Merge pull request #2843 from dundysm/fix/operator-securitycontext

Add configurable securityContext and dnsConfig for the operator Deployment

Author: rahulait

deployments/gpu-operator/templates/cleanup_crd.yaml

@@ -32,10 +32,27 @@ spec:
       {{- end }}
       nodeSelector:
         {{- toYaml .Values.operator.nodeSelector | nindent 8 }}
+      {{- with .Values.operator.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operator.dnsPolicy }}
+      dnsPolicy: {{ .Values.operator.dnsPolicy }}
+      {{- end }}
+      {{- with .Values.operator.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: cleanup-crd
           image: {{ include "gpu-operator.fullimage" . }}
           imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
           command:
             - /usr/bin/manage-crds
           args:

deployments/gpu-operator/templates/cleanup_gpucluster.yaml

@@ -37,10 +37,27 @@ spec:
       {{- end }}
       nodeSelector:
         {{- toYaml .Values.operator.nodeSelector | nindent 8 }}
+      {{- with .Values.operator.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operator.dnsPolicy }}
+      dnsPolicy: {{ .Values.operator.dnsPolicy }}
+      {{- end }}
+      {{- with .Values.operator.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: cleanup-gpucluster
           image: {{ include "gpu-operator.fullimage" . }}
           imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
           command:
             - /usr/bin/cleanup-gpuclusters
             - --gpucluster-name

deployments/gpu-operator/templates/operator.yaml

@@ -33,6 +33,17 @@ spec:
       {{- if .Values.operator.priorityClassName }}
       priorityClassName: {{ .Values.operator.priorityClassName }}
       {{- end }}
+      {{- with .Values.operator.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operator.dnsPolicy }}
+      dnsPolicy: {{ .Values.operator.dnsPolicy }}
+      {{- end }}
+      {{- with .Values.operator.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: gpu-operator
         image: {{ include "gpu-operator.fullimage" . }}
@@ -83,6 +94,12 @@ spec:
         resources:
           {{- toYaml . | nindent 10 }}
       {{- end }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
         ports:
           - name: metrics
             containerPort: 8080

deployments/gpu-operator/templates/upgrade_crd.yaml

@@ -81,10 +81,27 @@ spec:
       {{- end }}
       nodeSelector:
         {{- toYaml .Values.operator.nodeSelector | nindent 8 }}
+      {{- with .Values.operator.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operator.dnsPolicy }}
+      dnsPolicy: {{ .Values.operator.dnsPolicy }}
+      {{- end }}
+      {{- with .Values.operator.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: upgrade-crd
           image: {{ include "gpu-operator.fullimage" . }}
           imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
           command:
             - /usr/bin/manage-crds
           args:

deployments/gpu-operator/values.yaml

@@ -121,6 +121,17 @@ operator:
     requests:
       cpu: 200m
       memory: 100Mi
+  # Restricted defaults for the operator Deployment (not operand DaemonSets).
+  # Do not pin runAsUser/runAsGroup/fsGroup: the image already uses USER 1000:1000
+  # on vanilla Kubernetes, and a hardcoded UID fails OpenShift namespaces whose
+  # allocated range does not include 1000 (restricted-readonly SCC is MustRunAsRange).
+  securityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  # Empty dnsPolicy keeps the cluster default (ClusterFirst).
+  dnsPolicy: ""
+  dnsConfig: {}
   # metrics:
   #   serviceMonitor:
   #     interval: 15s