mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-07 07:51:38 +01:00
Compare commits
31 Commits
chore/kyve
...
ntretkowsk
| Author | SHA1 | Date | |
|---|---|---|---|
|
e720ef1bdb | ||
|
|
8867d1b204 | ||
|
|
cca755d4af | ||
|
|
2423ac2de6 | ||
|
|
09a233511e | ||
|
|
7d101b18d7 | ||
|
|
10f1ced37d | ||
|
|
2ddbd91f3d | ||
|
|
54277dabae | ||
|
|
b32cb70678 | ||
|
|
b7b9968245 | ||
|
|
b830edf8da | ||
|
|
f5aad1fa47 | ||
|
|
f2fe6f3026 | ||
|
|
1857dd961e | ||
|
|
0ab9979693 | ||
|
|
e0a6850a2d | ||
|
|
7032205acf | ||
|
|
51047936de | ||
|
|
a83ecd5c01 | ||
|
|
080073119b | ||
|
|
ec72602cdd | ||
|
|
9387168e89 | ||
|
|
b5a76bea57 | ||
|
|
bdcfb977e0 | ||
|
|
cb367775a6 | ||
|
|
e37361790b | ||
|
|
70bbbf311f | ||
|
|
cc94f0c66d | ||
|
|
684c6d4f29 | ||
|
|
62fae9976a |
5
.gitignore
vendored
5
.gitignore
vendored
@@ -28,8 +28,3 @@ logs
|
||||
|
||||
# Ignore backup files, e.g. created by the script that eases the local chart development
|
||||
*.bak
|
||||
|
||||
rendered.yaml
|
||||
pol.yaml
|
||||
|
||||
.DS_Store
|
||||
@@ -4,7 +4,7 @@
|
||||
---
|
||||
include:
|
||||
- project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
|
||||
ref: "v2.4.10"
|
||||
ref: "v2.4.17"
|
||||
file:
|
||||
- "ci/common/lint.yml"
|
||||
- "ci/release-automation/semantic-release.yml"
|
||||
@@ -767,17 +767,33 @@ import-default-accounts:
|
||||
- "echo \"Starting default account import for ${DOMAIN}\""
|
||||
- "cd /app"
|
||||
- |
|
||||
./user_import_udm_rest_api.py \
|
||||
--import_domain ${DOMAIN} \
|
||||
--udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
|
||||
--set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
|
||||
--import_filename ./template.ods \
|
||||
--admin_enable_fileshare True \
|
||||
--admin_enable_knowledgemanagement True \
|
||||
--admin_enable_projectmanagement True \
|
||||
--create_admin_accounts True \
|
||||
--create_maildomains True \
|
||||
--verify_certificate False
|
||||
set +e
|
||||
success=0
|
||||
for i in {1..5}; do
|
||||
echo "Attempt $i/5..."
|
||||
./user_import_udm_rest_api.py \
|
||||
--import_domain ${DOMAIN} \
|
||||
--udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
|
||||
--set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
|
||||
--import_filename ./template.ods \
|
||||
--admin_enable_fileshare True \
|
||||
--admin_enable_knowledgemanagement True \
|
||||
--admin_enable_projectmanagement True \
|
||||
--create_admin_accounts True \
|
||||
--create_maildomains True \
|
||||
--verify_certificate False
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Script succeeded on attempt $i."
|
||||
success=1
|
||||
break
|
||||
fi
|
||||
echo "Script failed. Waiting 60 seconds before retry..."
|
||||
sleep 60
|
||||
done
|
||||
if [ "$success" -ne 1 ]; then
|
||||
echo "Script failed after 5 attempts."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
run-tests:
|
||||
stage: "post-execute"
|
||||
|
||||
27
CHANGELOG.md
27
CHANGELOG.md
@@ -1,3 +1,30 @@
|
||||
# [1.10.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.9.0...v1.10.0) (2025-11-24)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **collabora:** Update Controller to 1.1.6 incl. Helm chart update to 1.1.10 ([d25c95f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d25c95f06bc199d09aa6ea4dc09c10e95153de38))
|
||||
* **collabora:** Update from 25.04.5 to 25.04.6 ([8de0f5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8de0f5de7277ad726588d7de2d06cb3e9376c993))
|
||||
* **external-services:** Create `nubus_authsession` database ([ec72602](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ec72602cdd3207f73ff806a26bfe7b9fd32b8634))
|
||||
* **helmfile:** Enable verification for XWiki Helm chart ([5104793](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/51047936de102c610adc00f4dff12d2eb8e945b0))
|
||||
* **helmfile:** Streamline annotations ([7aa717c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7aa717c0509a731c060c58a1b5877e1d9899406f))
|
||||
* **nubus:** Remove legacy `UMC` Keycloak client that was used for SAML connection with the Nubus portal ([152221f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/152221fa7976bfa942d5e9e9b8f78cc8e65765c0))
|
||||
* **open-xchange:** Only enable `smtpSASLAuthEnable` when `relayHost` is set ([70bbbf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/70bbbf311fcba57c31f535be7d0d453f4a945cee))
|
||||
* **open-xchange:** Optimize Dovecot Pro full-text search caches; review `migrations.md` for required upgrade steps ([f3f707c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f3f707c9eee8edf3ad61834d87b5c059f31b0e26))
|
||||
* **open-xchange:** Template SASL security options ([684c6d4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/684c6d4f29dd447872ebe582eef43c04034896f7))
|
||||
* **open-xchange:** Update Dovecot configuration based on supplier's best practise review ([850761e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/850761e0475b2f281fb23f6972d5c74fbdaa3a61))
|
||||
* **opendesk-static-files:** [[#260](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/260)] Fix doublette creation of configmap `data` keys when the same file is referenced multiple times for a component ([b5a76be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b5a76bea57ef7b136c54d1bc95c40f0a0c3f9716))
|
||||
* **openproject:** Update from 16.6.0 to 16.6.1 ([62fae99](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/62fae9976a731c00700d56ce8fab198bb2531d20))
|
||||
* **xwiki:** Update XWiki from 17.4.4 to 17.4.7 ([02a3b77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02a3b7711490394690df70ca92bab58b253e34f5))
|
||||
|
||||
|
||||
### Features
|
||||
|
||||
* **jitsi:** Update from 2.0.10431 to 2.0.10590 ([f5aad1f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f5aad1fa47559f0d3941c233c7d40029a9e83281))
|
||||
* **nubus:** Update from v1.14.0 to v1.15.2 ([12379d6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/12379d67e07936496fe31276b2052406e0137db6))
|
||||
* **open-xchange:** Support for LDAP group based mailing lists ([cc94f0c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cc94f0c66df098d0a20f7f0d4a6af5e791557981))
|
||||
* **openproject:** Update OpenProject from 16.5.1 to 16.6.0 ([19438c0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/19438c02817875bd408c5d6cf423d7bfb61f907f))
|
||||
|
||||
# [1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.8.0...v1.9.0) (2025-11-07)
|
||||
|
||||
|
||||
|
||||
@@ -86,7 +86,7 @@ When a repository path starts with `/zendis`, the artifact is only available in
|
||||
### Collabora
|
||||
|
||||
- Collabora Online (COOL) container image: Is build from the same public source code as Collabora Development Edition (CODE), only the build configurations might differ. COOL includes a brand package that is not public and its license is not open source.
|
||||
- COOL Controller container image and Helm chart: Source code and chart are using Mozilla Public License Version 2.0, but the source code is not public. It is provided to customers upon request.
|
||||
- [COOL Controller](https://www.collaboraonline.com/cool-controller-release-notes/) container image and Helm chart: Source code and chart are using Mozilla Public License Version 2.0, but the source code is not public. It is provided to customers upon request.
|
||||
|
||||
openDesk updates Collabora once a COOL image based on the version pattern `<major>.<minor>.<patch>.3+.<build>` was made available. This happens usually at the same time the CODE image with `<major>.<minor>.<patch>.2+.<build>` is made available.
|
||||
|
||||
|
||||
@@ -41,8 +41,8 @@ openDesk currently features the following functional main components:
|
||||
| Groupware | OX App Suite | GPL-2.0-only (backend), AGPL-3.0-or-later (frontend) | [8.41](https://documentation.open-xchange.com/appsuite/releases/8.41/) | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
|
||||
| Knowledge management | XWiki | LGPL-2.1-or-later | [17.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.4.4/) | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation) |
|
||||
| Portal & IAM | Nubus | AGPL-3.0-or-later | [1.15.2](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/1.15.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html) |
|
||||
| Project management | OpenProject | GPL-3.0-only | [16.6.0](https://www.openproject.org/docs/release-notes/16-6-0/) | [For the most recent release](https://www.openproject.org/docs/user-guide/) |
|
||||
| Videoconferencing | Jitsi | Apache-2.0 | [2.0.10431](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_10431) | [For the most recent release](https://jitsi.github.io/handbook/docs/category/user-guide/) |
|
||||
| Project management | OpenProject | GPL-3.0-only | [16.6.1](https://www.openproject.org/docs/release-notes/16-6-1/) | [For the most recent release](https://www.openproject.org/docs/user-guide/) |
|
||||
| Videoconferencing | Jitsi | Apache-2.0 | [2.0.10590](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_10590) | [For the most recent release](https://jitsi.github.io/handbook/docs/category/user-guide/) |
|
||||
| Weboffice | Collabora | MPL-2.0 | [25.04.6](https://www.collaboraoffice.com/code-25-04-release-notes/) | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/) |
|
||||
|
||||
While not all components are perfectly designed for the execution inside containers, one of the project's objectives is to
|
||||
|
||||
@@ -31,8 +31,6 @@ sankey-beta
|
||||
|
||||
ClamAV,PersistentVolume,1
|
||||
|
||||
Dovecot,PersistentVolume,1
|
||||
|
||||
Element/Synapse,PostgreSQL,1
|
||||
Element/Synapse,PersistentVolume,1
|
||||
|
||||
@@ -54,9 +52,15 @@ OpenProject,S3,1
|
||||
OpenProject,PersistentVolume,1
|
||||
OpenProject,Memcached,1
|
||||
|
||||
Open-Xchange,MariaDB,1
|
||||
Open-Xchange,PersistentVolume,1
|
||||
Open-Xchange,Redis,1
|
||||
OX App Suite,MariaDB,1
|
||||
OX App Suite,Redis,1
|
||||
OX App Suite,S3,1
|
||||
|
||||
OX Connector,PersistentVolume,1
|
||||
|
||||
OX Dovecot,Cassandra,1
|
||||
OX Dovecot,PersistentVolume,1
|
||||
OX Dovecot,S3,1
|
||||
|
||||
Postfix,PersistentVolume,1
|
||||
|
||||
@@ -70,7 +74,7 @@ XWiki,PersistentVolume,1
|
||||
| -------------------- | ------------ | -------- | --------------------------------------------------------------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
|
||||
| **ClamAV** | PVC | No | ClamAV Database | `clamav-database-clamav-simple-0` | `/var/lib/clamav` |
|
||||
| **Dovecot** | PVC | Yes | openDesk CE only: User mail directories | `dovecot` | `/srv/mail` |
|
||||
| | PVC | No | openDesk EE only: Metacache directory | `var-lib-dovecot-dovecot-0` | `/var/lib/dovecot` |
|
||||
| | PVC | Yes | openDesk EE only: Metacache directory | `var-lib-dovecot-dovecot-0` | `/var/lib/dovecot` |
|
||||
| | S3 | Yes | openDesk EE only: User mail | `dovecot` | `dovecot` |
|
||||
| | Cassandra | Yes | openDesk EE only: Metadata and ACLs | `dovecot_dictmap`, `dovecot_acl` | |
|
||||
| **Element/Synapse** | PostgreSQL | Yes | Application's main database | `matrix` | |
|
||||
@@ -85,8 +89,8 @@ XWiki,PersistentVolume,1
|
||||
| | | Yes | Login actions and device-fingerprints | `keycloak_extensions` | |
|
||||
| | | Optional | Store of the temporary password reset token | `selfservice` | |
|
||||
| | | Optional | OIDC session storage | `umsAuthSession` | |
|
||||
| | | No | Notification features are not used in openDesk 1.1 | `notificationsapi` | |
|
||||
| | | No | Guardian features are currently not used in openDesk 1.1 | `guardianmanagementapi` | |
|
||||
| | | No | At the moment the notification feature not enabled in openDesk | `notificationsapi` | |
|
||||
| | | No | At the moment the Guardian features are currently not enabled in openDesk | `guardianmanagementapi` | |
|
||||
| | S3 | No | Static files for Portal | `ums` | |
|
||||
| | PVC | Yes | openLDAP database (primary R/W Pods), when restore select the one from the leader | `shared-data-ums-ldap-server-primary-0` | `/var/lib/univention-ldap` |
|
||||
| | | Yes | openLDAP process data | `shared-run-ums-ldap-server-primary-0` | `/var/run/slapd` |
|
||||
@@ -101,13 +105,17 @@ XWiki,PersistentVolume,1
|
||||
| | Memcached | No | Cache | | |
|
||||
| | PVC | No | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs | `openproject-<web/worker>-*-tmp` | `/tmp` |
|
||||
| | | No | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs | `openproject-<web/worker>-app-*-tmp` | `/app/tmp` |
|
||||
| **Open-Xchange** | MariaDB | Yes | Application's control database to coordiate dynamically created ones | `configdb` | |
|
||||
| **OX App Suite** | MariaDB | Yes | Application's control database to coordiate dynamically created ones | `configdb` | |
|
||||
| | | Yes | Dynamically creates databases of schema `PRIMARYDB_n`containing multiple contexts | `PRIMARYDB_*` | |
|
||||
| | | Yes | OX Guard related settings | `oxguard*` | |
|
||||
| | S3 | Yes | Attachments of meetings, contacts and tasks | `openxchange` | |
|
||||
| | Redis | Optional | Cache, session related data, distributed maps | | |
|
||||
| | PVC | Optional | OX Connector: Caching of OX object data | for backup | `/var/lib/univention-appcenter/apps/ox-connector` |
|
||||
| **OX Connector** | PVC | Optional | OX Connector: Caching of OX object data | for backup | `/var/lib/univention-appcenter/apps/ox-connector` |
|
||||
| | | Yes | OX Connector: OX SOAP API credentials | `ox-connector-ox-contexts-ox-connector-0` | `/etc/ox-secrets` |
|
||||
| **OX Dovecot** | PVC | Yes | openDesk CE only: User mail directories | `dovecot` | `/srv/mail` |
|
||||
| | PVC | Yes | openDesk EE only: Various meta data and caches | `var-lib-dovecot` | `/var/lib/dovecot` |
|
||||
| | S3 | Yes | Dovecot Pro/openDesk EE only: User mail | `dovecot` | `dovecot` |
|
||||
| | Cassandra | Yes | Dovecot Pro/openDesk EE only: Metadata and ACLs | `dovecot_dictmap`, `dovecot_acl` | |
|
||||
| **Postfix** | PVC | Yes | Mail spool | `postfix` | `/var/spool/postfix` |
|
||||
| **XWiki** | PostgreSQL | Yes | Application's main database | `xwiki` | |
|
||||
| | PVC | Yes | Attachments | `xwiki-data-xwiki-0` | `/usr/local/xwiki/data` |
|
||||
|
||||
@@ -31,6 +31,11 @@ There are two options to deploy openDesk via Argo CD described in the following
|
||||
|
||||
## Option 1: Use YAML manifests
|
||||
|
||||
> [!warning]
|
||||
> Pre-rendering the YAML files will also embed all referenced secrets into the resulting outputs.
|
||||
> You must ensure that these files are accessible solely to individuals who are expressly authorized
|
||||
> to view the corresponding secrets, as well as the infrastructure and data protected by them.
|
||||
|
||||
This option requires a preprocessing step before using Argo CD. This step requires you to compile the Helmfile based
|
||||
deployment into Kubernetes YAML manifest, to do so you need to execute the helmfile binary:
|
||||
|
||||
|
||||
@@ -32,8 +32,10 @@ This documentation lets you create an openDesk evaluation instance on your Kuber
|
||||
* [Install](#install)
|
||||
* [Install single app](#install-single-app)
|
||||
* [Install single release/chart](#install-single-releasechart)
|
||||
* [Access deployment](#access-deployment)
|
||||
* [Using from external repository](#using-from-external-repository)
|
||||
* [Access deployment](#access-deployment)
|
||||
* [Login](#login)
|
||||
* [Credentials](#credentials)
|
||||
* [Uninstall](#uninstall)
|
||||
<!-- TOC -->
|
||||
|
||||
@@ -63,7 +65,7 @@ For your convenience, we recommend creating a `*.domain.tld` A-Record for your c
|
||||
| Record name | Type | Value | Additional information |
|
||||
|-------------------------------|------|----------------------------------------------------|-------------------------------------------------------------------|
|
||||
| *.domain.tld | A | IPv4 address of your Ingress Controller | |
|
||||
| *.domain.tld | AAAA | IPv6 address of your Ingress Controller | |
|
||||
| *.domain.tld | AAAA | IPv6 address of your Ingress Controller | Optional |
|
||||
| mail.domain.tld | A | IPv4 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
|
||||
| mail.domain.tld | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
|
||||
| domain.tld | MX | `10 mail.domain.tld` | |
|
||||
@@ -77,6 +79,8 @@ For your convenience, we recommend creating a `*.domain.tld` A-Record for your c
|
||||
|
||||
## Domain
|
||||
|
||||
As example base domain for your deployment we use `domain.tld` in this document.
|
||||
|
||||
A list of all subdomains can be found in `helmfile/environments/default/global.yaml.gotmpl`.
|
||||
|
||||
All subdomains can be customized. For example, _Nextcloud_ can be changed to `files.domain.tld` in `dev` environment:
|
||||
@@ -100,6 +104,11 @@ or alternatively via environment variable:
|
||||
export DOMAIN=domain.tld
|
||||
```
|
||||
|
||||
> [!warning]
|
||||
> Due to a limitation caused by a [bug in the SSSD subcomponent](https://github.com/SSSD/sssd/issues/7246), there
|
||||
> is an upper bound on the total domain length used by openDesk. To avoid issues, we recommend keeping the openDesk
|
||||
> base domain length below 94 characters.
|
||||
|
||||
### Apps
|
||||
|
||||
Depending on your ideal openDesk deployment, you may wish to disable or enable certain apps.
|
||||
@@ -441,17 +450,37 @@ Instead of iterating through all services, you can also deploy a single release
|
||||
helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
|
||||
```
|
||||
|
||||
## Using from external repository
|
||||
|
||||
Referring to `./helmfile_generic.yaml.gotmpl` from an external
|
||||
directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
|
||||
`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
|
||||
environments may overwrite specific configuration values. These
|
||||
configuration values are:
|
||||
|
||||
* `global.domain`
|
||||
* `global.helmRegistry`
|
||||
* `global.master_password`
|
||||
|
||||
# Access deployment
|
||||
|
||||
## Login
|
||||
|
||||
When all apps are successfully deployed, and their Pod status is `Running` or `Succeeded`, you can navigate to
|
||||
|
||||
```text
|
||||
https://domain.tld
|
||||
```
|
||||
|
||||
which will redirect you to the actual URL of the openDesk portal:
|
||||
|
||||
```text
|
||||
https://portal.domain.tld
|
||||
```
|
||||
|
||||
If you change the subdomain of `nubus`, you must replace the subdomain of `portal` with the same subdomain.
|
||||
By default the portal will send you to openDesk's login screen.
|
||||
|
||||
**Credentials:**
|
||||
## Credentials
|
||||
|
||||
openDesk deploys with the standard user account `Administrator`, the password for which can be retrieved as follows:
|
||||
|
||||
@@ -483,18 +512,6 @@ docker run --rm registry.opencode.de/bmi/opendesk/components/platform-developmen
|
||||
--create_admin_accounts True
|
||||
```
|
||||
|
||||
## Using from external repository
|
||||
|
||||
Referring to `./helmfile_generic.yaml.gotmpl` from an external
|
||||
directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
|
||||
`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
|
||||
environments may overwrite specific configuration values. These
|
||||
configuration values are:
|
||||
|
||||
* `global.domain`
|
||||
* `global.helmRegistry`
|
||||
* `global.master_password`
|
||||
|
||||
# Uninstall
|
||||
|
||||
You can uninstall the deployment by executing the following:
|
||||
|
||||
@@ -10,13 +10,21 @@ SPDX-License-Identifier: Apache-2.0
|
||||
* [Deprecation warnings](#deprecation-warnings)
|
||||
* [Overview and mandatory upgrade path](#overview-and-mandatory-upgrade-path)
|
||||
* [Manual checks/actions](#manual-checksactions)
|
||||
* [Versions ≥ v1.11.0](#versions--v1110)
|
||||
* [Pre-upgrade to versions ≥ v1.11.0](#pre-upgrade-to-versions--v1110)
|
||||
* [Helmfile new option: Annotations for external services (Dovecot, Jitsi JVB, Postfix)](#helmfile-new-option-annotations-for-external-services-dovecot-jitsi-jvb-postfix)
|
||||
* [Versions ≥ v1.10.0](#versions--v1100)
|
||||
* [Pre-upgrade to versions ≥ v1.10.0](#pre-upgrade-to-versions--v1100)
|
||||
* [Deployment cleanup: Collabora Controller](#deployment-cleanup-collabora-controller)
|
||||
* [Helmfile new secret: `secrets.nubus.ldapSearch.postfix`](#helmfile-new-secret-secretsnubusldapsearchpostfix)
|
||||
* [Helmfile new secret: `secrets.doveocot.sharedMailboxesMasterPassword`](#helmfile-new-secret-secretsdoveocotsharedmailboxesmasterpassword)
|
||||
* [New Helmfile default: Nubus provisioning debug container no longer deployed](#new-helmfile-default-nubus-provisioning-debug-container-no-longer-deployed)
|
||||
* [New Helmfile default: Postfix SMTP SASL security options](#new-helmfile-default-postfix-smtp-sasl-security-options)
|
||||
* [Post-upgrade to versions ≥ v1.10.0](#post-upgrade-to-versions--v1100)
|
||||
* [New application default: Dovecot full-text search index configuration](#new-application-default-dovecot-full-text-search-index-configuration)
|
||||
* [Versions ≥ v1.9.0](#versions--v190)
|
||||
* [Pre-upgrade to versions ≥ v1.9.0](#pre-upgrade-to-versions--v190)
|
||||
* [New application default: Postfix SMTP SASL security option](#new-application-default-postfix-smtp-sasl-security-option)
|
||||
* [Helmfile fix: Cassandra passwords read from `databases.*`](#helmfile-fix-cassandra-passwords-read-from-databases)
|
||||
* [Helmfile new feature: `functional.groupware.externalClients.*`](#helmfile-new-feature-functionalgroupwareexternalclients)
|
||||
* [Versions ≥ v1.8.0](#versions--v180)
|
||||
@@ -148,20 +156,20 @@ matching that constraint, though our links always point to the newest patch rele
|
||||
> 1. Upgrade to v1.7.1 → post steps for v1.6.0 to v1.7.1
|
||||
|
||||
<!-- IMPORTANT: Make sure to mark mandatory releases if an automatic migration requires a previous update to be installed -->
|
||||
| Version | Mandatory | Pre-Upgrade | Post-Upgrade | Minimum Required Previous Version |
|
||||
| ---------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------- | ---------------------------------------------------- |
|
||||
| [v1.10.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.9.0) | -- | [Pre](#pre-upgrade-to-versions--v1100) | -- | ⬇ Install ≥ v1.5.0 first |
|
||||
| [v1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.9.0) | -- | [Pre](#pre-upgrade-to-versions--v190) | -- | ⬇ Install ≥ v1.5.0 first |
|
||||
| [v1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.8.0) | -- | [Pre](#pre-upgrade-to-versions--v180) | -- | ⬇ Install ≥ v1.5.0 first |
|
||||
| [v1.7.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.7.1) | -- | [Pre](#pre-upgrade-to-versions--v170) | [Post](#post-upgrade-to-versions--v170) | ⬇ Install ≥ v1.5.0 first |
|
||||
| [v1.6.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.6.0) | -- | [Pre](#pre-upgrade-to-versions--v160) | [Post](#post-upgrade-to-versions--v160) | [⚠ Install v1.5.0 first](#versions--v160-automated) |
|
||||
| [v1.5.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.5.0) | **yes** | -- | -- | ⬇ Install ≥ v1.1.x first |
|
||||
| [v1.4.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.4.1) | -- | [Pre](#pre-upgrade-to-versions--v140) | -- | ⬇ Install ≥ v1.1.x first |
|
||||
| [v1.3.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.3.2) | -- | [Pre](#pre-upgrade-to-versions--v130) | -- | ⬇ Install ≥ v1.1.x first |
|
||||
| [v1.2.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.2.1) | -- | [Pre](#pre-upgrade-to-versions--v120) | -- | [⚠ Install v1.1.x first](#versions--v120-automated) |
|
||||
| [v1.1.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.1.2) | **yes** | [Pre .0](#pre-upgrade-to-versions--v110) → [Pre .1](#pre-upgrade-to-versions--v111) → [Pre .2](#pre-upgrade-to-versions--v112) | [Post](#post-upgrade-to-versions--v110) | [⚠ Install v1.0.0 first](#versions--v110-automated) |
|
||||
| [v1.0.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.0.0) | **yes** | [Pre](#pre-upgrade-to-versions--v100) | [Post](#post-upgrade-to-versions--v100) | [⚠ Install v0.9.0 first](#versions--v100-automated) |
|
||||
| [v0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v0.9.0) | **yes** | -- | -- | -- |
|
||||
| Version | Mandatory | Pre-Upgrade | Post-Upgrade | Minimum Required Previous Version |
|
||||
| ---------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------- | ---------------------------------------------------- |
|
||||
| [v1.10.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.9.0) | -- | [Pre](#pre-upgrade-to-versions--v1100) | [Post](#post-upgrade-to-versions--v1100) | ⬇ Install ≥ v1.5.0 first |
|
||||
| [v1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.9.0) | -- | [Pre](#pre-upgrade-to-versions--v190) | -- | ⬇ Install ≥ v1.5.0 first |
|
||||
| [v1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.8.0) | -- | [Pre](#pre-upgrade-to-versions--v180) | -- | ⬇ Install ≥ v1.5.0 first |
|
||||
| [v1.7.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.7.1) | -- | [Pre](#pre-upgrade-to-versions--v170) | [Post](#post-upgrade-to-versions--v170) | ⬇ Install ≥ v1.5.0 first |
|
||||
| [v1.6.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.6.0) | -- | [Pre](#pre-upgrade-to-versions--v160) | [Post](#post-upgrade-to-versions--v160) | [⚠ Install v1.5.0 first](#versions--v160-automated) |
|
||||
| [v1.5.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.5.0) | **yes** | -- | -- | ⬇ Install ≥ v1.1.x first |
|
||||
| [v1.4.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.4.1) | -- | [Pre](#pre-upgrade-to-versions--v140) | -- | ⬇ Install ≥ v1.1.x first |
|
||||
| [v1.3.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.3.2) | -- | [Pre](#pre-upgrade-to-versions--v130) | -- | ⬇ Install ≥ v1.1.x first |
|
||||
| [v1.2.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.2.1) | -- | [Pre](#pre-upgrade-to-versions--v120) | -- | [⚠ Install v1.1.x first](#versions--v120-automated) |
|
||||
| [v1.1.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.1.2) | **yes** | [Pre .0](#pre-upgrade-to-versions--v110) → [Pre .1](#pre-upgrade-to-versions--v111) → [Pre .2](#pre-upgrade-to-versions--v112) | [Post](#post-upgrade-to-versions--v110) | [⚠ Install v1.0.0 first](#versions--v110-automated) |
|
||||
| [v1.0.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.0.0) | **yes** | [Pre](#pre-upgrade-to-versions--v100) | [Post](#post-upgrade-to-versions--v100) | [⚠ Install v0.9.0 first](#versions--v100-automated) |
|
||||
| [v0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v0.9.0) | **yes** | -- | -- | -- |
|
||||
|
||||
> [!warning]
|
||||
> Be sure to check out the table in the release version you are going to install, and not the currently installed version.
|
||||
@@ -171,15 +179,85 @@ If you would like more details about the automated migrations, please read secti
|
||||
# Manual checks/actions
|
||||
|
||||
> [!note]
|
||||
> We **only** use the mathematical symbol ≥ to denote for which versions manual steps must be
|
||||
> applied. For example, "Versions ≥ v1.7.0" refers to all openDesk versions (major, minor and
|
||||
> We **only** use the mathematical symbol ≥ to denote for which versions manual steps must be
|
||||
> applied. For example, "Versions ≥ v1.7.0" refers to all openDesk versions (major, minor and
|
||||
> patch) starting from 1.7.0, e.g. 1.7.0, 1.7.1, 1.8.0, etc. Furthermore, if a version is not explicitly
|
||||
> listed no extra manual steps are required when upgrading to that version, e.g. in the case of an update from
|
||||
> version 1.7.0 to version 1.7.1.
|
||||
|
||||
## Versions ≥ v1.10.0
|
||||
## Versions ≥ v1.11.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.10.0
|
||||
### Pre-upgrade to versions ≥ v1.11.0
|
||||
|
||||
#### Helmfile new option: Annotations for external services (Dovecot, Jitsi JVB, Postfix)
|
||||
|
||||
**Target group:** Existing deployments using `service` annotations.
|
||||
|
||||
The three non-HTTP external services support now explicit annotations.
|
||||
See [`annotations.yaml.gomtpl`](../helmfile/environments/default/annotations.yaml.gotmpl) for reference.
|
||||
|
||||
**Jitsi JVB**
|
||||
|
||||
The already existing annotation key `annotations.jitsiJVB.service` has been renamed to
|
||||
`annotations.jitsiJVB.serviceExternal` be in line with the newly added ones for Postfix and Dovecot.
|
||||
If you make use of the JVB service annotation please rename the attribute to the new `serviceExternal` standard.
|
||||
|
||||
**Dovecot**
|
||||
|
||||
Setting service annotation by `annotations.openxchangeDovecot.service` applied the annotations to the internal
|
||||
and external service. This key now only sets annotations for the internal service. If you want to set
|
||||
annotations for the external service use the newly introduced key `annotations.openxchangeDovecot.serviceExternal`.
|
||||
|
||||
**Postfix**
|
||||
|
||||
Setting service annotation by `annotations.openxchangePostfix.service` applied the annotations to the internal
|
||||
and external service. This key now only sets annotations for the internal service. If you want to set
|
||||
annotations for the external service use the newly introduced key `annotations.openxchangePostfix.serviceExternal`.
|
||||
|
||||
## Versions ≥ v1.10.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.10.0
|
||||
|
||||
#### Deployment cleanup: Collabora Controller
|
||||
|
||||
**Target group:** Existing openDesk Enterprise deployments using Collabora Controller. Actually only long running
|
||||
deployments are affected, but following the instructions won't hurt.
|
||||
|
||||
As per upstream release notes for [Collabora Online Controller 1.1.4](https://www.collaboraonline.com/cool-controller-release-notes/)
|
||||
you have to remove the existing leases of the Controller. You can do so by setting `<your_namespace>` and executing
|
||||
the commands below.
|
||||
|
||||
```shell
|
||||
export NAMESPACE=<your_namespace>
|
||||
export COLLABORA_CONTROLLER_DEPLOYMENT_NAME=collabora-controller-cool-controller
|
||||
kubectl -n ${NAMESPACE} scale deployment/${COLLABORA_CONTROLLER_DEPLOYMENT_NAME} --replicas=0
|
||||
kubectl -n ${NAMESPACE} delete -n collabora leases.coordination.k8s.io collabora-online
|
||||
```
|
||||
|
||||
> [!note]
|
||||
> The Collabora Online Controller is not scaled up again, as this would happen as part of the upgrade deployment.
|
||||
|
||||
#### Helmfile new secret: `secrets.nubus.ldapSearch.postfix`
|
||||
|
||||
**Target group:** All existing deployments that use self-defined secrets.
|
||||
|
||||
The updated Postfix configuration supporting LDAP group based mailing list requires a new secret that is
|
||||
declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key
|
||||
`secrets.nubus.ldapSearch.postfix`.
|
||||
|
||||
If you define your own secrets, please ensure that you provide a value for this secret, otherwise it will
|
||||
be derived from the `MASTER_PASSWORD`.
|
||||
|
||||
#### Helmfile new secret: `secrets.doveocot.sharedMailboxesMasterPassword`
|
||||
|
||||
**Target group:** All existing deployments that have OX App Suite enabled and that use self-defined secrets.
|
||||
|
||||
The revised Dovecot configuration requires a new secret that is declared in
|
||||
[`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key
|
||||
`secrets.doveocot.sharedMailboxesMasterPassword`.
|
||||
|
||||
If you define your own secrets, please ensure that you provide a value for this secret, otherwise it will
|
||||
be derived from the `MASTER_PASSWORD`.
|
||||
|
||||
#### New Helmfile default: Nubus provisioning debug container no longer deployed
|
||||
|
||||
@@ -188,15 +266,57 @@ If you would like more details about the automated migrations, please read secti
|
||||
The [nats-box](https://github.com/nats-io/nats-box), a handy tool when it comes to debugging the Nubus provisioning stack, is no longer enabled in openDesk by default.
|
||||
|
||||
To re-enable the nats-box for your deployment you have to set:
|
||||
```
|
||||
technical.nubus.provisioning.nats.natsBox.enabled: true
|
||||
```yaml
|
||||
technical:
|
||||
nubus:
|
||||
provisioning:
|
||||
nats:
|
||||
natsBox:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
> [!note]
|
||||
> The nats-box also gets enabled when setting `debug.enabled: true`, but that should only be used in non-production scenarios and enabled debug
|
||||
> accross the whole deployment.
|
||||
|
||||
### Post-upgrade to versions ≥ v1.10.0
|
||||
#### New Helmfile default: Postfix SMTP SASL security options
|
||||
|
||||
**Target group:** All openDesk deployments using an external SMTP relay that does not support
|
||||
[Postfix's default `smtpSASLSecurityOptions`](https://www.postfix.org/postconf.5.html#smtp_sasl_security_options).
|
||||
|
||||
Starting from openDesk v1.9.0, the SMTP SASL security options set within openDesk are aligned with the
|
||||
recommended defaults. This might break currently working connections with external SMTP relays.
|
||||
|
||||
> [!warning]
|
||||
> Please check your mail relays supported SASL security options and adjust your deployment accordingly to
|
||||
> prevent the disruption of mail delivery.
|
||||
|
||||
To fall back to the behavior of openDesk < v1.9.0 (no security options at all) set the following in
|
||||
`smtp.yaml.gotmpl`
|
||||
|
||||
``` yaml
|
||||
smtp:
|
||||
security:
|
||||
smtpdSASLSecurityOptions: ~
|
||||
smtpSASLSecurityOptions: ~
|
||||
```
|
||||
|
||||
To set specific options consult the official Postfix documentation for
|
||||
[smtpd](https://www.postfix.org/postconf.5.html#smtpd_sasl_security_options) or
|
||||
[smtp](https://www.postfix.org/postconf.5.html#smtp_sasl_security_options) and set the string options via the
|
||||
yaml array notation:
|
||||
|
||||
``` yaml
|
||||
smtp:
|
||||
security:
|
||||
smtpdSASLSecurityOptions:
|
||||
- "noanonymous"
|
||||
smtpSASLSecurityOptions:
|
||||
- "noanonymous"
|
||||
- "noplaintext"
|
||||
```
|
||||
|
||||
### Post-upgrade to versions ≥ v1.10.0
|
||||
|
||||
#### New application default: Dovecot full-text search index configuration
|
||||
|
||||
@@ -210,9 +330,21 @@ Run the following command inside the Dovecot container:
|
||||
set -x; for d in /var/lib/dovecot/*/*; do uuid=$(basename "$d"); [[ $uuid =~ ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$ ]] || continue; doveadm fts rescan -u "$uuid"; doveadm index -u "$uuid" -q '*'; done
|
||||
```
|
||||
|
||||
## Versions ≥ v1.9.0
|
||||
## Versions ≥ v1.9.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.9.0
|
||||
### Pre-upgrade to versions ≥ v1.9.0
|
||||
|
||||
#### New application default: Postfix SMTP SASL security option
|
||||
|
||||
**Target group:** All openDesk deployments using an external SMTP relay that does not support
|
||||
[Postfix's default `smtpSASLSecurityOptions`](https://www.postfix.org/postconf.5.html#smtp_sasl_security_options).
|
||||
|
||||
Starting from openDesk v1.9.0, the SMTP SASL security options set within openDesk are aligned with the
|
||||
recommended defaults. This might break currently working connections with external SMTP relays. To prevent
|
||||
this you have to configure the supported options for your mail relay one of the following ways:
|
||||
|
||||
- Recommended: Directly upgrade to v1.10.0 and set SMTP SASL options through `smtp.security.*`.
|
||||
- Configure a customization for `smtpSASLSecurityOptions`.
|
||||
|
||||
#### Helmfile fix: Cassandra passwords read from `databases.*`
|
||||
|
||||
@@ -250,9 +382,9 @@ Additionally, it is now possible to explicitly define the hostnames shown in the
|
||||
|
||||
If these values are not explicitly set, openDesk will use `.Values.global.domain` as in previous releases.
|
||||
|
||||
## Versions ≥ v1.8.0
|
||||
## Versions ≥ v1.8.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.8.0
|
||||
### Pre-upgrade to versions ≥ v1.8.0
|
||||
|
||||
#### New application default: Default group for two-factor authentication is now "2FA Users"
|
||||
|
||||
@@ -407,9 +539,9 @@ Gravatar support is no longer enabled by default in Jitsi and OpenProject. In ca
|
||||
OPENPROJECT_PLUGIN__OPENPROJECT__AVATARS: '{enable_gravatars: true, enable_local_avatars: true}'
|
||||
```
|
||||
|
||||
## Versions ≥ v1.7.0
|
||||
## Versions ≥ v1.7.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.7.0
|
||||
### Pre-upgrade to versions ≥ v1.7.0
|
||||
|
||||
#### Helmfile fix: Ensure enterprise overrides apply when deploying from project root
|
||||
|
||||
@@ -440,7 +572,7 @@ annotation:
|
||||
notesYProvider: {}
|
||||
```
|
||||
|
||||
### Post-upgrade to versions ≥ v1.7.0
|
||||
### Post-upgrade to versions ≥ v1.7.0
|
||||
|
||||
#### Upstream fix: Provisioning of functional mailboxes
|
||||
|
||||
@@ -467,9 +599,9 @@ kill ${PROVISIONING_PORT_FORWARD_PID}
|
||||
rm ${TEMPORARY_CONSUMER_JSON}
|
||||
```
|
||||
|
||||
## Versions ≥ v1.6.0
|
||||
## Versions ≥ v1.6.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.6.0
|
||||
### Pre-upgrade to versions ≥ v1.6.0
|
||||
|
||||
#### Upstream constraint: Nubus' external secrets
|
||||
|
||||
@@ -488,7 +620,7 @@ Please ensure you read the [Nubus 1.10.0 "Migration steps" section](https://docs
|
||||
|
||||
For OX App Suite to access the object storage a new secret has been introduced.
|
||||
|
||||
It is declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key: `secrets.minio.openxchangeUser`. If you define your own secrets, please ensure that you provide a value for this secret as well, otherwise the aforementioned secret will be derived from the `MASTER_PASSWORD`.
|
||||
It is declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key: `secrets.minio.openxchangeUser`. If you define your own secrets, please ensure that you provide a value for this secret as well, otherwise it will be derived from the `MASTER_PASSWORD`.
|
||||
|
||||
#### Helmfile new object storage: `objectstores.openxchange.*`
|
||||
|
||||
@@ -524,7 +656,7 @@ kubectl cp -n ${NAMESPACE} open-xchange-core-mw-default-0:/opt/open-xchange/ox-f
|
||||
2. Run the upgrade.
|
||||
3. Continue with the [related post-upgrade steps](#ox-app-suite-fix-up-using-s3-as-storage-for-non-mail-attachments-post-upgrade)
|
||||
|
||||
### Post-upgrade to versions ≥ v1.6.0
|
||||
### Post-upgrade to versions ≥ v1.6.0
|
||||
|
||||
#### OX App Suite fix-up: Using S3 as storage for non mail attachments (post-upgrade)
|
||||
|
||||
@@ -565,9 +697,9 @@ ID Type of Job Status Further Information
|
||||
/opt/open-xchange/sbin/unregisterfilestore -A $MASTER_ADMIN_USER -P $MASTER_ADMIN_PW -i <your_old_filestore_id_from_step_3>
|
||||
```
|
||||
|
||||
## Versions ≥ v1.4.0
|
||||
## Versions ≥ v1.4.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.4.0
|
||||
### Pre-upgrade to versions ≥ v1.4.0
|
||||
|
||||
#### Helmfile cleanup: `global.additionalMailDomains` as list
|
||||
|
||||
@@ -591,9 +723,9 @@ global:
|
||||
- "sub2.maildomain.de"
|
||||
```
|
||||
|
||||
## Versions ≥ v1.3.0
|
||||
## Versions ≥ v1.3.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.3.0
|
||||
### Pre-upgrade to versions ≥ v1.3.0
|
||||
|
||||
#### Helmfile new feature: `functional.authentication.ssoFederation`
|
||||
|
||||
@@ -601,9 +733,9 @@ global:
|
||||
|
||||
Please ensure to configure your IdP federation config details as part of `functional.authentication.ssoFederation`. You can find more details in the "Example configuration" section of [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
|
||||
|
||||
## Versions ≥ v1.2.0
|
||||
## Versions ≥ v1.2.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.2.0
|
||||
### Pre-upgrade to versions ≥ v1.2.0
|
||||
|
||||
#### Helmfile cleanup: Do not configure OX provisioning when no OX installed
|
||||
|
||||
@@ -664,9 +796,9 @@ In case you are planning to migrate an existing instance from MariaDB to Postgre
|
||||
- https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
|
||||
- https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
|
||||
|
||||
## Versions ≥ v1.1.2
|
||||
## Versions ≥ v1.1.2
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.1.2
|
||||
### Pre-upgrade to versions ≥ v1.1.2
|
||||
|
||||
#### Helmfile feature update: App settings wrapped in `apps.` element
|
||||
|
||||
@@ -695,9 +827,9 @@ apps:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
## Versions ≥ v1.1.1
|
||||
## Versions ≥ v1.1.1
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.1.1
|
||||
### Pre-upgrade to versions ≥ v1.1.1
|
||||
|
||||
#### Helmfile feature update: Component specific `storageClassName`
|
||||
|
||||
@@ -750,9 +882,9 @@ persistence:
|
||||
|
||||
A not yet templated secret was discovered in the Nubus deployment. It is now declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) and can be defined using: `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the same value as the `MASTER_PASSWORD` environment variable used in your deployment.
|
||||
|
||||
## Versions ≥ v1.1.0
|
||||
## Versions ≥ v1.1.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.1.0
|
||||
### Pre-upgrade to versions ≥ v1.1.0
|
||||
|
||||
#### Helmfile cleanup: Restructured `/helmfile/files/theme` folder
|
||||
|
||||
@@ -915,7 +1047,7 @@ The update from openDesk v1.0.0 contains Redis 7.4.1, like the other openDesk bu
|
||||
|
||||
Please ensure the Redis you are using is updated to at least version 7.4 to support the requirement of OX App Suite.
|
||||
|
||||
### Post-upgrade to versions ≥ v1.1.0
|
||||
### Post-upgrade to versions ≥ v1.1.0
|
||||
|
||||
#### XWiki fix-ups
|
||||
|
||||
@@ -941,9 +1073,9 @@ Unfortunately XWiki does not upgrade itself as expected. The bug has been report
|
||||
|
||||
You should have now a fully functional XWiki instance with single sign-on and full-text search.
|
||||
|
||||
## Versions ≥ v1.0.0
|
||||
## Versions ≥ v1.0.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.0.0
|
||||
### Pre-upgrade to versions ≥ v1.0.0
|
||||
|
||||
#### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus
|
||||
|
||||
@@ -1125,7 +1257,7 @@ The IAM admin account `Administrator` is the only member of this group by defaul
|
||||
|
||||
If you need other accounts to use the API, please assign them to the aforementioned group.
|
||||
|
||||
### Post-upgrade to versions ≥ v1.0.0
|
||||
### Post-upgrade to versions ≥ v1.0.0
|
||||
|
||||
#### Configuration Improvement: Separate user permission for using Video Conference component
|
||||
|
||||
@@ -1157,33 +1289,33 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
|
||||
|
||||
# Automated migrations - Details
|
||||
|
||||
## Versions ≥ v1.6.0 (automated)
|
||||
## Versions ≥ v1.6.0 (automated)
|
||||
|
||||
> [!note]
|
||||
> Details can be found in [run_5.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_5.py).
|
||||
|
||||
### Versions ≥ v1.6.0 migrations-post
|
||||
### Versions ≥ v1.6.0 migrations-post
|
||||
|
||||
- Automatically restarts the StatefulSets `ums-provisioning-nats` and `ox-connector` due to a workaround applied on the NATS secrets, see the "Notes" segment of the ["Password seed" heading in getting-started.md](./docs/getting-started.md#password-seed)
|
||||
|
||||
> [!note]
|
||||
> This change aims to prevent authentication failures with NATS in some Pods, which can lead to errors such as: `wait-for-nats Unavailable, waiting 2 seconds. Error: nats: 'Authorization Violation'`.
|
||||
|
||||
## Versions ≥ v1.2.0 (automated)
|
||||
## Versions ≥ v1.2.0 (automated)
|
||||
|
||||
> [!note]
|
||||
> Details can be found in [run_4.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_4.py).
|
||||
|
||||
### Versions ≥ v1.2.0 migrations-pre
|
||||
### Versions ≥ v1.2.0 migrations-pre
|
||||
|
||||
- Automatically deletes PVC `group-membership-cache-ums-portal-consumer-0`: With the upgrade the Nubus Portal Consumer no longer requires to be executed with root privileges. The PVC contains files that require root permission to access them, therefore the PVC gets deleted (and re-created) during the upgrade.
|
||||
- Automatically deletes StatefulSet `ums-portal-consumer`: A bug was fixed in the templating of the Portal Consumer's PVC causing the values in `persistence.storages.nubusPortalConsumer.*` to be ignored. As these values are immutable, we had to delete the whole StatefulSet.
|
||||
|
||||
### Versions ≥ v1.2.0 migrations-post
|
||||
### Versions ≥ v1.2.0 migrations-post
|
||||
|
||||
- Automatically restarts the Deployment `ums-provisioning-udm-transformer` and StatefulSet `ums-provisioning-udm-listener` and deletes the Nubus Provisioning consumer `durable_name:incoming` on stream `stream:incoming`: Due to a bug in Nubus 1.7.0 the `incoming` stream was blocked after the upgrade, the aforementioned measures unblock the stream.
|
||||
|
||||
## Versions ≥ v1.1.0 (automated)
|
||||
## Versions ≥ v1.1.0 (automated)
|
||||
|
||||
With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.
|
||||
|
||||
@@ -1194,7 +1326,7 @@ creating the config map with the mentioned label.
|
||||
> [!note]
|
||||
> Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
|
||||
|
||||
## Versions ≥ v1.0.0 (automated)
|
||||
## Versions ≥ v1.0.0 (automated)
|
||||
|
||||
The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
|
||||
|
||||
|
||||
@@ -23,8 +23,7 @@ openDesk includes integration with Prometheus-based monitoring.
|
||||
|
||||
Together with [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack), you can easily leverage the full potential of the open-source cloud-native observability stack.
|
||||
|
||||
Before enabling the following options, you need to install the respective custom resource definitions (CRDs) from the kube-prometheus-stack
|
||||
repository or Prometheus operator.
|
||||
Before enabling the following options, you need to install the respective custom resource definitions (CRDs) from the kube-prometheus-stack repository which should at least include the Prometheus Operator.
|
||||
|
||||
# Defaults
|
||||
|
||||
@@ -33,14 +32,16 @@ All configurable options and their defaults can be found in
|
||||
|
||||
# Metrics
|
||||
|
||||
To deploy `podMonitor` and `serviceMonitor` custom resources, enable it by:
|
||||
To deploy `podMonitor` and `serviceMonitor` custom resources, enable them by:
|
||||
|
||||
```yaml
|
||||
prometheus:
|
||||
serviceMonitors:
|
||||
enabled: true
|
||||
podMonitors:
|
||||
enabled: true
|
||||
monitoring:
|
||||
prometheus:
|
||||
serviceMonitors:
|
||||
enabled: true
|
||||
podMonitors:
|
||||
enabled: true
|
||||
```
|
||||
```
|
||||
|
||||
# Alerts
|
||||
@@ -51,19 +52,23 @@ Some of these are created by our partners while others are defined in [opendesk-
|
||||
All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PrometheusRule) and can be enabled like this:
|
||||
|
||||
```yaml
|
||||
prometheus:
|
||||
prometheusRules:
|
||||
enabled: true
|
||||
monitoring:
|
||||
prometheus:
|
||||
prometheusRules:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
# Dashboards for Grafana
|
||||
|
||||
To deploy optional Grafana dashboards with ConfigMaps, enable the functionality with:
|
||||
If your Grafana instance is deployed via kube-prometheus-stack, or you have deployed the [Sidecar for datasources](https://github.com/grafana/helm-charts/blob/main/charts/grafana/README.md#sidecar-for-datasources), openDesk can make dashboards available via ConfigMap resources.
|
||||
|
||||
Enable the functionality with the following snippet:
|
||||
|
||||
```yaml
|
||||
grafana:
|
||||
dashboards:
|
||||
enabled: true
|
||||
monitoring:
|
||||
grafana:
|
||||
dashboards:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
Please find further details in the [related Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards).
|
||||
|
||||
@@ -29,14 +29,14 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
|
||||
- K8s cluster >= v1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
|
||||
- Domain and DNS Service
|
||||
- Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases)
|
||||
- [Helm](https://helm.sh/) >= v3.17.3, but not v3.18.0[^1]
|
||||
- [Helm](https://helm.sh/) >= v3.17.3 (but not v3.18.0[^1]) and < v4[^2],
|
||||
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0
|
||||
- [HelmDiff](https://github.com/databus23/helm-diff) >= v3.11.0
|
||||
- Volume provisioner supporting RWO (read-write-once)[^2]
|
||||
- Volume provisioner supporting RWO (read-write-once)[^3]
|
||||
- Certificate handling with [cert-manager](https://cert-manager.io/)
|
||||
|
||||
**Additional openDesk Enterprise requirements**
|
||||
- [OpenKruise](https://openkruise.io/)[^3] >= v1.6
|
||||
- [OpenKruise](https://openkruise.io/)[^4] >= v1.6
|
||||
|
||||
# Hardware
|
||||
|
||||
@@ -138,8 +138,11 @@ Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare
|
||||
|
||||
# Footnotes
|
||||
|
||||
[^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm 3.18.0 is not supported.
|
||||
[^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm v3.18.0 is not supported.
|
||||
|
||||
[^2]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail. E.g. the `local-path-provisioner` does not have sticky bit support.
|
||||
[^2]: Helm v4 introduced stricter flag grouping that is not yet supported by the helmdiff plugin.
|
||||
|
||||
[^3]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail. E.g. the `local-path-provisioner` does not have sticky bit support.
|
||||
|
||||
[^4]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
|
||||
|
||||
[^3]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
|
||||
|
||||
@@ -21,9 +21,10 @@ For more details on Chart validation, please visit: https://helm.sh/docs/topics/
|
||||
|
||||
All charts except the ones mentioned below are verifiable:
|
||||
|
||||
| Repository | Verifiable |
|
||||
|-------------------|:----------:|
|
||||
| open-xchange-repo | no |
|
||||
| Repository | Verifiable |
|
||||
| ------------------------- | :--------: |
|
||||
| collabora-controller-repo | no |
|
||||
| open-xchange-repo | no |
|
||||
|
||||
# Kubernetes security enforcements
|
||||
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-latest-tag
|
||||
labels:
|
||||
opendesk.eu/security-id: image-sec-001
|
||||
annotations:
|
||||
policies.kyverno.io/title: Disallow Latest Tag
|
||||
policies.kyverno.io/category: Best Practices
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/description: >-
|
||||
The ':latest' tag is mutable and can lead to unexpected errors if the
|
||||
image changes. A best practice is to use an immutable tag that maps to
|
||||
a specific version of an application Pod. This policy validates that the image
|
||||
specifies a tag and that it is not called `latest`.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: require-image-tag
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "An image tag is required."
|
||||
foreach:
|
||||
- list: "request.object.spec.containers"
|
||||
pattern:
|
||||
image: "*:*"
|
||||
- list: "request.object.spec.initContainers"
|
||||
pattern:
|
||||
image: "*:*"
|
||||
- list: "request.object.spec.ephemeralContainers"
|
||||
pattern:
|
||||
image: "*:*"
|
||||
- name: validate-image-tag
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Using a mutable image tag e.g. 'latest' is not allowed."
|
||||
foreach:
|
||||
- list: "request.object.spec.containers"
|
||||
pattern:
|
||||
image: "!*:latest"
|
||||
- list: "request.object.spec.initContainers"
|
||||
pattern:
|
||||
image: "!*:latest"
|
||||
- list: "request.object.spec.ephemeralContainers"
|
||||
pattern:
|
||||
image: "!*:latest"
|
||||
@@ -1,40 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-image-registries
|
||||
labels:
|
||||
opendesk.eu/security-id: image-sec-002
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict Image Registries
|
||||
policies.kyverno.io/category: Best Practices, EKS Best Practices
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
kyverno.io/kubernetes-version: "1.26"
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/description: >-
|
||||
Images from unknown, public registries can be of dubious quality and may not be
|
||||
scanned and secured, representing a high degree of risk. Requiring use of known, approved
|
||||
registries helps reduce threat exposure by ensuring image pulls only come from them. This
|
||||
policy validates that container images only originate from the registry `registry.opencode.de`.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: validate-registries
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Unknown image registry."
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- image: "registry.opencode.de/*"
|
||||
=(initContainers):
|
||||
- image: "registry.opencode.de/*"
|
||||
containers:
|
||||
- image: "registry.opencode.de/*"
|
||||
@@ -1,54 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: require-image-checksum
|
||||
labels:
|
||||
opendesk.eu/security-id: image-sec-003
|
||||
annotations:
|
||||
policies.kyverno.io/title: Require Images Use SHA-256 Checksums
|
||||
policies.kyverno.io/category: Supply Chain Security
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/description: >-
|
||||
Use of a SHA-256 checksum when pulling an image is often preferable because
|
||||
tags are mutable and can be overwritten. This policy checks to ensure that
|
||||
all images use SHA-256 digests in the format image@sha256:<64-character-hex>.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: require-image-checksum
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: >-
|
||||
Images must use SHA-256 checksums rather than tags.
|
||||
Expected format: registry/image:tag@sha256:<64-character-hex> or registry/image@sha256:<64-character-hex>
|
||||
foreach:
|
||||
- list: "request.object.spec.containers"
|
||||
deny:
|
||||
conditions:
|
||||
any:
|
||||
- key: "{{ regex_match('^.*@sha256:[a-f0-9]{64}$', element.image) }}"
|
||||
operator: NotEquals
|
||||
value: true
|
||||
- list: "request.object.spec.initContainers || `[]`"
|
||||
deny:
|
||||
conditions:
|
||||
any:
|
||||
- key: "{{ regex_match('^.*@sha256:[a-f0-9]{64}$', element.image) }}"
|
||||
operator: NotEquals
|
||||
value: true
|
||||
- list: "request.object.spec.ephemeralContainers || `[]`"
|
||||
deny:
|
||||
conditions:
|
||||
any:
|
||||
- key: "{{ regex_match('^.*@sha256:[a-f0-9]{64}$', element.image) }}"
|
||||
operator: NotEquals
|
||||
value: true
|
||||
@@ -1,40 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: verify-image
|
||||
labels:
|
||||
opendesk.eu/security-id: image-sec-004
|
||||
annotations:
|
||||
policies.kyverno.io/title: Verify Image
|
||||
policies.kyverno.io/category: Software Supply Chain Security, EKS Best Practices
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/minversion: 1.7.0
|
||||
policies.kyverno.io/description: >-
|
||||
Using the Cosign project, OCI images may be signed to ensure supply chain
|
||||
security is maintained. Those signatures can be verified before pulling into
|
||||
a cluster.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: false
|
||||
rules:
|
||||
- name: verify-image
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "registry.opencode.de/*"
|
||||
mutateDigest: true
|
||||
attestors:
|
||||
- entries:
|
||||
- keys:
|
||||
publicKeys: |
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXdVDz6n39PDj9ZezqYgmZ/qCDV4h
|
||||
bQwmuDfxix8BMRTZB9UHcOX4EgmAHWyXsbANB6tG8XWoqFpYRReNUvsG6g==
|
||||
-----END PUBLIC KEY-----
|
||||
@@ -1,53 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
###
|
||||
# TODO
|
||||
###
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: verify-sbom-cyclonedx
|
||||
labels:
|
||||
opendesk.eu/security-id: image-sec-005
|
||||
annotations:
|
||||
policies.kyverno.io/title: Verify CycloneDX SBOM (Keyless)
|
||||
policies.kyverno.io/category: Software Supply Chain Security
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/minversion: 1.8.3
|
||||
kyverno.io/kyverno-version: 1.9.0
|
||||
kyverno.io/kubernetes-version: "1.24"
|
||||
policies.kyverno.io/description: >-
|
||||
Software Bill of Materials (SBOM) provide details on the composition of a given
|
||||
container image and may be represented in a couple different standards.
|
||||
Having an SBOM can be important to ensuring images are built using verified
|
||||
processes. This policy verifies that an image has an SBOM in CycloneDX format
|
||||
and was signed by the expected subject and issuer when produced through GitHub Actions
|
||||
and using Cosign's keyless signing. It requires configuration based upon your own values.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: check-sbom
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "registry.opencode.de/*"
|
||||
attestations:
|
||||
- predicateType: https://cyclonedx.org/schema
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
subject: "mysubject"
|
||||
issuer: "https://token.actions.githubusercontent.com"
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{ Data.bomFormat }}"
|
||||
operator: Equals
|
||||
value: CycloneDX
|
||||
@@ -1,56 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
###
|
||||
# TODO
|
||||
###
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: verify-slsa-provenance-keyless
|
||||
labels:
|
||||
opendesk.eu/security-id: image-sec-006
|
||||
annotations:
|
||||
policies.kyverno.io/title: Verify SLSA Provenance (Keyless)
|
||||
policies.kyverno.io/category: Software Supply Chain Security
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/minversion: 1.8.3
|
||||
kyverno.io/kyverno-version: 1.9.0
|
||||
kyverno.io/kubernetes-version: "1.24"
|
||||
policies.kyverno.io/description: >-
|
||||
Provenance is used to identify how an artifact was produced
|
||||
and from where it originated. SLSA provenance is an industry-standard
|
||||
method of representing that provenance. This policy verifies that an
|
||||
image has SLSA provenance and was signed by the expected subject and issuer
|
||||
when produced through GitHub Actions.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: check-slsa-keyless
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "registry.opencode.de/*"
|
||||
attestations:
|
||||
- predicateType: https://slsa.dev/provenance/v0.2
|
||||
attestors:
|
||||
- count: 1
|
||||
entries:
|
||||
- keyless:
|
||||
subject: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v*"
|
||||
issuer: "https://token.actions.githubusercontent.com"
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
conditions:
|
||||
- all:
|
||||
# This expression uses a regex pattern to ensure the builder.id in the attestation is equal to the official
|
||||
# SLSA provenance generator workflow and uses a tagged release in semver format. If using a specific SLSA
|
||||
# provenance generation workflow, you may need to adjust the first input as necessary.
|
||||
- key: "{{ regex_match('^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9].[0-9].[0-9]$','{{ builder.id}}') }}"
|
||||
operator: Equals
|
||||
value: true
|
||||
@@ -1 +0,0 @@
|
||||
# TODO
|
||||
@@ -1,7 +0,0 @@
|
||||
## Image Security
|
||||
|
||||
...
|
||||
|
||||
### Status
|
||||
|
||||
{{ .image-sec.status }}
|
||||
@@ -1,42 +0,0 @@
|
||||
apiVersion: cli.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
name: image-sec
|
||||
policies:
|
||||
- image-sec-001_latest-tag.yaml
|
||||
- image-sec-002_trusted-registry.yaml
|
||||
- image-sec-003_digest.yaml
|
||||
- image-sec-004_signature.yaml
|
||||
- image-sec-005_sbom.yaml
|
||||
- image-sec-006_provenance.yaml
|
||||
resources:
|
||||
- ../../../rendered.yaml
|
||||
exceptions: []
|
||||
results:
|
||||
# image-sec-001
|
||||
- policy: disallow-latest-tag
|
||||
rule: require-image-tag
|
||||
result: pass
|
||||
- policy: disallow-latest-tag
|
||||
rule: validate-image-tag
|
||||
result: pass
|
||||
# image-sec-002
|
||||
- policy: restrict-image-registries
|
||||
rule: validate-registries
|
||||
result: pass
|
||||
# image-sec-003
|
||||
- policy: require-image-checksum
|
||||
rule: require-image-checksum
|
||||
result: pass
|
||||
# image-sec-004
|
||||
- policy: verify-image
|
||||
rule: verify-image
|
||||
result: pass
|
||||
# image-sec-005
|
||||
#- policy: verify-sbom-cyclonedx
|
||||
# rule: verify-sbom-cyclonedx
|
||||
# result: pass
|
||||
# image-sec-006
|
||||
#- policy: verify-slsa-provenance-keyless
|
||||
# rule: verify-slsa-provenance-keyless
|
||||
# result: pass
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: cli.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
name: net-mgt
|
||||
policies:
|
||||
- net-mgt-001_service-external-ips.yaml
|
||||
- net-mgt-002_service-node-port.yaml
|
||||
- net-mgt-003_ingress-host-match-tls.yaml
|
||||
resources:
|
||||
- ../../../rendered.yaml
|
||||
exceptions: []
|
||||
results:
|
||||
# net-mgt-001
|
||||
- policy: restrict-external-ips
|
||||
rule: check-ips
|
||||
result: pass
|
||||
# net-mgt-002
|
||||
- policy: restrict-nodeport
|
||||
rule: validate-nodeport
|
||||
result: pass
|
||||
# net-mgt-003
|
||||
- policy: ingress-host-match-tls
|
||||
rule: host-match-tls
|
||||
result: pass
|
||||
@@ -1,37 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-external-ips
|
||||
labels:
|
||||
opendesk.eu/security-id: net-mgt-001
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict External IPs
|
||||
policies.kyverno.io/category: Best Practices
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Service
|
||||
policies.kyverno.io/description: >-
|
||||
Service externalIPs can be used for a MITM attack (CVE-2020-8554).
|
||||
Restrict externalIPs or limit to a known set of addresses.
|
||||
See: https://github.com/kyverno/kyverno/issues/1367. This policy validates
|
||||
that the `externalIPs` field is not set on a Service.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: check-ips
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Service
|
||||
validate:
|
||||
message: "externalIPs are not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
# restrict external IP addresses
|
||||
# you can alternatively restrict to a known set of addresses using:
|
||||
# =(externalIPs): ["37.10.11.53", "153.10.20.1"]
|
||||
X(externalIPs): "null"
|
||||
@@ -1,35 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-nodeport
|
||||
labels:
|
||||
opendesk.eu/security-id: net-mgt-002
|
||||
annotations:
|
||||
policies.kyverno.io/title: Disallow NodePort
|
||||
policies.kyverno.io/category: Best Practices
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Service
|
||||
policies.kyverno.io/description: >-
|
||||
A Kubernetes Service of type NodePort uses a host port to receive traffic from
|
||||
any source. A NetworkPolicy cannot be used to control traffic to host ports.
|
||||
Although NodePort Services can be useful, their use must be limited to Services
|
||||
with additional upstream security checks. This policy validates that any new Services
|
||||
do not use the `NodePort` type.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: validate-nodeport
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Service
|
||||
validate:
|
||||
message: "Services of type NodePort are not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
=(type): "!NodePort"
|
||||
@@ -1,40 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: ingress-host-match-tls
|
||||
labels:
|
||||
opendesk.eu/security-id: net-mgt-003
|
||||
annotations:
|
||||
policies.kyverno.io/title: Ingress Host Match TLS
|
||||
policies.kyverno.io/category: Other
|
||||
policies.kyverno.io/severity: medium
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
kyverno.io/kubernetes-version: "1.20, 1.21"
|
||||
policies.kyverno.io/subject: Ingress
|
||||
policies.kyverno.io/description: >-
|
||||
Ingress resources which name a host name that is not present
|
||||
in the TLS section can produce ingress routing failures as a TLS
|
||||
certificate may not correspond to the destination host. This policy
|
||||
ensures that the host name in an Ingress rule is also found
|
||||
in the list of TLS hosts.
|
||||
spec:
|
||||
background: false
|
||||
validationFailureAction: Audit
|
||||
rules:
|
||||
- name: host-match-tls
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Ingress
|
||||
validate:
|
||||
message: "The host(s) in spec.rules[].host must match those in spec.tls[].hosts[]."
|
||||
deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: "{{ (request.object.spec.rules[].host || `[]`) | sort(@) }}"
|
||||
operator: AnyNotIn
|
||||
value: "{{ (request.object.spec.tls[].hosts[] || `[]`) | sort(@) }}"
|
||||
@@ -1,7 +0,0 @@
|
||||
## Network Management
|
||||
|
||||
...
|
||||
|
||||
### Status
|
||||
|
||||
{{ .net-mgt.status }}
|
||||
@@ -1,49 +0,0 @@
|
||||
apiVersion: cli.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
name: rbac-mgt
|
||||
policies:
|
||||
- rbac-mgt-001_automount-serviceaccount.yaml
|
||||
- rbac-mgt-002_binding-clusteradmin.yaml
|
||||
#- rbac-mgt-003_clusterrole.yaml
|
||||
- rbac-mgt-004_escalation-verbs.yaml
|
||||
- rbac-mgt-005_automount-sa-setting.yaml
|
||||
- rbac-mgt-006_secret-verbs.yaml
|
||||
- rbac-mgt-007_wildcard-verbs.yaml
|
||||
- rbac-mgt-008_wildcard-resources.yaml
|
||||
resources:
|
||||
- ../../../rendered.yaml
|
||||
exceptions: []
|
||||
results:
|
||||
# rbac-mgt-001
|
||||
- policy: restrict-automount-sa-token
|
||||
rule: validate-automountServiceAccountToken
|
||||
result: pass
|
||||
# rbac-mgt-002
|
||||
- policy: restrict-binding-clusteradmin
|
||||
rule: clusteradmin-bindings
|
||||
result: pass
|
||||
# rbac-mgt-003
|
||||
#- policy: restrict-binding-clusteradmin
|
||||
# rule: clusteradmin-bindings
|
||||
# result: pass
|
||||
# rbac-mgt-004
|
||||
- policy: restrict-escalation-verbs-roles
|
||||
rule: escalate
|
||||
result: pass
|
||||
# rbac-mgt-005
|
||||
- policy: restrict-sa-automount-sa-token
|
||||
rule: validate-sa-automountServiceAccountToken
|
||||
result: pass
|
||||
# rbac-mgt-006
|
||||
- policy: restrict-secret-role-verbs
|
||||
rule: secret-verbs
|
||||
result: pass
|
||||
# rbac-mgt-007
|
||||
- policy: restrict-wildcard-verbs
|
||||
rule: wildcard-verbs
|
||||
result: pass
|
||||
# rbac-mgt-008
|
||||
- policy: restrict-wildcard-resources
|
||||
rule: wildcard-resources
|
||||
result: pass
|
||||
@@ -1,35 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-automount-sa-token
|
||||
labels:
|
||||
opendesk.eu/security-id: rbac-mgt-001
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict Auto-Mount of Service Account Tokens
|
||||
policies.kyverno.io/category: Sample, EKS Best Practices
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod,ServiceAccount
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/description: >-
|
||||
Kubernetes automatically mounts ServiceAccount credentials in each Pod.
|
||||
The ServiceAccount may be assigned roles allowing Pods to access API resources.
|
||||
Blocking this ability is an extension of the least privilege best practice and should
|
||||
be followed if Pods do not need to speak to the API server to function.
|
||||
This policy ensures that mounting of these ServiceAccount tokens is blocked.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: validate-automountServiceAccountToken
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Auto-mounting of Service Account tokens is not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
automountServiceAccountToken: "false"
|
||||
@@ -1,37 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-binding-clusteradmin
|
||||
labels:
|
||||
opendesk.eu/security-id: rbac-mgt-002
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict Binding to Cluster-Admin
|
||||
policies.kyverno.io/category: Security
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: RoleBinding, ClusterRoleBinding, RBAC
|
||||
kyverno.io/kyverno-version: 1.6.2
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
kyverno.io/kubernetes-version: "1.23"
|
||||
policies.kyverno.io/description: >-
|
||||
The cluster-admin ClusterRole allows any action to be performed on any resource
|
||||
in the cluster and its granting should be heavily restricted. This
|
||||
policy prevents binding to the cluster-admin ClusterRole in
|
||||
RoleBinding or ClusterRoleBinding resources.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: clusteradmin-bindings
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- RoleBinding
|
||||
- ClusterRoleBinding
|
||||
validate:
|
||||
message: "Binding to cluster-admin is not allowed."
|
||||
pattern:
|
||||
roleRef:
|
||||
name: "!cluster-admin"
|
||||
@@ -1,2 +0,0 @@
|
||||
# No clusterrole allowed
|
||||
# TODO
|
||||
@@ -1,53 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-escalation-verbs-roles
|
||||
labels:
|
||||
opendesk.eu/security-id: rbac-mgt-004
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict Escalation Verbs in Roles
|
||||
policies.kyverno.io/category: Security
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Role, ClusterRole, RBAC
|
||||
kyverno.io/kyverno-version: 1.6.2
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
kyverno.io/kubernetes-version: "1.23"
|
||||
policies.kyverno.io/description: >-
|
||||
The verbs `impersonate`, `bind`, and `escalate` may all potentially lead to
|
||||
privilege escalation and should be tightly controlled. This policy prevents
|
||||
use of these verbs in Role or ClusterRole resources.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: escalate
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Role
|
||||
- ClusterRole
|
||||
validate:
|
||||
message: "Use of verbs `escalate`, `bind`, and `impersonate` are forbidden."
|
||||
foreach:
|
||||
- list: "request.object.rules[]"
|
||||
deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: "{{ element.apiGroups || '' }}"
|
||||
operator: AnyIn
|
||||
value:
|
||||
- rbac.authorization.k8s.io
|
||||
- key: "{{ element.resources || '' }}"
|
||||
operator: AnyIn
|
||||
value:
|
||||
- clusterroles
|
||||
- roles
|
||||
- key: "{{ element.verbs }}"
|
||||
operator: AnyIn
|
||||
value:
|
||||
- bind
|
||||
- escalate
|
||||
- impersonate
|
||||
@@ -1,35 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-sa-automount-sa-token
|
||||
labels:
|
||||
opendesk.eu/security-id: rbac-mgt-005
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict Auto-Mount of Service Account Tokens in Service Account
|
||||
policies.kyverno.io/category: Security
|
||||
kyverno.io/kyverno-version: 1.11.1
|
||||
kyverno.io/kubernetes-version: "1.27"
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Secret,ServiceAccount
|
||||
policies.kyverno.io/description: >-
|
||||
Kubernetes automatically mounts ServiceAccount credentials in each ServiceAccount.
|
||||
The ServiceAccount may be assigned roles allowing Pods to access API resources.
|
||||
Blocking this ability is an extension of the least privilege best practice and should
|
||||
be followed if Pods do not need to speak to the API server to function.
|
||||
This policy ensures that mounting of these ServiceAccount tokens is blocked.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: validate-sa-automountServiceAccountToken
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- ServiceAccount
|
||||
validate:
|
||||
message: "ServiceAccounts must set automountServiceAccountToken to false."
|
||||
pattern:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1,42 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-secret-role-verbs
|
||||
labels:
|
||||
opendesk.eu/security-id: rbac-mgt-006
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict Secret Verbs in Roles
|
||||
policies.kyverno.io/category: Security
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Role, ClusterRole, RBAC
|
||||
kyverno.io/kyverno-version: 1.6.2
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
kyverno.io/kubernetes-version: "1.23"
|
||||
policies.kyverno.io/description: >-
|
||||
The verbs `get`, `list`, and `watch` in a Role or ClusterRole, when paired with the Secrets resource, effectively
|
||||
allows Secrets to be read which may expose sensitive information. This policy prevents
|
||||
a Role or ClusterRole from using these verbs in tandem with Secret resources. In order to
|
||||
fully implement this control, it is recommended to pair this policy with another which
|
||||
also prevents use of the wildcard ('*') in the verbs list either when explicitly naming Secrets
|
||||
or when also using a wildcard in the base API group.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: secret-verbs
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Role
|
||||
- ClusterRole
|
||||
validate:
|
||||
message: "Requesting verbs `get`, `list`, or `watch` on Secrets is forbidden."
|
||||
deny:
|
||||
conditions:
|
||||
any:
|
||||
- key: ["get","list","watch"]
|
||||
operator: AnyIn
|
||||
value: "{{ request.object.rules[?resources.contains(@,'secrets')].verbs[] }}"
|
||||
@@ -1,41 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-wildcard-verbs
|
||||
labels:
|
||||
opendesk.eu/security-id: rbac-mgt-007
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict Wildcard in Verbs
|
||||
policies.kyverno.io/category: Security, EKS Best Practices
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Role, ClusterRole, RBAC
|
||||
kyverno.io/kyverno-version: 1.6.2
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
kyverno.io/kubernetes-version: "1.23"
|
||||
policies.kyverno.io/description: >-
|
||||
Wildcards ('*') in verbs grants all access to the resources referenced by it and
|
||||
does not follow the principal of least privilege. As much as possible,
|
||||
avoid such open verbs unless scoped to perhaps a custom API group.
|
||||
This policy blocks any Role or ClusterRole that contains a wildcard entry in
|
||||
the verbs list found in any rule.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: wildcard-verbs
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Role
|
||||
- ClusterRole
|
||||
validate:
|
||||
message: "Use of a wildcard ('*') in any verbs is forbidden."
|
||||
deny:
|
||||
conditions:
|
||||
any:
|
||||
- key: "{{ contains(to_array(request.object.rules[].verbs[]), '*') }}"
|
||||
operator: Equals
|
||||
value: true
|
||||
@@ -1,41 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-wildcard-resources
|
||||
labels:
|
||||
opendesk.eu/security-id: rbac-mgt-008
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict Wildcards in Resources
|
||||
policies.kyverno.io/category: Security, EKS Best Practices
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: ClusterRole, Role, RBAC
|
||||
kyverno.io/kyverno-version: 1.7.0
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
kyverno.io/kubernetes-version: "1.23"
|
||||
policies.kyverno.io/description: >-
|
||||
Wildcards ('*') in resources grants access to all of the resources referenced by
|
||||
the given API group and does not follow the principal of least privilege. As much as possible,
|
||||
avoid such open resources unless scoped to perhaps a custom API group.
|
||||
This policy blocks any Role or ClusterRole that contains a wildcard entry in
|
||||
the resources list found in any rule.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: wildcard-resources
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Role
|
||||
- ClusterRole
|
||||
validate:
|
||||
message: "Use of a wildcard ('*') in any resources is forbidden."
|
||||
deny:
|
||||
conditions:
|
||||
any:
|
||||
- key: "{{ contains(request.object.rules[].resources[], '*') }}"
|
||||
operator: Equals
|
||||
value: true
|
||||
@@ -1,7 +0,0 @@
|
||||
## Role Based Access Control (RBAC) Management
|
||||
|
||||
...
|
||||
|
||||
### Status
|
||||
|
||||
{{ .rbac-mgt.status }}
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: kyverno.io/v2
|
||||
kind: PolicyException
|
||||
metadata:
|
||||
name: postfix-exception
|
||||
namespace: opendesk
|
||||
spec:
|
||||
exceptions:
|
||||
- policyName: require-run-as-non-root-user
|
||||
ruleNames:
|
||||
- run-as-non-root-user
|
||||
- autogen-run-as-non-root-user
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Deployment
|
||||
namespaces:
|
||||
- opendesk
|
||||
names:
|
||||
- postfix
|
||||
@@ -1,66 +0,0 @@
|
||||
apiVersion: cli.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
name: sec-ctx
|
||||
policies:
|
||||
- sec-ctx-001_disallow-privileged-containers.yaml
|
||||
- sec-ctx-002_require-as-non-root.yaml
|
||||
- sec-ctx-003_run-as-user.yaml
|
||||
- sec-ctx-004_capabilities.yaml
|
||||
- sec-ctx-005_seccomp.yaml
|
||||
- sec-ctx-006_sysctl.yaml
|
||||
- sec-ctx-007_apparmor.yaml
|
||||
- sec-ctx-008_selinux.yaml
|
||||
- sec-ctx-009_proc-mount.yaml
|
||||
- sec-ctx-010_privilege-escalation.yaml
|
||||
resources:
|
||||
- ../../../rendered.yaml
|
||||
exceptions:
|
||||
- exceptions/postfix-exception.yaml
|
||||
results:
|
||||
# sec-ctx-001
|
||||
- policy: disallow-privileged-containers
|
||||
rule: privileged-containers
|
||||
result: pass
|
||||
# sec-ctx-002
|
||||
- policy: require-run-as-nonroot
|
||||
rule: run-as-non-root
|
||||
result: pass
|
||||
# sec-ctx-003
|
||||
- policy: require-run-as-non-root-user
|
||||
rule: run-as-non-root-user
|
||||
result: pass
|
||||
# sec-ctx-004
|
||||
- policy: disallow-capabilities-strict
|
||||
rule: require-drop-all
|
||||
result: pass
|
||||
- policy: disallow-capabilities-strict
|
||||
rule: adding-capabilities-strict
|
||||
result: pass
|
||||
# sec-ctx-005
|
||||
- policy: restrict-seccomp-strict
|
||||
rule: check-seccomp-strict
|
||||
result: pass
|
||||
# sec-ctx-006
|
||||
- policy: restrict-sysctls
|
||||
rule: check-sysctls
|
||||
result: pass
|
||||
# sec-ctx-007
|
||||
- policy: restrict-apparmor-profiles
|
||||
rule: app-armor
|
||||
result: pass
|
||||
# sec-ctx-008
|
||||
- policy: disallow-selinux
|
||||
rule: selinux-type
|
||||
result: pass
|
||||
- policy: disallow-selinux
|
||||
rule: selinux-user-role
|
||||
result: pass
|
||||
# sec-ctx-009
|
||||
- policy: disallow-proc-mount
|
||||
rule: check-proc-mount
|
||||
result: pass
|
||||
# sec-ctx-010
|
||||
- policy: disallow-privilege-escalation
|
||||
rule: privilege-escalation
|
||||
result: pass
|
||||
@@ -1,42 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-001
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: Privileged mode disables most security mechanisms
|
||||
and must not be allowed. This policy ensures Pods do not call for privileged
|
||||
mode.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Disallow Privileged Containers
|
||||
name: disallow-privileged-containers
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: privileged-containers
|
||||
validate:
|
||||
message: Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged,
|
||||
spec.initContainers[*].securityContext.privileged, and spec.ephemeralContainers[*].securityContext.privileged
|
||||
must be unset or set to `false`.
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- =(securityContext):
|
||||
=(privileged): "false"
|
||||
=(initContainers):
|
||||
- =(securityContext):
|
||||
=(privileged): "false"
|
||||
containers:
|
||||
- =(securityContext):
|
||||
=(privileged): "false"
|
||||
validationFailureAction: Audit
|
||||
@@ -1,56 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-002
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Restricted)
|
||||
policies.kyverno.io/description: Containers must be required to run as non-root
|
||||
users. This policy ensures `runAsNonRoot` is set to `true`. A known issue prevents
|
||||
a policy such as this using `anyPattern` from being persisted properly in Kubernetes
|
||||
1.23.0-1.23.2.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Require runAsNonRoot
|
||||
name: require-run-as-nonroot
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: run-as-non-root
|
||||
validate:
|
||||
anyPattern:
|
||||
- spec:
|
||||
=(ephemeralContainers):
|
||||
- =(securityContext):
|
||||
=(runAsNonRoot): "true"
|
||||
=(initContainers):
|
||||
- =(securityContext):
|
||||
=(runAsNonRoot): "true"
|
||||
containers:
|
||||
- =(securityContext):
|
||||
=(runAsNonRoot): "true"
|
||||
securityContext:
|
||||
runAsNonRoot: "true"
|
||||
- spec:
|
||||
=(ephemeralContainers):
|
||||
- securityContext:
|
||||
runAsNonRoot: "true"
|
||||
=(initContainers):
|
||||
- securityContext:
|
||||
runAsNonRoot: "true"
|
||||
containers:
|
||||
- securityContext:
|
||||
runAsNonRoot: "true"
|
||||
message: Running as root is not allowed. Either the field spec.securityContext.runAsNonRoot
|
||||
must be set to `true`, or the fields spec.containers[*].securityContext.runAsNonRoot,
|
||||
spec.initContainers[*].securityContext.runAsNonRoot, and spec.ephemeralContainers[*].securityContext.runAsNonRoot
|
||||
must be set to `true`.
|
||||
validationFailureAction: Audit
|
||||
@@ -1,45 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-003
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Restricted)
|
||||
policies.kyverno.io/description: Containers must be required to run as non-root
|
||||
users. This policy ensures `runAsUser` is either unset or set to a number greater
|
||||
than zero.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Require Run As Non-Root User
|
||||
name: require-run-as-non-root-user
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: run-as-non-root-user
|
||||
validate:
|
||||
message: Running as root is not allowed. The fields spec.securityContext.runAsUser,
|
||||
spec.containers[*].securityContext.runAsUser, spec.initContainers[*].securityContext.runAsUser,
|
||||
and spec.ephemeralContainers[*].securityContext.runAsUser must be unset or
|
||||
set to a number greater than zero.
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- =(securityContext):
|
||||
=(runAsUser): '>0'
|
||||
=(initContainers):
|
||||
- =(securityContext):
|
||||
=(runAsUser): '>0'
|
||||
=(securityContext):
|
||||
=(runAsUser): '>0'
|
||||
containers:
|
||||
- =(securityContext):
|
||||
=(runAsUser): '>0'
|
||||
validationFailureAction: Audit
|
||||
@@ -1,120 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-004
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: Adding capabilities beyond those listed in the
|
||||
policy must be disallowed.
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Disallow Capabilities
|
||||
name: disallow-capabilities
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: adding-capabilities
|
||||
preconditions:
|
||||
all:
|
||||
- key: '{{ request.operation || ''BACKGROUND'' }}'
|
||||
operator: NotEquals
|
||||
value: DELETE
|
||||
validate:
|
||||
deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: '{{ request.object.spec.[ephemeralContainers, initContainers, containers][].securityContext.capabilities.add[]
|
||||
}}'
|
||||
operator: AnyNotIn
|
||||
value:
|
||||
- AUDIT_WRITE
|
||||
- CHOWN
|
||||
- DAC_OVERRIDE
|
||||
- FOWNER
|
||||
- FSETID
|
||||
- KILL
|
||||
- MKNOD
|
||||
- NET_BIND_SERVICE
|
||||
- SETFCAP
|
||||
- SETGID
|
||||
- SETPCAP
|
||||
- SETUID
|
||||
- SYS_CHROOT
|
||||
message: Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN,
|
||||
DAC_OVERRIDE, FOWNER, FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID,
|
||||
SETPCAP, SETUID, SYS_CHROOT) are disallowed.
|
||||
validationFailureAction: Audit
|
||||
---
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-001
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Restricted)
|
||||
policies.kyverno.io/description: Adding capabilities other than `NET_BIND_SERVICE`
|
||||
is disallowed. In addition, all containers must explicitly drop `ALL` capabilities.
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Disallow Capabilities (Strict)
|
||||
name: disallow-capabilities-strict
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: require-drop-all
|
||||
preconditions:
|
||||
all:
|
||||
- key: '{{ request.operation || ''BACKGROUND'' }}'
|
||||
operator: NotEquals
|
||||
value: DELETE
|
||||
validate:
|
||||
foreach:
|
||||
- deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: ALL
|
||||
operator: AnyNotIn
|
||||
value: '{{ element.securityContext.capabilities.drop[] || `[]` }}'
|
||||
list: request.object.spec.[ephemeralContainers, initContainers, containers][]
|
||||
message: Containers must drop `ALL` capabilities.
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: adding-capabilities-strict
|
||||
preconditions:
|
||||
all:
|
||||
- key: '{{ request.operation || ''BACKGROUND'' }}'
|
||||
operator: NotEquals
|
||||
value: DELETE
|
||||
validate:
|
||||
foreach:
|
||||
- deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: '{{ element.securityContext.capabilities.add[] || `[]` }}'
|
||||
operator: AnyNotIn
|
||||
value:
|
||||
- NET_BIND_SERVICE
|
||||
- ""
|
||||
list: request.object.spec.[ephemeralContainers, initContainers, containers][]
|
||||
message: Any capabilities added other than NET_BIND_SERVICE are disallowed.
|
||||
validationFailureAction: Audit
|
||||
@@ -1,113 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-005
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: The seccomp profile must not be explicitly set
|
||||
to Unconfined. This policy, requiring Kubernetes v1.19 or later, ensures that
|
||||
seccomp is unset or set to `RuntimeDefault` or `Localhost`.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Restrict Seccomp
|
||||
name: restrict-seccomp
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: check-seccomp
|
||||
validate:
|
||||
message: Use of custom Seccomp profiles is disallowed. The fields spec.securityContext.seccompProfile.type,
|
||||
spec.containers[*].securityContext.seccompProfile.type, spec.initContainers[*].securityContext.seccompProfile.type,
|
||||
and spec.ephemeralContainers[*].securityContext.seccompProfile.type must be
|
||||
unset or set to `RuntimeDefault` or `Localhost`.
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- =(securityContext):
|
||||
=(seccompProfile):
|
||||
=(type): RuntimeDefault | Localhost
|
||||
=(initContainers):
|
||||
- =(securityContext):
|
||||
=(seccompProfile):
|
||||
=(type): RuntimeDefault | Localhost
|
||||
=(securityContext):
|
||||
=(seccompProfile):
|
||||
=(type): RuntimeDefault | Localhost
|
||||
containers:
|
||||
- =(securityContext):
|
||||
=(seccompProfile):
|
||||
=(type): RuntimeDefault | Localhost
|
||||
validationFailureAction: Audit
|
||||
---
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-005
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Restricted)
|
||||
policies.kyverno.io/description: The seccomp profile in the Restricted group must
|
||||
not be explicitly set to Unconfined but additionally must also not allow an
|
||||
unset value. This policy, requiring Kubernetes v1.19 or later, ensures that
|
||||
seccomp is set to `RuntimeDefault` or `Localhost`. A known issue prevents a
|
||||
policy such as this using `anyPattern` from being persisted properly in Kubernetes
|
||||
1.23.0-1.23.2.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Restrict Seccomp (Strict)
|
||||
name: restrict-seccomp-strict
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: check-seccomp-strict
|
||||
validate:
|
||||
anyPattern:
|
||||
- spec:
|
||||
=(ephemeralContainers):
|
||||
- =(securityContext):
|
||||
=(seccompProfile):
|
||||
=(type): RuntimeDefault | Localhost
|
||||
=(initContainers):
|
||||
- =(securityContext):
|
||||
=(seccompProfile):
|
||||
=(type): RuntimeDefault | Localhost
|
||||
containers:
|
||||
- =(securityContext):
|
||||
=(seccompProfile):
|
||||
=(type): RuntimeDefault | Localhost
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault | Localhost
|
||||
- spec:
|
||||
=(ephemeralContainers):
|
||||
- securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault | Localhost
|
||||
=(initContainers):
|
||||
- securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault | Localhost
|
||||
containers:
|
||||
- securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault | Localhost
|
||||
message: Use of custom Seccomp profiles is disallowed. The fields spec.securityContext.seccompProfile.type,
|
||||
spec.containers[*].securityContext.seccompProfile.type, spec.initContainers[*].securityContext.seccompProfile.type,
|
||||
and spec.ephemeralContainers[*].securityContext.seccompProfile.type must be
|
||||
set to `RuntimeDefault` or `Localhost`.
|
||||
validationFailureAction: Audit
|
||||
@@ -1,39 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-006
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: Sysctls can disable security mechanisms or affect
|
||||
all containers on a host, and should be disallowed except for an allowed "safe"
|
||||
subset. A sysctl is considered safe if it is namespaced in the container or
|
||||
the Pod, and it is isolated from other Pods or processes on the same Node. This
|
||||
policy ensures that only those "safe" subsets can be specified in a Pod.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Restrict sysctls
|
||||
name: restrict-sysctls
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: check-sysctls
|
||||
validate:
|
||||
message: Setting additional sysctls above the allowed type is disallowed. The
|
||||
field spec.securityContext.sysctls must be unset or not use any other names
|
||||
than kernel.shm_rmid_forced, net.ipv4.ip_local_port_range, net.ipv4.ip_unprivileged_port_start,
|
||||
net.ipv4.tcp_syncookies and net.ipv4.ping_group_range.
|
||||
pattern:
|
||||
spec:
|
||||
=(securityContext):
|
||||
=(sysctls):
|
||||
- =(name): kernel.shm_rmid_forced | net.ipv4.ip_local_port_range | net.ipv4.ip_unprivileged_port_start | net.ipv4.tcp_syncookies | net.ipv4.ping_group_range
|
||||
validationFailureAction: Audit
|
||||
@@ -1,38 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-007
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: On supported hosts, the 'runtime/default' AppArmor
|
||||
profile is applied by default. The default policy should prevent overriding
|
||||
or disabling the policy, or restrict overrides to an allowed set of profiles.
|
||||
This policy ensures Pods do not specify any other AppArmor profiles than `runtime/default`
|
||||
or `localhost/*`.
|
||||
policies.kyverno.io/minversion: 1.3.0
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod, Annotation
|
||||
policies.kyverno.io/title: Restrict AppArmor
|
||||
name: restrict-apparmor-profiles
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: app-armor
|
||||
validate:
|
||||
message: Specifying other AppArmor profiles is disallowed. The annotation `container.apparmor.security.beta.kubernetes.io`
|
||||
if defined must not be set to anything other than `runtime/default` or `localhost/*`.
|
||||
pattern:
|
||||
=(metadata):
|
||||
=(annotations):
|
||||
=(container.apparmor.security.beta.kubernetes.io/*): runtime/default |
|
||||
localhost/*
|
||||
validationFailureAction: Audit
|
||||
@@ -1,84 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-008
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: SELinux options can be used to escalate privileges
|
||||
and should not be allowed. This policy ensures that the `seLinuxOptions` field
|
||||
is undefined.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Disallow SELinux
|
||||
name: disallow-selinux
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: selinux-type
|
||||
validate:
|
||||
message: Setting the SELinux type is restricted. The fields spec.securityContext.seLinuxOptions.type,
|
||||
spec.containers[*].securityContext.seLinuxOptions.type, , spec.initContainers[*].securityContext.seLinuxOptions,
|
||||
and spec.ephemeralContainers[*].securityContext.seLinuxOptions.type must either
|
||||
be unset or set to one of the allowed values (container_t, container_init_t,
|
||||
or container_kvm_t).
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- =(securityContext):
|
||||
=(seLinuxOptions):
|
||||
=(type): container_t | container_init_t | container_kvm_t
|
||||
=(initContainers):
|
||||
- =(securityContext):
|
||||
=(seLinuxOptions):
|
||||
=(type): container_t | container_init_t | container_kvm_t
|
||||
=(securityContext):
|
||||
=(seLinuxOptions):
|
||||
=(type): container_t | container_init_t | container_kvm_t
|
||||
containers:
|
||||
- =(securityContext):
|
||||
=(seLinuxOptions):
|
||||
=(type): container_t | container_init_t | container_kvm_t
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: selinux-user-role
|
||||
validate:
|
||||
message: Setting the SELinux user or role is forbidden. The fields spec.securityContext.seLinuxOptions.user,
|
||||
spec.securityContext.seLinuxOptions.role, spec.containers[*].securityContext.seLinuxOptions.user,
|
||||
spec.containers[*].securityContext.seLinuxOptions.role, spec.initContainers[*].securityContext.seLinuxOptions.user,
|
||||
spec.initContainers[*].securityContext.seLinuxOptions.role, spec.ephemeralContainers[*].securityContext.seLinuxOptions.user,
|
||||
and spec.ephemeralContainers[*].securityContext.seLinuxOptions.role must be
|
||||
unset.
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- =(securityContext):
|
||||
=(seLinuxOptions):
|
||||
X(role): "null"
|
||||
X(user): "null"
|
||||
=(initContainers):
|
||||
- =(securityContext):
|
||||
=(seLinuxOptions):
|
||||
X(role): "null"
|
||||
X(user): "null"
|
||||
=(securityContext):
|
||||
=(seLinuxOptions):
|
||||
X(role): "null"
|
||||
X(user): "null"
|
||||
containers:
|
||||
- =(securityContext):
|
||||
=(seLinuxOptions):
|
||||
X(role): "null"
|
||||
X(user): "null"
|
||||
validationFailureAction: Audit
|
||||
@@ -1,44 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-009
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: The default /proc masks are set up to reduce
|
||||
attack surface and should be required. This policy ensures nothing but the default
|
||||
procMount can be specified. Note that in order for users to deviate from the
|
||||
`Default` procMount requires setting a feature gate at the API server.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Disallow procMount
|
||||
name: disallow-proc-mount
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: check-proc-mount
|
||||
validate:
|
||||
message: Changing the proc mount from the default is not allowed. The fields
|
||||
spec.containers[*].securityContext.procMount, spec.initContainers[*].securityContext.procMount,
|
||||
and spec.ephemeralContainers[*].securityContext.procMount must be unset or
|
||||
set to `Default`.
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- =(securityContext):
|
||||
=(procMount): Default
|
||||
=(initContainers):
|
||||
- =(securityContext):
|
||||
=(procMount): Default
|
||||
containers:
|
||||
- =(securityContext):
|
||||
=(procMount): Default
|
||||
validationFailureAction: Audit
|
||||
@@ -1,42 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: sec-ctx-010
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Restricted)
|
||||
policies.kyverno.io/description: Privilege escalation, such as via set-user-ID
|
||||
or set-group-ID file mode, should not be allowed. This policy ensures the `allowPrivilegeEscalation`
|
||||
field is set to `false`.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Disallow Privilege Escalation
|
||||
name: disallow-privilege-escalation
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: privilege-escalation
|
||||
validate:
|
||||
message: Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation,
|
||||
spec.initContainers[*].securityContext.allowPrivilegeEscalation, and spec.ephemeralContainers[*].securityContext.allowPrivilegeEscalation
|
||||
must be set to `false`.
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- securityContext:
|
||||
allowPrivilegeEscalation: "false"
|
||||
=(initContainers):
|
||||
- securityContext:
|
||||
allowPrivilegeEscalation: "false"
|
||||
containers:
|
||||
- securityContext:
|
||||
allowPrivilegeEscalation: "false"
|
||||
validationFailureAction: Audit
|
||||
@@ -1,18 +0,0 @@
|
||||
## Pod & Container Security Context
|
||||
|
||||
| ID | Description | References |
|
||||
|---|---|---|
|
||||
| SEC-CTX-001 | Pods must run non **privileged** only to prevent excessive rights and to make persistence and further escalation more difficult. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-002 | All Containers of a pod (containers, Init-Containers and Epehmeral-Containers) must run as non-root user (**runAsNonRoot**) to make persistence and further escalation more difficult. Given a justification and only if the necessary containers of the pod set this setting to false, while all other containers keep this setting set to true, this requirement may be violated. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-003 | All containers of a pod (containers, init-containers and ephemeral-containers) must not explicitly set runAsUser to 0 (root). The **runAsUser** field must either be undefined/null or set to a non-zero UID to ensure containers run with non-root privileges and reduce the risk of privilege escalation attacks. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-004 | All containers of a pod (containers, init-containers and ephemeral-containers) must drop `ALL` **capabilities** and may only add back the `NET_BIND_SERVICE` capability to follow the principle of least privilege and minimize the attack surface. This supports preventing containers from performing privileged system operations that could lead to container escape or host compromise. Given a justification, it is tolerated to add back the followingcapabilities: `AUDIT_WRITE`, `CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `MKNOD`, `SETFCAP`, `SETGID`, `SETPCAP`, `SETUID`, `SYS_CHROOT` | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-005 | All containers of a pod (containers, init-containers and ephemeral-containers) must have a **Seccomp** profile explicitly set to either `RuntimeDefault` or `Localhost` to restrict system calls and reduce the kernel attack surface. The Unconfined profile and absence of a profile are prohibited. Container-level `seccompProfile.type` fields may be undefined only if the pod-level `seccompProfile.type` is set appropriately, and conversely, the pod-level field may be undefined only if all container-level fields are set. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-006 | Pods must only use sysctls from an allowed safe list that are namespaced and isolated from other pods and processes on the same node. Only the following **sysctls** are permitted: `kernel.shm_rmid_forced`, `net.ipv4.ip_local_port_range`, `net.ipv4.ip_unprivileged_port_start`, `net.ipv4.tcp_syncookies`, `net.ipv4.ping_group_range`, `net.ipv4.ip_local_reserved_ports`, `net.ipv4.tcp_keepalive_time`, `net.ipv4.tcp_fin_timeout`, `net.ipv4.tcp_keepalive_intvl`, and `net.ipv4.tcp_keepalive_probes`. All other sysctls are prohibited as they can disable security mechanisms or affect all containers on the host. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-007 | On **AppArmor**-supported hosts, all containers of a pod (containers, init-containers and ephemeral-containers) must use the `RuntimeDefault` AppArmor profile or a locally defined profile (`Localhost`). The Unconfined profile is prohibited. Containers may only override the default AppArmor profile with `RuntimeDefault` or `Localhost` profiles. Undefined/nil values are permitted to inherit the runtime’s default behavior. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-008 | On **SELinux**-enabled hosts, all containers of a pod (containers, init-containers and ephemeral-containers) must only use approved SELinux types (`container_t`, `container_init_t`, `container_kvm_t`, or `container_engine_t`) and are prohibited from setting custom SELinux users or roles. The `seLinux-Options.user` and `seLinuxOptions.role` fields must remain undefined or empty to prevent privilege escalation through SELinux context manipulation. This ensures containers operate within predefined SELinux security boundaries. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-009 | All containers of a pod (containers, init-containers and ephemeral-containers) must use the default **`/proc`** mount type with standard masking to reduce the kernel attack surface. The `procMount` field must be either undefined/nil or explicitly set to `Default`. The Unmasked option is prohibited to prevent containers from accessing sensitive kernel information through `/proc` that could be used for container escape or information disclosure attacks. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| SEC-CTX-010 | All containers of a pod (containers, init-containers and ephemeral-containers) must set **`allowPrivilegeEscalation`** to false to prevent privilege escalation through setuid or setgid binaries. This blocks containers from gaining more privileges than their parent process and prevents exploitation of setuid/setgid executables that could lead to container escape or unauthorized privilege elevation. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
|
||||
### Status
|
||||
|
||||
{{ .sec-ctx.status }}
|
||||
@@ -1,77 +0,0 @@
|
||||
apiVersion: cli.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
name: wld-iso
|
||||
policies:
|
||||
- wld-iso-001_host-namespaces.yaml
|
||||
- wld-iso-002_hostpath-volumes.yaml
|
||||
- wld-iso-003_host-ports.yaml
|
||||
- wld-iso-004_host-probes.yaml
|
||||
- wld-iso-005_volume-types.yaml
|
||||
- wld-iso-006_cri-socket-mount.yaml
|
||||
- wld-iso-007_resource-requests-limits.yaml
|
||||
- wld-iso-008_emptydir-sizelimit.yaml
|
||||
- wld-iso-009_secrets-from-envs.yaml
|
||||
- wld-iso-010_controlplane-scheduling.yaml
|
||||
resources:
|
||||
- ../../../rendered.yaml
|
||||
exceptions: []
|
||||
results:
|
||||
# wld-iso-001
|
||||
- policy: disallow-host-namespaces
|
||||
rule: host-namespaces
|
||||
result: pass
|
||||
# wld-iso-002
|
||||
- policy: disallow-host-path
|
||||
rule: host-path
|
||||
result: pass
|
||||
# wld-iso-003
|
||||
- policy: disallow-host-ports
|
||||
rule: host-ports-none
|
||||
result: pass
|
||||
# wld-iso-004
|
||||
- policy: disallow-host-probes-lifecycle
|
||||
rule: host-probes-lifecycle
|
||||
result: pass
|
||||
# wld-iso-005
|
||||
- policy: restrict-volume-types
|
||||
rule: restricted-volumes
|
||||
result: pass
|
||||
# wld-iso-006
|
||||
- policy: disallow-container-sock-mounts
|
||||
rule: validate-docker-sock-mount
|
||||
result: pass
|
||||
- policy: disallow-container-sock-mounts
|
||||
rule: validate-containerd-sock-mount
|
||||
result: pass
|
||||
- policy: disallow-container-sock-mounts
|
||||
rule: validate-crio-sock-mount
|
||||
result: pass
|
||||
- policy: disallow-container-sock-mounts
|
||||
rule: validate-dockerd-sock-mount
|
||||
result: pass
|
||||
- policy: disallow-container-sock-mounts
|
||||
rule: validate-var-mount
|
||||
result: pass
|
||||
- policy: disallow-container-sock-mounts
|
||||
rule: validate-var-run-mount
|
||||
result: pass
|
||||
# wld-iso-007
|
||||
- policy: require-requests-limits
|
||||
rule: validate-resources
|
||||
result: pass
|
||||
# wld-iso-008
|
||||
- policy: require-emptydir-sizelimit
|
||||
rule: require-emptydir-sizelimit
|
||||
result: pass
|
||||
# wld-iso-009
|
||||
- policy: secrets-not-from-env-vars
|
||||
rule: secrets-not-from-env-vars
|
||||
result: pass
|
||||
# wld-iso-010
|
||||
- policy: restrict-controlplane-scheduling
|
||||
rule: restrict-controlplane-scheduling-master
|
||||
result: pass
|
||||
- policy: restrict-controlplane-scheduling
|
||||
rule: restrict-controlplane-scheduling-control-plane
|
||||
result: pass
|
||||
@@ -1,37 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-001
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: Host namespaces (Process ID namespace, Inter-Process
|
||||
Communication namespace, and network namespace) allow access to shared information
|
||||
and can be used to elevate privileges. Pods should not be allowed access to
|
||||
host namespaces. This policy ensures fields which make use of these host namespaces
|
||||
are unset or set to `false`.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Disallow Host Namespaces
|
||||
name: disallow-host-namespaces
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: host-namespaces
|
||||
validate:
|
||||
message: Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
|
||||
spec.hostIPC, and spec.hostPID must be unset or set to `false`.
|
||||
pattern:
|
||||
spec:
|
||||
=(hostIPC): "false"
|
||||
=(hostNetwork): "false"
|
||||
=(hostPID): "false"
|
||||
validationFailureAction: Audit
|
||||
@@ -1,35 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-002
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: HostPath volumes let Pods use host directories
|
||||
and volumes in containers. Using host resources can be used to access shared
|
||||
data or escalate privileges and should not be allowed. This policy ensures no
|
||||
hostPath volumes are in use.
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod,Volume
|
||||
policies.kyverno.io/title: Disallow hostPath
|
||||
name: disallow-host-path
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: host-path
|
||||
validate:
|
||||
message: HostPath volumes are forbidden. The field spec.volumes[*].hostPath
|
||||
must be unset.
|
||||
pattern:
|
||||
spec:
|
||||
=(volumes):
|
||||
- X(hostPath): "null"
|
||||
validationFailureAction: Audit
|
||||
@@ -1,42 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-003
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Baseline)
|
||||
policies.kyverno.io/description: 'Access to host ports allows potential snooping
|
||||
of network traffic and should not be allowed, or at minimum restricted to a
|
||||
known list. This policy ensures the `hostPort` field is unset or set to `0`. '
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/title: Disallow hostPorts
|
||||
name: disallow-host-ports
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: host-ports-none
|
||||
validate:
|
||||
message: Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort
|
||||
, spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
|
||||
must either be unset or set to `0`.
|
||||
pattern:
|
||||
spec:
|
||||
=(ephemeralContainers):
|
||||
- =(ports):
|
||||
- =(hostPort): 0
|
||||
=(initContainers):
|
||||
- =(ports):
|
||||
- =(hostPort): 0
|
||||
containers:
|
||||
- =(ports):
|
||||
- =(hostPort): 0
|
||||
validationFailureAction: Audit
|
||||
@@ -1,115 +0,0 @@
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-host-probes-lifecycle
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-004
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/title: Disallow Host in Probes and Lifecycle Hooks
|
||||
policies.kyverno.io/category: Pod Security Standards (Restricted)
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/description: >-
|
||||
The host field in probes and lifecycle hooks allows bypassing network
|
||||
policies by directing traffic to arbitrary hosts. This policy ensures
|
||||
that the host field in livenessProbe, readinessProbe, startupProbe,
|
||||
and lifecycle hooks (postStart/preStop) is either undefined or empty
|
||||
for both containers and initContainers.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: host-probes-lifecycle
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: >-
|
||||
The host field in probes and lifecycle hooks must be undefined or empty.
|
||||
pattern:
|
||||
spec:
|
||||
=(initContainers):
|
||||
- =(livenessProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(readinessProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(startupProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(lifecycle):
|
||||
=(postStart):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(preStop):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(ephemeralContainers):
|
||||
- =(livenessProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(readinessProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(startupProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(lifecycle):
|
||||
=(postStart):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(preStop):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(containers):
|
||||
- =(livenessProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(readinessProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(startupProbe):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(lifecycle):
|
||||
=(postStart):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
=(preStop):
|
||||
=(httpGet):
|
||||
=(host): ""
|
||||
=(tcpSocket):
|
||||
=(host): ""
|
||||
@@ -1,53 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-005
|
||||
annotations:
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/category: Pod Security Standards (Restricted)
|
||||
policies.kyverno.io/description: In addition to restricting HostPath volumes,
|
||||
the restricted pod security profile limits usage of non-core volume types to
|
||||
those defined through PersistentVolumes. This policy blocks any other type of
|
||||
volume other than those in the allow list.
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod,Volume
|
||||
policies.kyverno.io/title: Restrict Volume Types
|
||||
name: restrict-volume-types
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
- match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
name: restricted-volumes
|
||||
preconditions:
|
||||
all:
|
||||
- key: '{{ request.operation || ''BACKGROUND'' }}'
|
||||
operator: NotEquals
|
||||
value: DELETE
|
||||
validate:
|
||||
deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: '{{ request.object.spec.volumes[].keys(@)[] || '''' }}'
|
||||
operator: AnyNotIn
|
||||
value:
|
||||
- name
|
||||
- configMap
|
||||
- csi
|
||||
- downwardAPI
|
||||
- emptyDir
|
||||
- ephemeral
|
||||
- persistentVolumeClaim
|
||||
- projected
|
||||
- secret
|
||||
- ""
|
||||
message: 'Only the following types of volumes may be used: configMap, csi, downwardAPI,
|
||||
emptyDir, ephemeral, persistentVolumeClaim, projected, and secret.'
|
||||
validationFailureAction: Audit
|
||||
@@ -1,101 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: disallow-container-sock-mounts
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-006
|
||||
annotations:
|
||||
policies.kyverno.io/title: Disallow CRI socket mounts
|
||||
policies.kyverno.io/category: Best Practices, EKS Best Practices
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/description: >-
|
||||
Container daemon socket bind mounts allows access to the container engine on the
|
||||
node. This access can be used for privilege escalation and to manage containers
|
||||
outside of Kubernetes, and hence should not be allowed. This policy validates that
|
||||
the sockets used for CRI engines Docker, Containerd, and CRI-O are not used.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: validate-docker-sock-mount
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Use of the Docker Unix socket is not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
=(volumes):
|
||||
- =(hostPath):
|
||||
path: "!/var/run/docker.sock"
|
||||
- name: validate-containerd-sock-mount
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Use of the Containerd Unix socket is not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
=(volumes):
|
||||
- =(hostPath):
|
||||
path: "!/var/run/containerd/containerd.sock"
|
||||
- name: validate-crio-sock-mount
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Use of the CRI-O Unix socket is not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
=(volumes):
|
||||
- =(hostPath):
|
||||
path: "!/var/run/crio/crio.sock"
|
||||
- name: validate-dockerd-sock-mount
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Use of the Docker CRI socket is not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
=(volumes):
|
||||
- =(hostPath):
|
||||
path: "!/var/run/cri-dockerd.sock"
|
||||
- name: validate-var-mount
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Mounting /var is not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
=(volumes):
|
||||
- =(hostPath):
|
||||
path: "!/var"
|
||||
- name: validate-var-run-mount
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Mounting /var/run is not allowed."
|
||||
pattern:
|
||||
spec:
|
||||
=(volumes):
|
||||
- =(hostPath):
|
||||
path: "!/var/run"
|
||||
@@ -1,56 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: require-requests-limits
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-007
|
||||
annotations:
|
||||
policies.kyverno.io/title: Require Limits and Requests
|
||||
policies.kyverno.io/category: Best Practices, EKS Best Practices
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/description: >-
|
||||
As application workloads share cluster resources, it is important to limit resources
|
||||
requested and consumed by each Pod. It is recommended to require resource requests and
|
||||
limits per Pod, especially for memory and CPU. If a Namespace level request or limit is specified,
|
||||
defaults will automatically be applied to each Pod based on the LimitRange configuration.
|
||||
This policy validates that all containers have something specified for memory and CPU
|
||||
requests and memory limits.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: validate-resources
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "CPU and memory resource requests and memory limits are required for containers."
|
||||
pattern:
|
||||
spec:
|
||||
containers:
|
||||
- resources:
|
||||
requests:
|
||||
memory: "?*"
|
||||
cpu: "?*"
|
||||
limits:
|
||||
memory: "?*"
|
||||
=(initContainers):
|
||||
- resources:
|
||||
requests:
|
||||
memory: "?*"
|
||||
cpu: "?*"
|
||||
limits:
|
||||
memory: "?*"
|
||||
=(ephemeralContainers):
|
||||
- resources:
|
||||
requests:
|
||||
memory: "?*"
|
||||
cpu: "?*"
|
||||
limits:
|
||||
memory: "?*"
|
||||
@@ -1,36 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: require-emptydir-sizelimit
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-008
|
||||
annotations:
|
||||
policies.kyverno.io/title: Require emptyDir sizeLimit
|
||||
policies.kyverno.io/category: Best Practices
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod, Volume
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/description: >-
|
||||
When a Pod requests an emptyDir, by default it does not have a size limit which
|
||||
may allow it to consume excess or all of the space in the medium backing the volume.
|
||||
This can quickly overrun a Node and may result in a denial of service for other
|
||||
workloads. This policy requires that all emptyDir volumes have a sizeLimit set.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: require-emptydir-sizelimit
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "All emptyDir volumes must have a sizeLimit set."
|
||||
pattern:
|
||||
spec:
|
||||
=(volumes):
|
||||
- =(emptyDir):
|
||||
sizeLimit: "?*"
|
||||
@@ -1,50 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: secrets-not-from-env-vars
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-009
|
||||
annotations:
|
||||
policies.kyverno.io/title: Disallow Secrets from Env Vars
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod, Secret
|
||||
kyverno.io/kyverno-version: 1.6.0
|
||||
policies.kyverno.io/description: >-
|
||||
Secrets used as environment variables containing sensitive information may, if not carefully controlled,
|
||||
be printed in log output which could be visible to unauthorized people and captured in forwarding
|
||||
applications. This policy disallows using Secrets as environment variables.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: secrets-not-from-env-vars
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Secrets must be mounted as volumes, not as environment variables."
|
||||
pattern:
|
||||
spec:
|
||||
containers:
|
||||
- name: "*"
|
||||
=(env):
|
||||
- =(valueFrom):
|
||||
X(secretKeyRef): "null"
|
||||
- name: secrets-not-from-envfrom
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Secrets must not come from envFrom statements."
|
||||
pattern:
|
||||
spec:
|
||||
containers:
|
||||
- name: "*"
|
||||
=(envFrom):
|
||||
- X(secretRef): "null"
|
||||
@@ -1,46 +0,0 @@
|
||||
# Source: https://github.com/kyverno/policies/tree/main/pod-security
|
||||
# License: Apache-2.0
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: restrict-controlplane-scheduling
|
||||
labels:
|
||||
opendesk.eu/security-id: wld-iso-010
|
||||
annotations:
|
||||
policies.kyverno.io/title: Restrict control plane scheduling
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/minversion: 1.6.0
|
||||
policies.kyverno.io/description: >-
|
||||
Scheduling non-system Pods to control plane nodes (which run kubelet) is often undesirable
|
||||
because it takes away resources from the control plane components and can represent
|
||||
a possible security threat vector. This policy prevents users from setting a toleration
|
||||
in a Pod spec which allows running on control plane nodes
|
||||
with the taint key `node-role.kubernetes.io/master`.
|
||||
spec:
|
||||
validationFailureAction: Audit
|
||||
background: true
|
||||
rules:
|
||||
- name: restrict-controlplane-scheduling-master
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: Pods may not use tolerations which schedule on control plane nodes.
|
||||
pattern:
|
||||
spec:
|
||||
=(tolerations):
|
||||
- key: "!node-role.kubernetes.io/master"
|
||||
- name: restrict-controlplane-scheduling-control-plane
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: Pods may not use tolerations which schedule on control plane nodes.
|
||||
pattern:
|
||||
spec:
|
||||
=(tolerations):
|
||||
- key: "!node-role.kubernetes.io/control-plane"
|
||||
@@ -1,14 +0,0 @@
|
||||
## Workload Isolation and Configuration
|
||||
|
||||
| ID | Description | References |
|
||||
|---|---|---|
|
||||
| WLD-ISO-001 | Pods must not share **host namespaces** (`hostNetwork`, `hostPID`, `hostIPC`). These fields must be undefined/nil or explicitly set to false to prevent containers from accessing host network interfaces, process trees, or inter-process communication mechanisms, which could lead to container escape or unauthorized access to host resources. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| WLD-ISO-002 | **HostPath volumes** must be forbidden (`spec.volumes[*].hostPath` must be undefined/nil) to prevent containers from mounting directories from the host filesystem, which could enable unauthorized access to sensitive host files, container escape, or persistence mechanisms on the node. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| WLD-ISO-003 | **Host ports** must be disallowed. The `hostPort` field in all containers (containers, init-containers, and ephemeral-containers) must be undefined/nil or set to 0 to prevent bypassing network policies and exposing services directly on the host network interface, which could lead to unauthorized access or port conflicts. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| WLD-ISO-004 | The **host field in probes and lifecycle hooks** must be undefined/nil or empty string for all containers (containers and init-containers). This prevents probes and hooks from targeting the host network directly, maintaining proper network isolation between containers and the host system. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
| WLD-VOL-001 | Pods must only use **approved volume types** that maintain security boundaries. Permitted volume types are: `configMap`, `csi`, `downwardAPI`, `emptyDir`, `ephemeral`, `persistentVolumeClaim`, `projected`, and `secret`. All other volume types, particularly those that break isolation boundaries (`hostPath`, etc.), are prohibited to prevent unauthorized access to host resources or external systems. | K8s-PSS, BSI-SYS-1-6, OWASP-K8s, NIST-SP, NSA-Hardening |
|
||||
|
||||
|
||||
### Status
|
||||
|
||||
{{ .wld-iso.status }}
|
||||
@@ -248,9 +248,9 @@ jitsi:
|
||||
{{ .Values.resources.jvb | toYaml | nindent 6 }}
|
||||
service:
|
||||
type: {{ coalesce .Values.service.type.jitsiVideoBridge .Values.cluster.service.type | quote }}
|
||||
{{- if .Values.annotations.jitsiJvb.service }}
|
||||
{{- if .Values.annotations.jitsiJvb.serviceExternal }}
|
||||
annotations:
|
||||
{{ .Values.annotations.jitsiJvb.service | toYaml | nindent 8 }}
|
||||
{{ .Values.annotations.jitsiJvb.serviceExternal | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
@@ -140,6 +140,8 @@ service:
|
||||
{{ .Values.annotations.openxchangeDovecot.service | toYaml | nindent 4 }}
|
||||
external:
|
||||
enabled: true
|
||||
annotations:
|
||||
{{ .Values.annotations.openxchangeDovecot.serviceExternal | toYaml | nindent 6 }}
|
||||
type: {{ coalesce .Values.service.type.dovecot .Values.cluster.service.type | quote }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -64,11 +64,14 @@ postfix:
|
||||
password:
|
||||
value: {{ .Values.smtp.password }}
|
||||
smtpSASLAuthEnable: "yes"
|
||||
{{- else }}
|
||||
smtpSASLAuthEnable: "no"
|
||||
{{- end }}
|
||||
allowRelayNets: false
|
||||
smtpTLSSecurityLevel: "encrypt"
|
||||
smtpdSASLAuthEnable: "yes"
|
||||
smtpdSASLSecurityOptions: "noanonymous"
|
||||
smtpdSASLSecurityOptions: {{ .Values.smtp.security.smtpdSASLSecurityOptions | join ", " | quote }}
|
||||
smtpSASLSecurityOptions: {{ .Values.smtp.security.smtpSASLSecurityOptions | join ", " | quote }}
|
||||
smtpdSASLType: "dovecot"
|
||||
smtpdTLSSecurityLevel: "encrypt"
|
||||
smtpdTLSCertFile: "/etc/tls/tls.crt"
|
||||
@@ -78,6 +81,25 @@ postfix:
|
||||
staticAuthDB:
|
||||
enabled: false
|
||||
|
||||
ldapTransportMaps: []
|
||||
|
||||
ldapVirtualAliasMaps:
|
||||
- host: "ums-ldap-server"
|
||||
scheme: "ldap"
|
||||
port: 389
|
||||
baseDn: "{{ .Values.ldap.baseDn }}"
|
||||
bindDn: "uid=ldapsearch_postfix,cn=users,{{ .Values.ldap.baseDn }}"
|
||||
password:
|
||||
value: {{ .Values.secrets.nubus.ldapSearch.postfix | quote }}
|
||||
# ldap filter to find groups with mail address
|
||||
queryFilter: "(&(|(objectClass=univentionMailList)(objectClass=posixGroup))(|(mailPrimaryAddress=%s)(mailAlternativeAddress=%s)))"
|
||||
# -- use this attribute if the query already returns email addresses of members and no recursive lookup needs to be done
|
||||
resultAttribute: ""
|
||||
# -- do a recursive search on the specified attribute if found, should be a DN
|
||||
specialResultAttribute: "uniqueMember"
|
||||
# -- return the following attribute from all found leaves when a recursive search is done
|
||||
leafResultAttribute: "mailPrimaryAddress"
|
||||
|
||||
{{- if .Values.antivirus.milter.host }}
|
||||
smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
|
||||
{{- else }}
|
||||
@@ -107,6 +129,8 @@ service:
|
||||
{{ .Values.annotations.openxchangePostfix.service | toYaml | nindent 4 }}
|
||||
external:
|
||||
enabled: true
|
||||
annotations:
|
||||
{{ .Values.annotations.openxchangePostfix.serviceExternal | toYaml | nindent 6 }}
|
||||
type: {{ coalesce .Values.service.type.postfix .Values.cluster.service.type | quote }}
|
||||
{{- end }}
|
||||
...
|
||||
|
||||
@@ -28,7 +28,7 @@ clamd:
|
||||
podAnnotations:
|
||||
intents.otterize.com/service-name: "clamav-distributed"
|
||||
{{- with .Values.annotations.servicesExternalClamavDistributed.clamdPod }}
|
||||
{{ . | toYaml | nindent 4 }}
|
||||
{{ . | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
|
||||
@@ -46,7 +46,7 @@ persistence:
|
||||
podAnnotations:
|
||||
intents.otterize.com/service-name: "clamav-simple"
|
||||
{{- with .Values.annotations.servicesExternalClamavSimple.pod }}
|
||||
{{ . | toYaml | nindent 2 }}
|
||||
{{ . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
podSecurityContext:
|
||||
|
||||
@@ -32,7 +32,7 @@ image:
|
||||
podAnnotations:
|
||||
intents.otterize.com/service-name: "dkimpy-milter"
|
||||
{{- with .Values.annotations.servicesExternalDkimpy.service }}
|
||||
{{ . | toYaml | nindent 2 }}
|
||||
{{ . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
podSecurityContext:
|
||||
|
||||
@@ -36,7 +36,7 @@ image:
|
||||
podAnnotations:
|
||||
intents.otterize.com/service-name: "memcached"
|
||||
{{- with .Values.annotations.servicesExternalMemcached.pod }}
|
||||
{{ . | toYaml | nindent 2 }}
|
||||
{{ . | toYaml | nindent 2 }}
|
||||
{{- end}}
|
||||
replicaCount: {{ .Values.replicas.memcached }}
|
||||
|
||||
|
||||
@@ -136,7 +136,7 @@ provisioning:
|
||||
podAnnotations:
|
||||
intents.otterize.com/service-name: "minio-provisioning"
|
||||
{{- with .Values.annotations.servicesExternalMinio.provisioningPod }}
|
||||
{{ . | toYaml | nindent 4}}
|
||||
{{ . | toYaml | nindent 4}}
|
||||
{{- end }}
|
||||
policies:
|
||||
- name: "migrations-bucket-policy"
|
||||
|
||||
@@ -72,6 +72,8 @@ postfix:
|
||||
password:
|
||||
value: {{ .Values.smtp.password }}
|
||||
smtpSASLAuthEnable: "yes"
|
||||
{{- else }}
|
||||
smtpSASLAuthEnable: "no"
|
||||
{{- end }}
|
||||
# Warning: This setting allows unauthenticated mail relay from relayNets!
|
||||
allowRelayNets: true
|
||||
@@ -80,7 +82,8 @@ postfix:
|
||||
smtpdTLSMandatoryCiphers: "medium"
|
||||
smtpTLSSecurityLevel: "encrypt"
|
||||
smtpdSASLAuthEnable: "yes"
|
||||
smtpdSASLSecurityOptions: "noanonymous"
|
||||
smtpdSASLSecurityOptions: {{ .Values.smtp.security.smtpdSASLSecurityOptions | join ", " | quote }}
|
||||
smtpSASLSecurityOptions: {{ .Values.smtp.security.smtpSASLSecurityOptions | join ", " | quote }}
|
||||
smtpdSASLType: "cyrus"
|
||||
smtpdTLSSecurityLevel: "may"
|
||||
smtpdTLSCertFile: "/etc/tls/tls.crt"
|
||||
@@ -94,6 +97,25 @@ postfix:
|
||||
password:
|
||||
value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
|
||||
|
||||
ldapTransportMaps: []
|
||||
|
||||
ldapVirtualAliasMaps:
|
||||
- host: "ums-ldap-server"
|
||||
scheme: "ldap"
|
||||
port: 389
|
||||
baseDn: "{{ .Values.ldap.baseDn }}"
|
||||
bindDn: "uid=ldapsearch_postfix,cn=users,{{ .Values.ldap.baseDn }}"
|
||||
password:
|
||||
value: {{ .Values.secrets.nubus.ldapSearch.postfix | quote }}
|
||||
# ldap filter to find groups with mail address
|
||||
queryFilter: "(&(|(objectClass=univentionMailList)(objectClass=posixGroup))(|(mailPrimaryAddress=%s)(mailAlternativeAddress=%s)))"
|
||||
# -- use this attribute if the query already returns email addresses of members and no recursive lookup needs to be done
|
||||
resultAttribute: ""
|
||||
# -- do a recursive search on the specified attribute if found, should be a DN
|
||||
specialResultAttribute: "uniqueMember"
|
||||
# -- return the following attribute from all found leaves when a recursive search is done
|
||||
leafResultAttribute: "mailPrimaryAddress"
|
||||
|
||||
{{- if .Values.antivirus.milter.host }}
|
||||
smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
|
||||
{{- else }}
|
||||
|
||||
@@ -67,6 +67,9 @@ job:
|
||||
- username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
|
||||
password: {{ .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.umsGuardianManagementApi.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
- username: {{ .Values.databases.umsAuthSession.username | quote }}
|
||||
password: {{ .Values.secrets.postgresql.umsAuthSessionUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.umsAuthSession.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
- username: {{ .Values.databases.umsSelfservice.username | quote }}
|
||||
password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.umsSelfservice.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
@@ -96,6 +99,8 @@ job:
|
||||
user: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
|
||||
- name: {{ .Values.databases.umsNotificationsApi.name | quote }}
|
||||
user: {{ .Values.databases.umsNotificationsApi.username | quote }}
|
||||
- name: {{ .Values.databases.umsAuthSession.name | quote }}
|
||||
user: {{ .Values.databases.umsAuthSession.username | quote }}
|
||||
- name: {{ .Values.databases.umsSelfservice.name | quote }}
|
||||
user: {{ .Values.databases.umsSelfservice.username | quote }}
|
||||
{{ if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
|
||||
|
||||
@@ -6,7 +6,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
|
||||
name: "dovecot"
|
||||
version: "3.2.1"
|
||||
version: "3.3.0"
|
||||
verify: true
|
||||
oxAppSuite:
|
||||
registry: "registry.opencode.de"
|
||||
|
||||
@@ -95,7 +95,7 @@ annotations:
|
||||
serviceAccount: ~
|
||||
jitsiJvb:
|
||||
pod: ~
|
||||
service: ~
|
||||
serviceExternal: ~
|
||||
metricsPrometheus: ~
|
||||
metricsGrafana: ~
|
||||
jitsiProsody:
|
||||
@@ -360,6 +360,7 @@ annotations:
|
||||
pod: ~
|
||||
service: ~
|
||||
serviceAccount: ~
|
||||
serviceExternal: ~
|
||||
openxchangeEnterpriseContactPicker:
|
||||
appsuiteCoreMw:
|
||||
appsuiteCoreMwPod: ~
|
||||
@@ -369,6 +370,7 @@ annotations:
|
||||
openxchangePostfix:
|
||||
pod: ~
|
||||
service: ~
|
||||
serviceExternal: ~
|
||||
openxchangePublicSectorUi:
|
||||
pod: ~
|
||||
servicesExternalClamavDistributed:
|
||||
|
||||
@@ -97,7 +97,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot"
|
||||
name: "dovecot"
|
||||
version: "3.2.1"
|
||||
version: "3.3.0"
|
||||
verify: true
|
||||
element:
|
||||
# providerCategory: "Platform"
|
||||
@@ -139,7 +139,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
|
||||
name: "intercom-service"
|
||||
version: "2.19.5"
|
||||
version: "2.22.0"
|
||||
verify: true
|
||||
jitsi:
|
||||
# providerCategory: "Platform"
|
||||
@@ -149,7 +149,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
|
||||
name: "opendesk-jitsi"
|
||||
version: "3.3.2"
|
||||
version: "3.4.0"
|
||||
verify: true
|
||||
mariadb:
|
||||
# providerCategory: "Platform"
|
||||
@@ -361,7 +361,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-static-files"
|
||||
name: "opendesk-static-files"
|
||||
version: "4.1.0"
|
||||
version: "4.1.1"
|
||||
verify: true
|
||||
openproject:
|
||||
# providerCategory: "Supplier"
|
||||
@@ -437,7 +437,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
|
||||
name: "postfix"
|
||||
version: "5.0.1"
|
||||
version: "5.1.0"
|
||||
verify: true
|
||||
postgresql:
|
||||
# providerCategory: "Platform"
|
||||
@@ -536,5 +536,5 @@ charts:
|
||||
repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
|
||||
name: "xwiki"
|
||||
version: "1.4.4"
|
||||
verify: false
|
||||
verify: true
|
||||
...
|
||||
|
||||
@@ -3,5 +3,5 @@
|
||||
---
|
||||
global:
|
||||
systemInformation:
|
||||
releaseVersion: "v1.9.0"
|
||||
releaseVersion: "v1.10.0"
|
||||
...
|
||||
|
||||
@@ -15,7 +15,7 @@ global:
|
||||
#
|
||||
mailDomain: {{ env "MAIL_DOMAIN" | quote }}
|
||||
|
||||
## Define additional mail domains, comma separated, e.g. domain1.de,domain2.de
|
||||
## Optional list of additional mail domains
|
||||
#
|
||||
additionalMailDomains: []
|
||||
|
||||
|
||||
@@ -158,7 +158,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["2", "1", "0"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/univention/images-mirror/intercom-service"
|
||||
tag: "2.19.5@sha256:4f1bccfd29889e1edd093c8e35c9486919984faf55ca92b787a6a7aca3729e47"
|
||||
tag: "2.22.0@sha256:0049fc70c03d42780630c2b9915172086ce0cf8f936daeb04e625270a50d0126"
|
||||
jibri:
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Nordeck"
|
||||
@@ -168,7 +168,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["8922"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jibri"
|
||||
tag: "stable-10431@sha256:21ae6f3e9139ca1beea630756060b66f1a6221005f45e35df35d4bf9f69a4cc3"
|
||||
tag: "stable-10590@sha256:c6e10bc418084c2e1664e76bdddb525db34ba5f140af5a9fe9dd5c4f7637a492"
|
||||
jicofo:
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Nordeck"
|
||||
@@ -178,7 +178,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["8922"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jicofo"
|
||||
tag: "stable-10431@sha256:6857b0cad627cde79f6e21c1c40843b14d70dd43e627537c60449d448ce14769"
|
||||
tag: "stable-10590@sha256:a30e9e09fdc39d88bc8cc8a4e83a32bb6bf58914abfb44290439afaf4c72e4a8"
|
||||
jigasi:
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Nordeck"
|
||||
@@ -188,7 +188,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["9955"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jigasi"
|
||||
tag: "stable-10431@sha256:9bcb35444296ab007b24a8ccecd6c1eacc0f01fccf4223e7f8ac340464f4a52e"
|
||||
tag: "stable-10590@sha256:0596e603eb1b4909e8df97be00649848f2b1b85b7cbb7d5e3065ba482a231d49"
|
||||
jitsi:
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Nordeck"
|
||||
@@ -198,7 +198,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["8922"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/web"
|
||||
tag: "stable-10431@sha256:47f57fb67d95a2d3b5fa6edf93916b4922e1599278c0f9dd16cc30f432c75511"
|
||||
tag: "stable-10590@sha256:ae90a61975f7f7d498051ce9e0d7310117ee3f869dcc8c947a005214b253582d"
|
||||
jitsiKeycloakAdapter:
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Nordeck"
|
||||
@@ -208,7 +208,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["2023", "12", "14"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jitsi-keycloak-adapter"
|
||||
tag: "v20250911@sha256:716fb9ba2e866d74cbbd6241a8c75335e48ba25ec2d35f4678e83dd3156bc87c"
|
||||
tag: "v20251119@sha256:2df703ff789be841f984142120e5a31dfd60cfe112a8d8d548ecc92e1401f005"
|
||||
jitsiPatchJVB:
|
||||
# providerCategory: "Community"
|
||||
# providerResponsible: "openDesk"
|
||||
@@ -228,7 +228,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["8922"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jvb"
|
||||
tag: "stable-10431@sha256:64f8a368f593a30d5388d9643b1b0af7b4a09f03f6e585e50cdbff398b5f8918"
|
||||
tag: "stable-10590@sha256:651021ddd4fe1ca29848d96d5813a1ea71b3dbf3587b14a13968ec0e62de2f0c"
|
||||
mariadb:
|
||||
# providerCategory: "Community"
|
||||
# providerResponsible: "openDesk"
|
||||
@@ -762,7 +762,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["13", "1", "1"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
|
||||
tag: "16.6.0@sha256:11fcbc357a5a4e724bb1164e43a93c713f73e5efb52212d75cfc845becbf64c0"
|
||||
tag: "16.6.1@sha256:e3eb4ecdff5a94d2d2aaa0eacc9e747306d6ba6a06f308d2d16cc209516dd4e0"
|
||||
openprojectBootstrap:
|
||||
# providerCategory: "Platform"
|
||||
# providerResponsible: "openDesk"
|
||||
@@ -914,7 +914,7 @@ images:
|
||||
# upstreamRepository: "bmi/opendesk/components/platform-development/images/postfix"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/images/postfix"
|
||||
tag: "3.0.3@sha256:12bcebf57ddb53258c48eaa60e9c25b441f4319ee1b94b363c652ad0a992a875"
|
||||
tag: "3.0.4@sha256:5b17c801283215b13e8305b0be1497d70c232e8ea8414f965cd1010333ae95ab"
|
||||
postfixBootstrap:
|
||||
# providerCategory: "Community"
|
||||
# providerResponsible: "openDesk"
|
||||
@@ -940,7 +940,7 @@ images:
|
||||
# upstreamMirrorStartFrom: ["8922"]
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/prosody"
|
||||
tag: "stable-10431@sha256:792618fff60c6e0eb4facb221e3477b2249cabeaf0479753ac7a6b98c075fd20"
|
||||
tag: "stable-10590@sha256:86d43e743268fa89035663a5e29be7689b131b9c1fb435c01c94d2eeebbb058a"
|
||||
redis:
|
||||
# providerCategory: "Community"
|
||||
# providerResponsible: "openDesk"
|
||||
|
||||
@@ -16,8 +16,8 @@ persistence:
|
||||
size: "1Gi"
|
||||
storageClassName: ~
|
||||
dovecot:
|
||||
# With Dovecot CE this is used for the mail storage.
|
||||
# Dovecot Pro (EE) uses this storage for the metacache,
|
||||
# openDesk CE: Mail storage
|
||||
# openDesk EE (with Dovecot Pro): Storage for metacache
|
||||
size: "1Gi"
|
||||
storageClassName: ~
|
||||
mariadb:
|
||||
|
||||
@@ -32,6 +32,7 @@ secrets:
|
||||
dovecot: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_dovecot" | sha1sum | quote }}
|
||||
element: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_element" | sha1sum | quote }}
|
||||
ox: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_ox" | sha1sum | quote }}
|
||||
postfix: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_postfix" | sha1sum | quote }}
|
||||
openproject: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_openproject" | sha1sum | quote }}
|
||||
xwiki: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_xwiki" | sha1sum | quote }}
|
||||
systemAccounts:
|
||||
|
||||
@@ -20,4 +20,15 @@ smtp:
|
||||
key: ""
|
||||
selector: "rsa"
|
||||
useED25519: false
|
||||
|
||||
security:
|
||||
# Postfix defaults
|
||||
# Ref.: https://www.postfix.org/postconf.5.html#smtpd_sasl_security_options
|
||||
smtpdSASLSecurityOptions:
|
||||
- "noanonymous"
|
||||
# Postfix defaults
|
||||
# Ref.: https://www.postfix.org/postconf.5.html#smtp_sasl_security_options
|
||||
smtpSASLSecurityOptions:
|
||||
- "noanonymous"
|
||||
- "noplaintext"
|
||||
...
|
||||
|
||||
@@ -22,8 +22,8 @@ name: "openDesk"
|
||||
platforms:
|
||||
- "web"
|
||||
developmentStatus: "stable"
|
||||
softwareVersion: "1.9.0"
|
||||
releaseDate: "2025-11-07"
|
||||
softwareVersion: "1.10.0"
|
||||
releaseDate: "2025-11-24"
|
||||
softwareType: "standalone/web"
|
||||
url: "https://gitlab.opencode.de/bmi/opendesk/"
|
||||
logo: ".opencode/openDesk-logo-rgb-color.svg"
|
||||
|
||||
Reference in New Issue
Block a user