Mikek openshift - #11
Conversation
…to support openshift deployment
Co-authored-by: Copilot <copilot@github.com>
There was a problem hiding this comment.
Pull request overview
Adds OpenShift-specific Helm rendering for kagent (restricted SCC compatibility and optional SCC creation) and introduces an optional Service + health-check port exposure to support kproxy-style UDP intake deployments.
Changes:
- Add
openshift.*values plus templates/helpers to render OpenShift-compatible pod/container security contexts and (optionally) a SecurityContextConstraints resource. - Add configurable health-check server settings and support for exposing container ports + an optional Kubernetes Service (e.g., LoadBalancer with TCP health + UDP intake).
- Add Helm unit tests, docs, and CI template-render scenarios for OpenShift and kproxy load balancer configurations.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
values.yaml |
Adds OpenShift, healthCheck, extra ports, and Service configuration defaults. |
templates/_helpers.tpl |
Adds OpenShift SCC naming helper, OpenShift-aware security context helpers, and health/ports rendering logic in the container spec. |
templates/service.yaml |
New optional Service template driven by service.* values. |
templates/openshift-scc.yaml |
New optional SecurityContextConstraints template for OpenShift. |
contracts/values.schema.json |
Extends values schema for OpenShift, Service ports, and extra container ports. |
tests/service_test.yaml |
Adds unit coverage for Service rendering and port/env behavior for kproxy scenarios. |
tests/openshift_test.yaml |
Adds unit coverage for OpenShift restricted-compatible security contexts and SCC rendering. |
README.md |
Documents OpenShift usage and kproxy/load balancer configuration patterns. |
docs/openshift.md |
Adds a dedicated OpenShift deployment guide (restricted SCC + optional custom SCC). |
docs/kproxy-loadbalancer-values.yaml |
Provides an example values file for kproxy with a load balancer. |
.github/workflows/ci.yaml |
Adds template-render scenarios for OpenShift and kproxy load balancer configurations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| {{- default (printf "%s-scc" (include "kagent.fullname" .)) .Values.openshift.securityContextConstraints.name | trunc 63 | trimSuffix "-" }} | ||
| {{- end }} |
| value: "/opt/ua/keys" | ||
| - name: K_K8S_HELM | ||
| value: "true" | ||
| # Health check server configuration (auto-enabled when probes are enabled) |
| users: | ||
| - system:serviceaccount:{{ .Release.Namespace }}:{{ include "kagent.serviceAccountName" . }} |
| memory: 4096Mi | ||
|
|
||
| # Extra container ports to expose on the kagent container. | ||
| # The health check port is added automatically when kagent.healthCheck or probes are enabled. |
|
+1 for this. We don't use openshift however we need our kubernetes deployment of kagent to have a LoadBalancer service to ingress flow traffic. |
# Conflicts: # .github/workflows/ci.yaml # README.md # contracts/values.schema.json
Provide a stable, per-identity /etc/machine-id (32 lowercase hex, Linux format) derived from the pod keypair, avoiding the hostPath mount of the host machine-id that is blocked under the OpenShift restricted SCC. Gated by kagent.machineId.enabled (default off); active for statefulset with secret keypair. Includes schema, docs, example, and unit tests.
Add docs/capabilities.md documenting which Linux capabilities each Universal Agent capability requires, correct the inaccurate mapping in values.yaml (kdns needs NET_RAW, add livesynth SYS_CHROOT/SETUID/SETGID and ksyslog/ksnmptrap NET_BIND_SERVICE), and cross-link from README and the OpenShift guide. Also add .vscode/settings.json to treat Helm templates as helm language.
Add release workflow that lints, unit-tests, packages, and pushes the kagent chart to oci://ghcr.io/<owner>/kagent on v*.*.* tags (portable across fork and upstream), and creates a GitHub Release with the packaged .tgz. Add a package job to CI for build validation on PRs. Fix install docs: the chart artifact is named 'kagent' (not 'kagent-helm'), and add a provisioning-token/version to the OCI examples.
![arnica-github-connector[bot]](https://avatars.githubusercontent.com/in/144692?s=60&v=4){kind=small}
| run: | | ||
| CHART_VERSION="$(helm show chart . | awk '/^version:/ {print $2}')" | ||
| INPUT_VERSION="${{ github.event.inputs.version }}" | ||
| if [ -n "$INPUT_VERSION" ]; then | ||
| VERSION="$INPUT_VERSION" | ||
| elif [ "${GITHUB_REF_TYPE}" = "tag" ]; then | ||
| VERSION="${GITHUB_REF_NAME#v}" | ||
| else | ||
| VERSION="$CHART_VERSION" | ||
| fi | ||
| echo "version=${VERSION}" >> "$GITHUB_OUTPUT" | ||
| echo "Publishing chart version ${VERSION} (Chart.yaml declares ${CHART_VERSION})" | ||
| if [ "${GITHUB_REF_TYPE}" = "tag" ] && [ "${VERSION}" != "${CHART_VERSION}" ]; then | ||
| echo "::error::Git tag v${VERSION} does not match Chart.yaml version ${CHART_VERSION}. Bump the chart version before tagging." | ||
| exit 1 | ||
| fi | ||
|
|
There was a problem hiding this comment.
Static Code Analysis Risk: Injection - Run shell injection
This GitHub Actions workflow directly interpolates untrusted github context data (such as issue titles, pull request bodies, commit messages, branch names, or workflow input values) into a run: step using the ${{ ... }} expression syntax. Because these values are expanded inline before the shell script executes, an attacker who controls the source data — for example, by crafting a malicious issue title or pull request branch name — can inject arbitrary shell commands into the runner. This leads to OS command injection, allowing the attacker to exfiltrate repository secrets, modify code, pivot to other systems, or compromise the CI/CD pipeline.
Recommendation: Assign the untrusted github context value to an intermediate environment variable using the env: mapping on the step, then reference that environment variable in the run: script with proper double-quoting. For example, replace run: echo ${{ github.event.issue.title }} with env: ISSUE_TITLE: ${{ github.event.issue.title }} and run: echo "$ISSUE_TITLE". The double quotes around the environment variable reference are essential to prevent word-splitting and glob expansion. For cases where the value must be used programmatically (e.g., in conditionals or passed to other tools), consider additional input validation or sanitization before use.
Severity: Critical 💥
Status: Open 🔴
References:
- https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
- https://securitylab.github.com/research/github-actions-untrusted-input/
Suggested reviewers 🧐: @mkrygeri
More details:
Take action by replying with an [arnica] command 💬
Actions
Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.
To acknowledge the finding as a valid code risk: [arnica] ack <acknowledge additional details>
To dismiss the risk with a reason: [arnica] dismiss <fp|accept|capacity> <dismissal reason>
Examples
-
[arnica] ack This is a valid risk and I'm looking into it -
[arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive) -
[arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system -
[arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint
Detail why kagent needs a machine-id, the OpenShift-specific hostPath/shared-node problem, the init-container derivation (md5sum of public key, random fallback), the emptyDir->subPath volume flow, requirements/scope, verification steps, and the sd_id128 API caveat.
This PR adds support for Openshift in Kagent Kubenetes HELM deployment