sourcegraph: read-only root filesystem for blobstore, cadvisor, otel, and pgsql-exporter

charts/sourcegraph/CHANGELOG.md

@@ -18,6 +18,7 @@ Use `**BREAKING**:` to denote a breaking change
 - Added `indexedSearch.livenessProbe` (`failureThreshold`, `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`) to tune the `zoekt-webserver` liveness probe, which was previously hardcoded. Defaults are unchanged (`10`/`120`/`60`/`5`). Raise `failureThreshold` or `timeoutSeconds` where the index greatly exceeds the container memory limit: page-cache reclaim stalls `/healthz` past `timeoutSeconds`, and consecutive failures restart a container that is still serving. Keep the resulting window wider than zoekt's in-process watchdog (`ZOEKT_WATCHDOG_ERRORS` x `ZOEKT_WATCHDOG_TICK`) so the watchdog remains the first line of defence.
 - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`.
 - Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix.
+- Set `readOnlyRootFilesystem: true` by default on the `blobstore`, `cadvisor`, `otel-agent`, and `otel-collector` containers, and on the `pgsql-exporter` sidecar of `pgsql`, `codeintel-db`, and `codeinsights-db`. `blobstore` gets an `emptyDir` at `/tmp`. Added `postgresExporter.containerSecurityContext`, which the templates already read but `values.yaml` did not define, so the sidecar rendered `securityContext: null`; it sets no user, so the sidecar still runs as its database pod's user. Set `<serviceName>.containerSecurityContext.readOnlyRootFilesystem: false` to revert.
 
 ## 8.1.0
 

charts/sourcegraph/README.md

@@ -93,7 +93,7 @@ In addition to the documented values, all services also support the following va
 | alpine.image.defaultTag | string | `<appVersion>@sha256:<digest>`, pinned by each release | Docker image tag for the `alpine` image |
 | alpine.image.name | string | `"alpine-3.14"` | Docker image name for the `alpine` image |
 | alpine.resources | object | `{"limits":{"cpu":"10m","memory":"50Mi"},"requests":{"cpu":"10m","memory":"50Mi"}}` | Resource requests & limits for the `alpine` initContainer, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |
-| blobstore.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"runAsGroup":101,"runAsUser":100}` | Security context for the `blobstore` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
+| blobstore.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `blobstore` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | blobstore.enabled | bool | `true` | Enable `blobstore` (S3 compatible storage) |
 | blobstore.env | object | the chart will add some default environment values | Environment variables for the `blobstore` container |
 | blobstore.image.defaultTag | string | `<appVersion>@sha256:<digest>`, pinned by each release | Docker image tag for the `blobstore` image |
@@ -106,7 +106,7 @@ In addition to the documented values, all services also support the following va
 | blobstore.storageAnnotations | object | `{}` | Optional annotations to add to the `blobstore` PVC |
 | blobstore.storageSize | string | `"100Gi"` | PVC Storage Request for `blobstore` data volume |
 | blobstore.storageSubPath | string | `""` | Optional subPath for the `blobstore` primary data volume mount |
-| cadvisor.containerSecurityContext | object | `{"privileged":true}` | Security context for the `cadvisor` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
+| cadvisor.containerSecurityContext | object | `{"privileged":true,"readOnlyRootFilesystem":true}` | Security context for the `cadvisor` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | cadvisor.enabled | bool | `true` | Enable `cadvisor` |
 | cadvisor.image.defaultTag | string | `<appVersion>@sha256:<digest>`, pinned by each release | Docker image tag for the `cadvisor` image |
 | cadvisor.image.name | string | `"cadvisor"` | Docker image name for the `cadvisor` image |
@@ -281,6 +281,7 @@ In addition to the documented values, all services also support the following va
 | nodeExporter.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `node-exporter` |
 | nodeExporter.serviceAccount.name | string | `"node-exporter"` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | openTelemetry.agent.containerSecurityContext.allowPrivilegeEscalation | bool | `false` |  |
+| openTelemetry.agent.containerSecurityContext.readOnlyRootFilesystem | bool | `true` |  |
 | openTelemetry.agent.containerSecurityContext.runAsGroup | int | `101` |  |
 | openTelemetry.agent.containerSecurityContext.runAsUser | int | `100` |  |
 | openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318,"httpZpages":55679}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |
@@ -298,6 +299,7 @@ In addition to the documented values, all services also support the following va
 | openTelemetry.gateway.config.traces.processors | object | `{}` | Define trace processors. Read how to configure sampling in the [OpenTelemetry documentation](https://docs.sourcegraph.com/admin/observability/opentelemetry#sampling-traces) |
 | openTelemetry.gateway.config.traces.tracePipelineProcessors | list | `[]` | Define the order in which processors are applied in the traces pipeline. When set, this takes precedence over the iteration order of `processors` (which cannot be relied on to preserve insertion order). Must contain exactly the same processor names as the keys of `processors`. |
 | openTelemetry.gateway.containerSecurityContext.allowPrivilegeEscalation | bool | `false` |  |
+| openTelemetry.gateway.containerSecurityContext.readOnlyRootFilesystem | bool | `true` |  |
 | openTelemetry.gateway.containerSecurityContext.runAsGroup | int | `101` |  |
 | openTelemetry.gateway.containerSecurityContext.runAsUser | int | `100` |  |
 | openTelemetry.gateway.name | string | `"otel-collector"` | Name used by resources. Does not affect service names or PVCs. |
@@ -328,6 +330,7 @@ In addition to the documented values, all services also support the following va
 | pgsql.storageAnnotations | object | `{}` | Optional annotations to add to the `pgsql` PVC |
 | pgsql.storageSize | string | `"200Gi"` | PVC Storage Request for `pgsql` data volume |
 | pgsql.storageSubPath | string | `""` | Optional subPath for the `pgsql` primary data volume mount |
+| postgresExporter.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true}` | Security context for the `pgsql-exporter` sidecar container, which runs as the user of its database pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | postgresExporter.image.defaultTag | string | `<appVersion>@sha256:<digest>`, pinned by each release | Docker image tag for the `pgsql-exporter` image |
 | postgresExporter.image.name | string | `"postgres_exporter"` | Docker image name for the `pgsql-exporter` image |
 | postgresExporter.resources | object | `{"limits":{"cpu":"10m","memory":"50Mi"},"requests":{"cpu":"10m","memory":"50Mi"}}` | Resource requests & limits for the `pgsql-exporter` sidecar container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |

charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml

@@ -89,6 +89,8 @@ spec:
           {{- end }}
         - name: blobstore
           mountPath: /blobstore
+        - name: tmpdir
+          mountPath: /tmp
         {{- if .Values.blobstore.extraVolumeMounts }}
         {{- toYaml .Values.blobstore.extraVolumeMounts | nindent 8 }}
         {{- end }}
@@ -112,6 +114,8 @@ spec:
           claimName: blobstore
       - name: blobstore
         emptyDir: {}
+      - name: tmpdir
+        emptyDir: {}
       {{- if .Values.blobstore.extraVolumes }}
       {{- toYaml .Values.blobstore.extraVolumes | nindent 6 }}
       {{- end }}

charts/sourcegraph/values.yaml

@@ -166,6 +166,7 @@ cadvisor:
     # You may also run `cadvisor` with reduced privileges by setting
     # `cadvisor.containerSecurityContext.privileged=false` in your override file
     privileged: true
+    readOnlyRootFilesystem: true
 
 codeInsightsDB:
   # -- Enable `codeinsights-db` PostgreSQL server
@@ -682,6 +683,7 @@ blobstore:
     allowPrivilegeEscalation: false
     runAsUser: 100
     runAsGroup: 101
+    readOnlyRootFilesystem: true
   # -- Name used by resources. Does not affect service names or PVCs.
   name: "blobstore"
   # -- Resource requests & limits for the `blobstore` container,
@@ -757,6 +759,7 @@ openTelemetry:
       allowPrivilegeEscalation: false
       runAsUser: 100
       runAsGroup: 101
+      readOnlyRootFilesystem: true
 
   agent:
     # -- Name used by resources. Does not affect service names or PVCs.
@@ -788,6 +791,7 @@ openTelemetry:
       allowPrivilegeEscalation: false
       runAsUser: 100
       runAsGroup: 101
+      readOnlyRootFilesystem: true
 
 nodeExporter:
   # -- Enable `node-exporter`
@@ -914,6 +918,11 @@ postgresExporter:
     defaultTag: 8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d
     # -- Docker image name for the `pgsql-exporter` image
     name: "postgres_exporter"
+  # -- Security context for the `pgsql-exporter` sidecar container, which runs as the user of its database pod,
+  # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
   # -- Resource requests & limits for the `pgsql-exporter` sidecar container,
   # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
   resources: