Support Pod Security Standard = "restricted" in the helm chart

[ecerulm]

Currently if you try to deploy the ingress-nginx helm chart into a namespace with "pod-security.kubernetes.io/enforce: restricted" it will fail with

Error creating: pods "nginx-controller-ingress-nginx-admission-create-nb4r4" is forbidden: violates PodSecurity "restricted:v1.23": unrestricted capabilities (container "create" must set securityContext.capabilities.drop=["ALL"])

Although the helm chart values allow to modify/control several securityContexts (.controller.podSecurityContext, .controller.admissionWebhooks.patch.securityContext, defaultBackend.podSecurityContext, default.containerSecurityContext) it does not provide a way to control that the securityContext in charts/ingress-nginx/templates/admission-webhooks. I don't know if this would be only thing missing.

I would be good to ensure that this could run under PodSecurity/PodSecurityStandard "restricted" , but if it's not possible maybe it would be good to mention in the documentation README.md saying that it needs at least "baseline".

[k8s-ci-robot]

@ecerulm: This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[longwuyuan]

#9056
#9056

[jemag]

Ideally the containers securityContext should try and strive towards the highest default security that they can sustain, independent of PSS. I am not sure what the end result would be for each container, but a decent target could be something like:

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000
  seccompProfile:
    type: RuntimeDefault

(Obviously the end-result for each container will be different depending on their circumstances, for example the controller needs the NET_BIND_SERVICE cap and to run as user 101 I believe)

Overall, this would improve the default security out of the box for end-users. If the containers currently support it, there isn't much downside to improving the default security.

It also helps clarifying to the end-user that these values are officially supported and will not cause any problem with the containers (e.g.: readOnlyRootFilesystem: true could for example cause problems for containers expecting to write to specific directories). By having them already specified, the end-user does not need to do extensive testing to ensure it does not cause any issue.

[pkoraca]

If it helps, we are running with the following config for quite a while to enforce a subset of Kubernetes Pod Security Standards (PSS) via Kyverno PSS Policies.

      values: |
        ingress-nginx:
          controller:
            admissionWebhooks:
              createSecretJob:
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                      - ALL
                  readOnlyRootFilesystem: true
                  runAsUser: 2000
                  runAsGroup: 2000
                  runAsNonRoot: true                
              patchWebhookJob:
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                      - ALL
                  readOnlyRootFilesystem: true
                  runAsUser: 2000
                  runAsGroup: 2000
                  runAsNonRoot: true                    
            containerSecurityContext:
              capabilities:
                drop:
                  - ALL
                add:
                  - NET_BIND_SERVICE
              runAsUser: 101
              runAsGroup: 101
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: false
              runAsNonRoot: true

[ecerulm]

I tested recently on version 4.11.2 of the helm chart and I did not get the error Error creating: pods "nginx-controller-ingress-nginx-admission-create-nb4r4" is forbidden: violates PodSecurity "restricted:v1.23": unrestricted capabilities (container "create" must set securityContext.capabilities.drop=["ALL"]) while deploying to a namespace with:

apiVersion: v1
kind: Namespace
metadata:
  name: ingress-nginx
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: v1.30

so I'm closing the issue