Merge pull request #906 from bart0sh/PR136-terrascan-check

implement terrascan check

.github/workflows/ci.yaml

@@ -166,3 +166,17 @@ jobs:
       - name: Test SGX & FPGA Admission Webhook, Deploy Operator
         run: |
           make test-with-kind
+
+  terrascan:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+    - name: Install terrascan
+      run: |
+        curl -L "$(curl -s https://api.github.com/repos/accurics/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz
+        tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz
+        install terrascan /usr/local/bin && rm terrascan
+    - name: Run Terrascan
+      run: make terrascan
+

Jenkinsfile

@@ -67,6 +67,15 @@ pipeline {
         }
         stage("make lint"){
           parallel {
+            stage("make terrascan") {
+              steps {
+                dir(path: "$REPO_DIR") {
+                  sh "curl -sL `curl -s https://api.github.com/repos/accurics/terrascan/releases/latest | grep -o -E https://.+?_Linux_x86_64.tar.gz` | tar -zx terrascan"
+                  sh "sudo mv terrascan /usr/local/bin/"
+                  sh "make terrascan"
+                }
+              }
+            }
             stage("make lint") {
               steps {
                 dir(path: "$REPO_DIR") {

Makefile

@@ -148,6 +148,15 @@ e2e-sgx:
 e2e-gpu:
 	@$(GO) test -v ./test/e2e/... -ginkgo.v -ginkgo.progress -ginkgo.focus "GPU" -delete-namespace-on-failure=false
 
+terrascan:
+	@ls deployments/*/kustomization.yaml | while read f ; \
+	do \
+		echo "\n==== $$(basename $$(dirname $$f)) ====" ; \
+		terrascan scan -v --show-passed -d $$(dirname $$f) -i kustomize --severity high \
+		--skip-rules 'AC_K8S_0051,AC_K8S_0076,AC_K8S_0087' \
+		|| exit $$? ; \
+	done
+
 pre-pull:
 ifeq ($(TAG),devel)
 	@$(BUILDER) pull golang:1.17-bullseye

deployments/dlb_plugin/base/intel-dlb-plugin.yaml

@@ -24,6 +24,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         terminationMessagePath: /tmp/termination-log          
         volumeMounts:
         - name: devfs

deployments/dsa_plugin/base/intel-dsa-plugin.yaml

@@ -24,6 +24,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - name: devfs
           mountPath: /dev/dsa

deployments/fpga_admissionwebhook/kustomization.yaml

@@ -0,0 +1,2 @@
+bases:
+  - base

deployments/fpga_admissionwebhook/manager/manager.yaml

@@ -24,6 +24,7 @@ spec:
           runAsUser: 65532
           runAsGroup: 65532
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         resources:
           limits:
             cpu: 100m

deployments/fpga_plugin/base/intel-fpga-plugin-daemonset.yaml

@@ -20,6 +20,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /opt/intel/fpga-sw
           name: intel-fpga-sw
@@ -39,6 +40,7 @@ spec:
         terminationMessagePath: /tmp/termination-log
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - name: devfs
           mountPath: /dev

deployments/fpga_plugin/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - base

deployments/gpu_plugin/base/intel-gpu-plugin.yaml

@@ -19,6 +19,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /etc/kubernetes/node-feature-discovery/source.d/
           name: nfd-source-hooks
@@ -33,6 +34,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - name: devfs
           mountPath: /dev/dri

deployments/operator/default/manager_auth_proxy_patch.yaml

@@ -24,6 +24,7 @@ spec:
           runAsUser: 1000
           runAsGroup: 1000
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
       - name: manager
         args:
         - "--metrics-addr=127.0.0.1:8080"

deployments/operator/kustomization.yaml

@@ -0,0 +1,4 @@
+bases:
+  - default
+  - manager
+  - webhook

deployments/operator/manager/manager.yaml

@@ -38,6 +38,7 @@ spec:
           runAsUser: 65532
           runAsGroup: 65532
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         env:
           - name: DEVICEPLUGIN_NAMESPACE
             valueFrom:

deployments/qat_dpdk_app/base/crypto-perf-dpdk-pod-requesting-qat.yaml

@@ -27,6 +27,7 @@ spec:
         hugepages-2Mi: "128Mi"
     securityContext:
       readOnlyRootFilesystem: true
+      allowPrivilegeEscalation: false
       capabilities:
         add:
           ["IPC_LOCK"]

deployments/qat_dpdk_app/kustomization.yaml

@@ -0,0 +1,2 @@
+bases:
+  - base

deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml

@@ -17,6 +17,7 @@ spec:
       - name: intel-qat-kernel-plugin
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
           privileged: true
         image: intel/intel-qat-plugin:devel
         imagePullPolicy: IfNotPresent

deployments/qat_plugin/base/intel-qat-plugin.yaml

@@ -18,6 +18,7 @@ spec:
         image: intel/intel-qat-plugin:devel
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         imagePullPolicy: IfNotPresent
         volumeMounts:
         - name: devdir

deployments/sgx_admissionwebhook/kustomization.yaml

@@ -0,0 +1,2 @@
+bases:
+  - base

deployments/sgx_admissionwebhook/manager/manager.yaml

@@ -24,6 +24,7 @@ spec:
           runAsUser: 65532
           runAsGroup: 65532
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         resources:
           limits:
             cpu: 100m

deployments/sgx_aesmd/base/intel-sgx-aesmd.yaml

@@ -21,6 +21,7 @@ spec:
         image: intel/sgx-aesmd-demo:devel
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         resources:
           limits:
             sgx.intel.com/epc: "1Mi"

deployments/sgx_enclave_apps/base/intelsgx-job.yaml

@@ -20,6 +20,7 @@ spec:
           command: ["/opt/intel/sgx-sample-app/sgx-sample-app"]
           securityContext:
             readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
             capabilities:
               add: ["IPC_LOCK"]
           resources:

deployments/sgx_enclave_apps/kustomization.yaml

@@ -0,0 +1,2 @@
+bases:
+  - base

deployments/sgx_plugin/base/intel-sgx-plugin.yaml

@@ -18,6 +18,7 @@ spec:
         image: intel/intel-sgx-plugin:devel
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         imagePullPolicy: IfNotPresent
         volumeMounts:
         - name: kubeletsockets

deployments/sgx_plugin/overlays/epc-hook-initcontainer/add-epc-nfd-initcontainer.yaml

@@ -11,6 +11,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /etc/kubernetes/node-feature-discovery/source.d/
           name: nfd-source-hooks

deployments/sgx_plugin/overlays/epc-nfd/add-epc-nfd-initcontainer.yaml

@@ -11,6 +11,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /etc/kubernetes/node-feature-discovery/source.d/
           name: nfd-source-hooks

deployments/vpu_plugin/base/intel-vpu-plugin.yaml

@@ -24,6 +24,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - name: devion
           mountPath: /dev/ion

pkg/controllers/dlb/controller_test.go

@@ -33,6 +33,7 @@ const appLabel = "intel-dlb-plugin"
 func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
 	devicePlugin := rawObj.(*devicepluginv1.DlbDevicePlugin)
 	yes := true
+	no := false
 
 	daemonSet := apps.DaemonSet{
 		TypeMeta: metav1.TypeMeta{
@@ -77,7 +78,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:                  devicePlugin.Spec.Image,
 							ImagePullPolicy:        "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{

pkg/controllers/dsa/controller_test.go

@@ -35,6 +35,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 	devicePlugin := rawObj.(*devicepluginv1.DsaDevicePlugin)
 
 	yes := true
+	no := false
 	daemonSet := apps.DaemonSet{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "DaemonSet",
@@ -77,7 +78,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{

pkg/controllers/fpga/controller_test.go

@@ -35,6 +35,7 @@ const appLabel = "intel-fpga-plugin"
 func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
 	devicePlugin := rawObj.(*devicepluginv1.FpgaDevicePlugin)
 	yes := true
+	no := false
 	directoryOrCreate := v1.HostPathDirectoryOrCreate
 
 	return &apps.DaemonSet{
@@ -79,7 +80,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							ImagePullPolicy: "IfNotPresent",
 							Name:            appLabel,
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							TerminationMessagePath: "/tmp/termination-log",
 							VolumeMounts: []v1.VolumeMount{
@@ -106,7 +108,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							ImagePullPolicy: "IfNotPresent",
 							Name:            "intel-fpga-initcontainer",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{

pkg/controllers/gpu/controller_test.go

@@ -36,6 +36,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 	devicePlugin := rawObj.(*devicepluginv1.GpuDevicePlugin)
 
 	yes := true
+	no := false
 	daemonSet := apps.DaemonSet{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "DaemonSet",
@@ -78,7 +79,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{

pkg/controllers/qat/controller_test.go

@@ -35,6 +35,7 @@ const appLabel = "intel-qat-plugin"
 func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
 	devicePlugin := rawObj.(*devicepluginv1.QatDevicePlugin)
 	yes := true
+	no := false
 	pluginAnnotations := devicePlugin.ObjectMeta.DeepCopy().Annotations
 
 	return &apps.DaemonSet{
@@ -71,7 +72,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{

pkg/controllers/sgx/controller_test.go

@@ -36,6 +36,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 	devicePlugin := rawObj.(*devicepluginv1.SgxDevicePlugin)
 
 	yes := true
+	no := false
 	charDevice := v1.HostPathCharDev
 	directoryOrCreate := v1.HostPathDirectoryOrCreate
 	daemonSet := apps.DaemonSet{
@@ -70,7 +71,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{