{"action":"closed","issue":{"url":"https://api.github.com/repos/cloudfoundry-incubator/kubo-release/issues/231","repository_url":"https://api.github.com/repos/cloudfoundry-incubator/kubo-release","labels_url":"https://api.github.com/repos/cloudfoundry-incubator/kubo-release/issues/231/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry-incubator/kubo-release/issues/231/comments","events_url":"https://api.github.com/repos/cloudfoundry-incubator/kubo-release/issues/231/events","html_url":"https://github.com/cloudfoundry-incubator/kubo-release/issues/231","id":342473343,"node_id":"MDU6SXNzdWUzNDI0NzMzNDM=","number":231,"title":"Bug - disallowing privileged mode also sets SecurityContextDeny","user":{"login":"paulczar","id":2488346,"node_id":"MDQ6VXNlcjI0ODgzNDY=","avatar_url":"https://avatars2.githubusercontent.com/u/2488346?v=4","gravatar_id":"","url":"https://api.github.com/users/paulczar","html_url":"https://github.com/paulczar","followers_url":"https://api.github.com/users/paulczar/followers","following_url":"https://api.github.com/users/paulczar/following{/other_user}","gists_url":"https://api.github.com/users/paulczar/gists{/gist_id}","starred_url":"https://api.github.com/users/paulczar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulczar/subscriptions","organizations_url":"https://api.github.com/users/paulczar/orgs","repos_url":"https://api.github.com/users/paulczar/repos","events_url":"https://api.github.com/users/paulczar/events{/privacy}","received_events_url":"https://api.github.com/users/paulczar/received_events","type":"User","site_admin":false},"labels":[{"id":539523613,"node_id":"MDU6TGFiZWw1Mzk1MjM2MTM=","url":"https://api.github.com/repos/cloudfoundry-incubator/kubo-release/labels/in%20progress","name":"in progress","color":"3461AD","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-07-18T20:08:05Z","updated_at":"2018-09-05T00:10:10Z","closed_at":"2018-09-05T00:10:09Z","author_association":"NONE","body":"**What happened**:\r\n\r\nMany Kubernetes manifests and helm charts require setting `securityContext.runAsUser` in order to have the same permissions as when the image was built to ensure access to files/directories/etc works.\r\n\r\nUnfortunately `SecurityContextDeny` is being added as an admission controller when a cluster is created without privileged mode.  This breaks the ability to set a runAsUser and thus breaks many helm charts etc which in turn causes operators to deploy clusters with privileged mode enabled and reducing the overall security of the cluster.\r\n\r\nsee https://github.com/cloudfoundry-incubator/kubo-release/blob/fdad0defdd3b839410e3f862f68f9078643ab229/jobs/kube-apiserver/templates/config/bpm.yml.erb#L24-L26\r\n\r\n```\r\n  if !p('allow_privileged')\r\n    admission_control_options.push(\"SecurityContextDeny\")\r\n  end\r\n```\r\n\r\n\r\n**What you expected to happen**:\r\n\r\nSecurityContextDeny should be selectable as a admission controller and not be tied to privileged.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\n\r\n`helm install redis`\r\n\r\n**Anything else we need to know?**:\r\n\r\nIt looks like this Pull Request will solve the issue - https://github.com/cloudfoundry-incubator/kubo-release/pull/206\r\n\r\nand this will help general security concerns that might cause a person to want SecurityContextDeny in the first place - https://github.com/cloudfoundry-incubator/kubo-release/pull/216/files\r\n\r\n\r\n**Environment**:\r\n- Deployment Info (`bosh -d <deployment> deployment`):\r\n- Environment Info (`bosh -e <environment> environment`):\r\n- Kubernetes version (`kubectl version`):\r\n- Cloud provider (e.g. `aws`, `gcp`, `vsphere`):\r\n"}}
{"actor":{"display_login":"youreddy"}}