fix(security): declare the C-0211 baseline context on the Hetzner CSI workloads - #3878
Conversation
… workloads kube-system is excluded from add-security-context, so both Hetzner CSI workloads miss the two field gaps that account for C-0211's whole residual population: fsGroupChangePolicy on the pod spec, and seLinuxOptions on every container. Chart 2.23.0 exposes only `enabled` and `fsGroup` under podSecurityContext and no container securityContext at all, so both fields are post-rendered. OnRootMismatch is inert for both workloads. The node DaemonSet mounts only hostPath volumes, and kubelet never applies fsGroup ownership management to hostPath. The controller's one volume is an emptyDir, created root-owned on every pod start, so the root GID always mismatches and kubelet performs exactly the same recursive chown it performs today. The empty seLinuxOptions object declares the field without pinning a type, level or MCS category, so every container keeps the runtime's own SELinux defaults -- including the privileged hcloud-csi-driver container, whose existing `privileged: true` the patch preserves. Part of #3239 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ost-renderer The hcloud-csi HelmRelease is a controller-RBAC emitter, so adding post-renderer patches to it moves the pinned aggregate even though nothing is granted. Conservation against main 20240da: 573 rendered identities per side with an identical sorted identity list; exactly one rendered document differs, and it is the hcloud-csi HelmRelease, whose only delta is the postRenderers block this branch adds. All 94 grant-bearing ClusterRole, Role, ClusterRoleBinding, RoleBinding and ServiceAccount documents hash byte-identically on both sides, and appending one synthetic ClusterRole to the branch render changes that hash, so the identical result is a finding rather than a blind read. The new aggregate was read from CI's own failure on job 105324573289. Part of #3239 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@coderabbitai review |
|
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details🔇 Additional comments (2)
📝 WalkthroughWalkthroughThe Hetzner CSI HelmRelease now uses a Kustomize post-renderer to patch pod and container security contexts for its DaemonSet and Deployment. The patches set Priority: ⬇️ Low Merge Risk: ⚪ Minimal · up to The Hetzner CSI security-context declarations and their approved rendered-surface fingerprint update are consistent with the stated change. No actionable merge risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@coderabbitai review |
|
✅ Action performedReview finished.
|
Readiness at
|
1 participant
Motivation
Our cluster-security scan flags every workload in
kube-systemfor two missingdeclarations, because that namespace is deliberately excluded from the mutation that
supplies them everywhere else. The exclusion exists to protect privilege settings, but
these two fields are not privilege settings — so the scan has been reporting a gap we
never needed to have.
Changes
Declares the two fields on both Hetzner CSI workloads (the node agent and the controller),
clearing 2 of the 13 remaining
kube-systemworkloads. The values are chosen so nothingabout how these pods run actually changes: one field is provably a no-op for the volume
types these pods use, and the other declares the setting while leaving SELinux entirely to
the runtime, exactly as today.
No operational action needed. Pods restart once as the change rolls out.
Part of #3239