Merge pull request #240 from aojea/alpha-hardening

Alpha/beta hardening: security, storage, Helm, and test fixes

Author: aojea

.github/workflows/deploy.yaml

@@ -8,6 +8,15 @@ on:
       - 'v*.*.*'
   workflow_dispatch:
 
+# Serialize deploys per-environment so a burst of pushes (e.g. several
+# dependabot PRs merging back-to-back) can't run concurrently against the
+# same GKE namespace and race on shared resources (e.g. the dns-sync-rollout
+# job name). Keeps only the latest queued run per environment; never cancels
+# one already in progress.
+concurrency:
+  group: deploy-${{ github.ref_type == 'tag' && 'hub' || 'bananas' }}
+  cancel-in-progress: false
+
 env:
   REGISTRY: ghcr.io
 

Dockerfile.nano-init

@@ -9,7 +9,8 @@ RUN gcc -shared -fPIC -ldl -o libinterceptor.so cmd/nano-init/interceptor/interc
 RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -o nano-init ./cmd/nano-init
 
 # Stage 2: Final
-FROM gcr.io/distroless/base:latest
-COPY --from=builder /app/nano-init /
-COPY --from=builder /app/libinterceptor.so /opt/sam/libinterceptor.so
+FROM gcr.io/distroless/base:nonroot
+COPY --from=builder --chown=nonroot:nonroot /app/nano-init /
+COPY --from=builder --chown=nonroot:nonroot /app/libinterceptor.so /opt/sam/libinterceptor.so
+USER nonroot:nonroot
 ENTRYPOINT ["/nano-init"]

Dockerfile.sam-box

@@ -7,6 +7,7 @@ COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -o sam-box ./cmd/sam-box
 
 # Stage 2: Final
-FROM gcr.io/distroless/static:latest
-COPY --from=builder /app/sam-box /
+FROM gcr.io/distroless/static:nonroot
+COPY --from=builder --chown=nonroot:nonroot /app/sam-box /
+USER nonroot:nonroot
 ENTRYPOINT ["/sam-box"]

Dockerfile.sam-console

@@ -7,11 +7,12 @@ RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 go build -o /bin/sam-console ./cmd/sam-console
 
-FROM gcr.io/distroless/static-debian12
+FROM gcr.io/distroless/static-debian12:nonroot
 
 WORKDIR /app
-COPY --from=builder /bin/sam-console /usr/local/bin/sam-console
-COPY cmd/sam-console/public /app/public
+COPY --from=builder --chown=nonroot:nonroot /bin/sam-console /usr/local/bin/sam-console
+COPY --chown=nonroot:nonroot cmd/sam-console/public /app/public
 
+USER nonroot:nonroot
 EXPOSE 8081
 ENTRYPOINT ["/usr/local/bin/sam-console"]

Dockerfile.sam-control-plane

@@ -5,8 +5,15 @@ COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -o sam-control-plane ./cmd/sam-control-plane
+# Pre-create the sqlite data dir owned by the nonroot UID so that a fresh
+# named/anonymous volume mounted over it inherits writable ownership instead
+# of defaulting to root.
+RUN mkdir -p /data-seed && chown 65532:65532 /data-seed
 
 # Stage 2: Final
-FROM gcr.io/distroless/static:latest
-COPY --from=builder /app/sam-control-plane /
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /tmp
+COPY --from=builder --chown=nonroot:nonroot /app/sam-control-plane /
+COPY --from=builder --chown=nonroot:nonroot /data-seed /data
+USER nonroot:nonroot
 ENTRYPOINT ["/sam-control-plane"]

Dockerfile.sam-node

@@ -5,8 +5,15 @@ COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -o sam-node ./cmd/sam-node
+# Pre-create the default data dir owned by the nonroot UID so that a fresh
+# named/anonymous volume mounted over it inherits writable ownership instead
+# of defaulting to root.
+RUN mkdir -p /data-seed && chown 65532:65532 /data-seed
 
 # Stage 2: Final
-FROM gcr.io/distroless/static:latest
-COPY --from=builder /app/sam-node /
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /tmp
+COPY --from=builder --chown=nonroot:nonroot /app/sam-node /
+COPY --from=builder --chown=nonroot:nonroot /data-seed /data
+USER nonroot:nonroot
 ENTRYPOINT ["/sam-node"]

Dockerfile.sam-router

@@ -5,8 +5,15 @@ COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -o sam-router ./cmd/sam-router
+# Pre-create the keys/data dir owned by the nonroot UID so that a fresh
+# named/anonymous volume mounted over it inherits writable ownership instead
+# of defaulting to root.
+RUN mkdir -p /data-seed && chown 65532:65532 /data-seed
 
 # Stage 2: Final
-FROM gcr.io/distroless/static:latest
-COPY --from=builder /app/sam-router /
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /tmp
+COPY --from=builder --chown=nonroot:nonroot /app/sam-router /
+COPY --from=builder --chown=nonroot:nonroot /data-seed /data
+USER nonroot:nonroot
 ENTRYPOINT ["/sam-router"]

charts/sam-mesh/templates/console-deployment.yaml

@@ -42,6 +42,18 @@ spec:
         - containerPort: 8081
           name: http
           protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /info
+            port: http
+          periodSeconds: 5
+        livenessProbe:
+          httpGet:
+            path: /info
+            port: http
+          periodSeconds: 15
+        resources:
+          {{- toYaml .Values.console.resources | nindent 10 }}
         args:
         - "--hub=http://{{ include "sam-mesh.fullname" . }}-control-plane:{{ .Values.controlPlane.service.port }}"
         - "--bind-addr=:8081"

charts/sam-mesh/templates/control-plane-deployment.yaml

@@ -46,6 +46,8 @@ spec:
             path: /info
             port: http
           periodSeconds: 15
+        resources:
+          {{- toYaml .Values.controlPlane.resources | nindent 10 }}
         args:
         - "--bind-address=0.0.0.0:8080"
         {{- if eq .Values.database.type "postgres" }}

charts/sam-mesh/templates/db-statefulset.yaml

@@ -34,6 +34,8 @@ spec:
         - containerPort: 5432
           name: postgres
           protocol: TCP
+        resources:
+          {{- toYaml .Values.database.postgres.resources | nindent 10 }}
         volumeMounts:
         - name: db-data
           mountPath: /var/lib/postgresql/data