/cluster-services/argo.tf#L26). The [ArgoCD docs](https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#namespace-metadata) mentions that if we have another manifest file for the same namespace the data in ArgoCD will be overwritten. Currently this isn't an issue but it makes sense to have a single entity managing things. It's easier to have the `licensify` namespace in Terraform as we currently have for `apps` and `datagovuk` - As part of alphagov/govuk-helm-charts#1883

- Licensify namespace is now managed by Terraform in alphagov/govuk-infrastructure#1571 - As part of #1883

Description: - Licensify is currently managed by Terraform in #1571 so import is no longer needed - As part of alphagov/govuk-helm-charts#1883

Description: - Enforce PSS to restricted on Licensify - As part of alphagov/govuk-helm-charts#1883

… PSS restricted Description: - PSS restricted doesn't allow volume types of `nfs` (see [here](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted)) but does allow us to use a `PersistentVolume` of type NFS - Add some additional annotations onto Licensify `PersistentVolume` and `PersistentVolumeClaim` - As part of #1883

… PSS restricted Description: - PSS restricted doesn't allow volume types of `nfs` (see [here](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted)) but does allow us to use a `PersistentVolume` of type NFS - Add some additional annotations onto Licensify `PersistentVolume` and `PersistentVolumeClaim` - Remove `namespace` value from Licensify as Terraform now manages namespace configuration - As part of #1883

Description: - Licensify is now managed in Terraform alphagov/govuk-infrastructure#1571 - Add a few labels to volumes - As part of #1883

… PSS restricted Description: - PSS restricted doesn't allow volume types of `nfs` (see [here](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted)) but does allow us to use a `PersistentVolume` of type NFS - As part of #1883

This was linked to pull requests Mar 4, 2024

Updating Asset-manager chart to be PSS restricted compliant. #1861

Draft

Updating GOV.UK Generic chart to be PSS restricted compliant. #1860

Merged

Enable audit mode for PSS restricted profile. alphagov/govuk-infrastructure#1068

Merged

sengi closed this as completed in #1860 Mar 18, 2024

sengi reopened this May 1, 2024

theseanything mentioned this issue May 1, 2024

Add securityContext from cron-jobs containers #1995

Merged

This was referenced May 1, 2024

Updating Asset-manager chart to be PSS restricted compliant. #1861

Draft

Updating GOV.UK Generic chart to be PSS restricted compliant. #1860

Merged

Enable audit mode for PSS restricted profile. alphagov/govuk-infrastructure#1068

Merged

This was unlinked from pull requests May 1, 2024

Updating Asset-manager chart to be PSS restricted compliant. #1861

Draft

Updating GOV.UK Generic chart to be PSS restricted compliant. #1860

Merged

Enable audit mode for PSS restricted profile. alphagov/govuk-infrastructure#1068

Merged

dj-maisy added the k8s Kubernetes label Jul 22, 2024

MahmudH assigned MahmudH and nimalank7 Sep 18, 2024

nimalank7 added a commit that referenced this issue Sep 25, 2024

Update init containers to be PSS compliant

8fd027f

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

MahmudH pushed a commit that referenced this issue Sep 26, 2024

Update init containers to be PSS compliant

9f9ee10

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

MahmudH pushed a commit that referenced this issue Sep 26, 2024

Update init containers to be PSS compliant

62ad2c0

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

MahmudH pushed a commit that referenced this issue Sep 26, 2024

Update init containers to be PSS compliant

12f256b

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

MahmudH pushed a commit that referenced this issue Sep 26, 2024

Update init containers to be PSS compliant

9301816

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

nimalank7 added a commit that referenced this issue Sep 27, 2024

Update init containers to be PSS compliant

ebb39fd

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

nimalank7 mentioned this issue Sep 27, 2024

Update init containers to be PSS compliant in the apps namespace #2620

Merged

nimalank7 added a commit that referenced this issue Oct 2, 2024

Update init containers to be PSS compliant

89b02e0

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

nimalank7 added a commit that referenced this issue Oct 2, 2024

Update init containers to be PSS compliant

c012fe1

Description: - Enforce initContainers to be compliant when PSS is set to restricted - As part of #1883

nimalank7 mentioned this issue Jan 14, 2025

Release new Argo Bootstrap helm chart for 0.3.3 #2897

Merged

nimalank7 added a commit to alphagov/govuk-infrastructure that referenced this issue Jan 14, 2025

Increment Argo Bootstrap Helm Chart to 0.3.3

303c2b2

Description: - Argo Bootstrap chart has been incremented in alphagov/govuk-helm-charts#2897 - As part of alphagov/govuk-helm-charts#1883

nimalank7 added a commit that referenced this issue Jan 15, 2025

Upgrade Argo Bootstrap chart to 0.3.3

4ff3283

Description: - #2892 changed argo-bootstrap so changes need to be released in a new chart - As part of #1883

This was referenced Jan 15, 2025

Upgrade Argo Bootstrap chart to 0.3.3 #2900

Merged

Increment Argo Bootstrap Helm Chart to 0.3.3 alphagov/govuk-infrastructure#1570

Merged

nimalank7 mentioned this issue Jan 16, 2025

Import licensify namespace into Terraform alphagov/govuk-infrastructure#1571

Merged

nimalank7 added a commit that referenced this issue Jan 16, 2025

Remove Licensify namespace configuration

f21049f

- Licensify namespace is now managed by Terraform in alphagov/govuk-infrastructure#1571 - As part of #1883

nimalank7 mentioned this issue Jan 16, 2025

Remove Licensify namespace configuration #2911

Merged

nimalank7 added a commit to alphagov/govuk-infrastructure that referenced this issue Jan 16, 2025

Remove import for Licensify namespace

6bd9bcd

Description: - Licensify is currently managed by Terraform in #1571 so import is no longer needed - As part of alphagov/govuk-helm-charts#1883

nimalank7 mentioned this issue Jan 16, 2025

Remove import for Licensify namespace alphagov/govuk-infrastructure#1572

Merged

nimalank7 added a commit to alphagov/govuk-infrastructure that referenced this issue Jan 16, 2025

Enforce PSS to restricted on Licensify

f919702

Description: - Enforce PSS to restricted on Licensify - As part of alphagov/govuk-helm-charts#1883

nimalank7 mentioned this issue Jan 16, 2025

Enforce PSS to restricted on Licensify alphagov/govuk-infrastructure#1573

Draft

nimalank7 mentioned this issue Jan 17, 2025

Use NFS PersistentVolume for asset-manager clamav for compliance with PSS restricted #2912

Draft

nimalank7 added a commit that referenced this issue Jan 17, 2025

Clean up Licensify config

5e3a04f

Description: - Licensify is now managed in Terraform alphagov/govuk-infrastructure#1571 - Add a few labels to volumes - As part of #1883

nimalank7 added a commit that referenced this issue Jan 17, 2025

Clean up Licensify config

5eacdfa

Description: - Licensify is now managed in Terraform alphagov/govuk-infrastructure#1571 - Add a few labels to volumes - As part of #1883

nimalank7 mentioned this issue Jan 17, 2025

Clean up Licensify config #2913

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Roll out PSS Restricted profile. #1883

Roll out PSS Restricted profile. #1883

sengi commented Mar 4, 2024 •

edited

Loading

sengi commented May 1, 2024

sengi commented May 1, 2024

Roll out PSS Restricted profile. #1883

Roll out PSS Restricted profile. #1883

Comments

sengi commented Mar 4, 2024 • edited Loading

sengi commented May 1, 2024

sengi commented May 1, 2024

sengi commented Mar 4, 2024 •

edited

Loading