Custom SecurityContext in Postgresql, OperatorConfiguration CRDs by hshmilo · Pull Request #2244 · zalando/postgres-operator

hshmilo · 2023-02-27T10:11:33Z

This PR extends the Postgresql, OperatorConfiguration CRDs with the following list of properties related to pod/containers SecurityContext.
Postgresql CRD:

spiloSeccompProfile – adds SeccompProfile config property on the cluster pod level.
securityContext for the sidecars configuration – configures securityContext property for particular sidecar container.

OperatorConfiguration CRD:

dropped_pod_capabilities - list of dropped capabilities for spilo container.
spilo_seccompprofile – adds SeccompProfile config property on clusters pod level.
securityContext for the sidecars configuration – configures securityContext property for particular sidecar container.

This PR addresses #2223

EmilMunksoe · 2023-04-27T13:06:54Z

+1

x3rus · 2023-05-17T14:01:21Z

+1

ugur99 · 2023-08-08T12:12:56Z

Hi everyone, any updates regarding this PR?

m1m1x · 2023-09-17T07:19:27Z

Hi,

any chance to review this MR please? It would be a good addition for cluster security in depth.

mattwing · 2023-12-06T19:51:18Z

+1 on needing this to comply with restricted profiles, as @EmilMunksoe mentioned #2223 (comment)

Tahedah · 2024-04-17T12:09:36Z

Hey, this is also a blocker for us since we have strict pod policies for the clusters. Is this something that will be merged soon?

sj-porter-knime · 2024-04-22T20:14:21Z

+1

BalintCsonka · 2024-04-23T13:41:20Z

+1

mrpainte · 2024-05-02T14:50:18Z

+1 this would allow my team to be able to deploy postgres into our clusters with this operator

bumarcell · 2024-05-13T13:01:17Z

Why is this MR (which will make many lives easier) ignored for over a year now? waiting only makes it more complicated to merge and now there are merge conflicts to resolve.
I hope there's a good reason for that.. 😓

ajchiarello · 2024-05-13T15:18:04Z

Honestly, the delay on this led me to move from this operator over the CloudNative PostgreSQL Operator, which does everything and is already secure.

sdesbure · 2024-05-14T07:32:04Z

Honestly, the delay on this led me to move from this operator over the CloudNative PostgreSQL Operator, which does everything and is already secure.

same here :(

zacharyljones · 2024-08-09T15:12:06Z

+1

mheers · 2024-08-09T15:25:52Z

I circumvented the problem with a MutatingWebhookConfiguration and the corresponding controller:

https://github.com/mheers/pod-spec-mutator

You create a deployment with an env var that specifies how the pod will modified before starting:
https://github.com/mheers/pod-spec-mutator/blob/main/deploy/deployment.yaml#L38

With this one can easily specify the SecurityContext and have it merged in the starting pods specification on-the-fly.

ajchiarello · 2024-08-09T15:30:28Z

I circumvented the problem with a MutatingWebhookConfiguration and the corresponding controller:

I circumvented the problem by moving to the CNPG Operator which does everything securely by default.

mheers · 2024-08-09T15:34:54Z

I circumvented the problem with a MutatingWebhookConfiguration and the corresponding controller:

I circumvented the problem by moving to the CNPG Operator which does everything securely by default.

I also checked CNPG and indeed it offers to set the SecurityContext, but I also need to define additional volumes and hostAliases - which is also not supported by CNPG so I sticked with zalando and built the admission-hook.

chef-6229 · 2024-08-15T12:45:19Z

please merge this PR

sj-porter-knime · 2024-08-27T17:59:57Z

I think labeling this PR as minor might be a bit of an understatement - setting restricted security contexts is a best practice for any database running in Kubernetes and increasingly becoming a hard requirement. Almost every company we see using Kubernetes is installing tools like Kyverno or Gatekeeper to enforce security policies, making Postgres instances controlled via this operator a security exception in every single case. Using mutation policies with Kyverno is a creative workaround for those brave enough to use mutation policies, but also a bit of an anti-pattern.

Could we please get an acknowledgement or response from the PR reviewers (or other repo maintainers) with current status and/or some steps that community members can take to help it along? Do you need testers, or is there something else you're concerned about that we can help with? Migrating to another Postgres Operator would be a large undertaking for us, but if we can't get these security exceptions resolved, we may be forced to migrate at some point like others already have.

sj-porter-knime · 2024-08-27T17:59:57Z

I think labeling this PR as minor might be a bit of an understatement - setting restricted security contexts is a best practice for any database running in Kubernetes and increasingly becoming a hard requirement. Almost every company we see using Kubernetes is installing tools like Kyverno or Gatekeeper to enforce security policies, making Postgres instances controlled via this operator a security exception in every single case. Using mutation policies with Kyverno is a creative workaround for those brave enough to use mutation policies, but also a bit of an anti-pattern.

Could we please get an acknowledgement or response from the PR reviewers (or other repo maintainers) with current status and/or some steps that community members can take to help it along? Do you need testers, or is there something else you're concerned about that we can help with? Migrating to another Postgres Operator would be a large undertaking for us, but if we can't get these security exceptions resolved, we may be forced to migrate at some point like others already have.

szuecs · 2024-08-29T17:06:21Z

charts/postgres-operator/crds/operatorconfigurations.yaml

                    type: integer
                  spilo_runasgroup:
                    type: integer
+                  spilo_runasnonroot:


Why do you need this if there is a spilo_runasuser?

@szuecs such field is required to conform with pod security standards restricted profile
https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted

Ok then let's have it!
Please resolve all the comments related with this one.
Thanks for your work!

szuecs · 2024-08-29T17:06:49Z

charts/postgres-operator/crds/postgresqls.yaml

                type: integer
              spiloRunAsGroup:
                type: integer
+              spiloRunAsNonRoot:


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:06:58Z

charts/postgres-operator/values.yaml

  # set user and group for the spilo container (required to run Spilo as non-root process)
  # spilo_runasuser: 101
  # spilo_runasgroup: 103
+  # spilo_runasnonroot: true


https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:09:59Z

docs/administrator.md

-cluster to access buckets to write WAL-E logs: Workload Identity (recommended)
-or using a GCP Service Account Key (legacy).
-
-#### Workload Identity setup


why is this all dropped?
I have no idea about GCP, but the PR seems to be about CRD change to allow to customize SecurityContext.
Please make sure the focus of the PR stays in line with the changes.

szuecs · 2024-08-29T17:10:42Z

docs/reference/cluster_manifest.md

  This must be set to run the container without root. By default the container
  runs with root. This option only works for Spilo versions >= 1.6-p3.

+* **spiloRunAsNonRoot**


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:02Z

docs/reference/operator_parameters.md

  This must be set to run the container without root. By default the container
  runs with root. This option only works for Spilo versions >= 1.6-p3.

+* **spilo_runasnonroot**


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:16Z

docs/user.md

+        capabilities:
+          drop:
+          - ALL
+        runAsNonRoot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:24Z

manifests/complete-postgres-manifest.yaml

  enableShmVolume: true
 #  spiloRunAsUser: 101
 #  spiloRunAsGroup: 103
+#  spiloRunAsNonRoot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:30Z

manifests/complete-postgres-manifest.yaml

+#       capabilities:
+#        drop:
+#         - ALL
+#       runAsNonRoot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:40Z

manifests/configmap.yaml

  spilo_allow_privilege_escalation: "true"
  # spilo_runasuser: 101
  # spilo_runasgroup: 103
+  # spilo_runasnonroot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:47Z

manifests/operatorconfiguration.crd.yaml

                    type: integer
                  spilo_runasgroup:
                    type: integer
+                  spilo_runasnonroot:


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:11:54Z

manifests/postgresql-operator-default-configuration.yaml

    spilo_allow_privilege_escalation: true
    # spilo_runasuser: 101
    # spilo_runasgroup: 103
+    # spilo_runasnonroot: true


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:12:00Z

manifests/postgresql.crd.yaml

                type: integer
              spiloRunAsGroup:
                type: integer
+              spiloRunAsNonRoot:


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:12:18Z

pkg/apis/acid.zalan.do/v1/crds.go

 					"spiloRunAsGroup": {
 						Type: "integer",
 					},
+					"spiloRunAsNonRoot": {


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:12:32Z

pkg/apis/acid.zalan.do/v1/operator_configuration_type.go

 	SpiloAllowPrivilegeEscalation          *bool                        `json:"spilo_allow_privilege_escalation,omitempty"`
 	SpiloRunAsUser                         *int64                       `json:"spilo_runasuser,omitempty"`
 	SpiloRunAsGroup                        *int64                       `json:"spilo_runasgroup,omitempty"`
+	SpiloRunAsNonRoot                      *bool                        `json:"spilo_runasnonroot,omitempty"`


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:13:16Z

pkg/util/config/config.go

 	PodTerminateGracePeriod       time.Duration       `name:"pod_terminate_grace_period" default:"5m"`
 	SpiloRunAsUser                *int64              `name:"spilo_runasuser"`
 	SpiloRunAsGroup               *int64              `name:"spilo_runasgroup"`
+	SpiloRunAsNonRoot             *bool               `name:"spilo_runasnonroot"`


same as https://github.com/zalando/postgres-operator/pull/2244/files#r1736739561

szuecs · 2024-08-29T17:14:19Z

pkg/cluster/k8sres.go

 	}

+	c.logger.Debugf("Generated logical backup env vars")
+	c.logger.Debugf("%v", envVars)


hmm, not sure if I would like this as security enhancement

szuecs · 2024-08-29T17:18:27Z

I am not part of postgres-operator maintainers, but from kubernetes point of view I have some idea. I hope my questions are fine and help to get some things sorted out.

parsa97 · 2025-07-28T13:31:09Z

Hi all, just wondering if there's a reason this PR has been inactive for the past two years?

joshdcu · 2025-10-06T04:33:52Z

Yes, these changes are important to have. Could we please get this PR reviewed and merged?

berler · 2025-11-18T17:28:01Z

I'm working on several PRs that split this up into smaller changes that are hopefully easier to review. The first one is here: #2993

Hanna Shmilo added 2 commits February 24, 2023 15:06

pod+containers securityContext

0619032

add securityContext to postgresql.crd.yaml

2d93111

hshmilo requested review from FxKu, Jan-M, hughcapet, idanovinda, jopadi and sdudoladov as code owners February 27, 2023 10:11

hshmilo mentioned this pull request Feb 27, 2023

Custom Security Context in postgresql #2223

Open

add runAsNonRoot

8fe3817

FxKu added this to the 1.14.0 milestone Aug 21, 2024

FxKu added the minor label Aug 23, 2024

szuecs reviewed Aug 29, 2024

View reviewed changes

FxKu modified the milestones: 1.14.0, 2.0 Nov 11, 2024

berler mentioned this pull request Nov 18, 2025

add dropped_pod_capabilities #2993

Open

berler mentioned this pull request Nov 18, 2025

add spiloRunAsNonRoot and spiloSeccompProfile #2994

Open

Conversation

hshmilo commented Feb 27, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

EmilMunksoe commented Apr 27, 2023

Uh oh!

x3rus commented May 17, 2023

Uh oh!

ugur99 commented Aug 8, 2023

Uh oh!

m1m1x commented Sep 17, 2023

Uh oh!

mattwing commented Dec 6, 2023

Uh oh!

Tahedah commented Apr 17, 2024

Uh oh!

sj-porter-knime commented Apr 22, 2024

Uh oh!

BalintCsonka commented Apr 23, 2024

Uh oh!

mrpainte commented May 2, 2024

Uh oh!

bumarcell commented May 13, 2024

Uh oh!

ajchiarello commented May 13, 2024

Uh oh!

sdesbure commented May 14, 2024

Uh oh!

zacharyljones commented Aug 9, 2024

Uh oh!

mheers commented Aug 9, 2024

Uh oh!

ajchiarello commented Aug 9, 2024

Uh oh!

mheers commented Aug 9, 2024

Uh oh!

chef-6229 commented Aug 15, 2024

Uh oh!

sj-porter-knime commented Aug 27, 2024

Uh oh!

sj-porter-knime commented Aug 27, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomsozolins Aug 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hshmilo commented Feb 27, 2023 •

edited

Loading

tomsozolins Aug 29, 2024 •

edited

Loading