Define Flyte agent pod and container securityContext

 - Follow security best practices and allow for more granular
   configuration. Right now, the default flyteagent container cannot run
   with the following desirable podSecurityContext:

   runAsNonRoot: true
   runAsUser: XXX

   The container crashes on startup

   It would also be desirable to set a container securityContext with:

   capabilities:
     drop:
     - ALL

   The container launched with caps dropped, but I wasn't familiar
   enough with the code in that container to know if that will actually
   work, so didn't set a default

Signed-off-by: ddl-ebrown <[email protected]>

charts/flyteagent/README.md

@@ -26,11 +26,13 @@ A Helm chart for Flyte agent
 | podAnnotations | object | `{}` | Annotations for flyteagent pods |
 | podEnv | object | `{}` | Additional flyteagent pod container environment variables |
 | podLabels | object | `{}` | Labels for flyteagent pods |
+| podSecurityContext | object | `{"seLinuxOptions":{"type":"spc_t"}}` | Security context for pod |
 | ports.containerPort | int | `8000` |  |
 | ports.name | string | `"agent-grpc"` |  |
 | priorityClassName | string | `""` | Sets priorityClassName for datacatalog pod(s). |
 | replicaCount | int | `1` | Replicas count for flyteagent deployment |
 | resources | object | `{"limits":{"cpu":"500m","ephemeral-storage":"200Mi","memory":"200Mi"},"requests":{"cpu":"500m","ephemeral-storage":"200Mi","memory":"200Mi"}}` | Default resources requests and limits for flyteagent deployment |
+| securityContext | object | `{"allowPrivilegeEscalation":false}` | Security context for container |
 | service | object | `{"annotations":{"projectcontour.io/upstream-protocol.h2c":"grpc"},"type":"ClusterIP"}` | Service settings for flyteagent |
 | serviceAccount | object | `{"annotations":{},"create":true,"imagePullSecrets":[]}` | Configuration for service accounts for flyteagent |
 | serviceAccount.annotations | object | `{}` | Annotations for ServiceAccount attached to flyteagent pods |

charts/flyteagent/templates/agent/deployment.yaml

@@ -19,6 +19,8 @@ spec:
       {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
       {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
       - command:
         - pyflyte
@@ -36,6 +38,8 @@ spec:
         ports:
         - containerPort: {{ .Values.ports.containerPort }}
           name: {{ .Values.ports.name }}
+        securityContext:
+          {{- toYaml .Values.securityContext | nindent 12 }}
         resources: {{- toYaml .Values.resources | nindent 10 }}
         {{- with .Values.additionalVolumeMounts -}}
         {{ tpl (toYaml .) $ | nindent 8 }}

charts/flyteagent/values.yaml

@@ -54,6 +54,13 @@ serviceAccount:
   annotations: {}
   # -- ImagePullSecrets to automatically assign to the service account
   imagePullSecrets: []
+# -- Security context for pod
+podSecurityContext:
+  seLinuxOptions:
+    type: spc_t
+# -- Security context for container
+securityContext:
+  allowPrivilegeEscalation: false
 # -- Annotations for flyteagent pods
 podAnnotations: {}
 # -- Additional flyteagent pod container environment variables

deployment/agent/flyte_agent_helm_generated.yaml

@@ -71,6 +71,9 @@ spec:
         helm.sh/chart: flyteagent-v0.1.10
         app.kubernetes.io/managed-by: Helm
     spec:
+      securityContext:
+        seLinuxOptions:
+          type: spc_t
       containers:
       - command:
         - pyflyte
@@ -84,6 +87,8 @@ spec:
         ports:
         - containerPort: 8000
           name: agent-grpc
+        securityContext:
+            allowPrivilegeEscalation: false
         resources:
           limits:
             cpu: 500m