Add security context to Agones containers (#3856)

* Add security context * mend --------- Co-authored-by: Zach Loafman <[email protected]>
googleforgames · Jun 10, 2024 · 69dd30f · 69dd30f
1 parent aa390f9
commit 69dd30f
Show file tree

Hide file tree

Showing 5 changed files with 32 additions and 0 deletions.
diff --git a/install/helm/agones/templates/controller.yaml b/install/helm/agones/templates/controller.yaml
@@ -103,6 +103,10 @@ spec:
  - name: agones-controller
  image: "{{ .Values.agones.image.registry }}/{{ .Values.agones.image.controller.name}}:{{ default .Values.agones.image.tag .Values.agones.image.controller.tag }}"
  imagePullPolicy: {{ .Values.agones.image.controller.pullPolicy }}
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ allowPrivilegeEscalation: false
  env:
  # minimum port that can be exposed to GameServer traffic
  - name: MIN_PORT

diff --git a/install/helm/agones/templates/extensions-deployment.yaml b/install/helm/agones/templates/extensions-deployment.yaml
@@ -97,6 +97,10 @@ spec:
  - name: agones-extensions
  image: "{{ .Values.agones.image.registry }}/{{ .Values.agones.image.extensions.name}}:{{ default .Values.agones.image.tag .Values.agones.image.extensions.tag }}"
  imagePullPolicy: {{ .Values.agones.image.extensions.pullPolicy }}
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ allowPrivilegeEscalation: false
  env:
  - name: PROMETHEUS_EXPORTER
  value: {{ .Values.agones.metrics.prometheusEnabled | quote }}

diff --git a/install/helm/agones/templates/ping.yaml b/install/helm/agones/templates/ping.yaml
@@ -90,6 +90,10 @@ spec:
  - name: agones-ping
  image: "{{ .Values.agones.image.registry }}/{{ .Values.agones.image.ping.name}}:{{ default .Values.agones.image.tag .Values.agones.image.ping.tag }}"
  imagePullPolicy: {{ .Values.agones.image.ping.pullPolicy }}
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ allowPrivilegeEscalation: false
 {{- if .Values.agones.ping.resources }}
  resources:
 {{ toYaml .Values.agones.ping.resources | indent 12 }}

diff --git a/install/helm/agones/templates/service/allocation.yaml b/install/helm/agones/templates/service/allocation.yaml
@@ -229,6 +229,10 @@ spec:
  - name: agones-allocator
  image: "{{ .Values.agones.image.registry }}/{{ .Values.agones.image.allocator.name}}:{{ default .Values.agones.image.tag .Values.agones.image.allocator.tag }}"
  imagePullPolicy: {{ .Values.agones.image.allocator.pullPolicy }}
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ allowPrivilegeEscalation: false
  livenessProbe:
  httpGet:
  path: /live

diff --git a/install/yaml/install.yaml b/install/yaml/install.yaml
@@ -17061,6 +17061,10 @@ spec:
  - name: agones-controller
  image: "us-docker.pkg.dev/agones-images/release/agones-controller:1.42.0-dev"
  imagePullPolicy: IfNotPresent
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ allowPrivilegeEscalation: false
  env:
  # minimum port that can be exposed to GameServer traffic
  - name: MIN_PORT
@@ -17221,6 +17225,10 @@ spec:
  - name: agones-extensions
  image: "us-docker.pkg.dev/agones-images/release/agones-extensions:1.42.0-dev"
  imagePullPolicy: IfNotPresent
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ allowPrivilegeEscalation: false
  env:
  - name: PROMETHEUS_EXPORTER
  value: "true"
@@ -17358,6 +17366,10 @@ spec:
  - name: agones-ping
  image: "us-docker.pkg.dev/agones-images/release/agones-ping:1.42.0-dev"
  imagePullPolicy: IfNotPresent
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ allowPrivilegeEscalation: false
  livenessProbe:
  httpGet:
  port: 8080
@@ -17432,6 +17444,10 @@ spec:
  - name: agones-allocator
  image: "us-docker.pkg.dev/agones-images/release/agones-allocator:1.42.0-dev"
  imagePullPolicy: IfNotPresent
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ allowPrivilegeEscalation: false
  livenessProbe:
  httpGet:
  path: /live