fix: decouple skills from the privileged sandbox and default to restricted PSS#2334
Draft
QuentinBisson wants to merge 1 commit into
Draft
fix: decouple skills from the privileged sandbox and default to restricted PSS#2334QuentinBisson wants to merge 1 commit into
QuentinBisson wants to merge 1 commit into
Conversation
…icted PSS Skills alone no longer set privileged=true on the agent container: skills loading needs no elevated privileges, and srt fails loudly per command when it cannot sandbox, so nothing runs unsandboxed. The explicit executeCodeBlocks opt-in keeps requesting the privileged sandbox, and securityContext.privileged remains the manual knob. When no securityContext is provided, the agent and skills-init containers now default to the Pod Security Standards restricted profile (allowPrivilegeEscalation=false, runAsNonRoot, drop ALL, RuntimeDefault seccomp). Dockerfile.full switches to a numeric USER so runAsNonRoot is verifiable by the kubelet. Fixes kagent-dev#1997 Fixes kagent-dev#2244 Signed-off-by: QuentinBisson <quentin@giantswarm.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1997. Fixes #2244.
What
Two changes to how the controller renders agent pod security:
Skills no longer imply
privileged: true(#1997). Skills loading (git clone / OCI pull inskills-init) needs no elevated privileges;privilegedexists only for the srt/bubblewrap BashTool sandbox, and the controller conflated the two. Now only the explicitdeclarative.executeCodeBlocks: trueopt-in requests the privileged sandbox (the existingallowPrivilegeEscalation: falseguard still suppresses it), andsecurityContext.privileged: trueremains the manual knob. This is safe rather than a silent downgrade: both runtimes always execsrt, which fails loudly per command when it cannot set up isolation — there is no unsandboxed fallback path.Restricted-PSS defaults (#2244). When the user provides no
securityContext, the agent container and the skills-init container now render the Pod Security Standardsrestrictedprofile (allowPrivilegeEscalation: false,runAsNonRoot: true,capabilities.drop: [ALL],seccompProfile: RuntimeDefault) instead of nothing, so agents are admitted onrestricted-enforcing clusters out of the box. A user-providedsecurityContextpasses through unchanged. All first-party images already run as non-root;python/Dockerfile.fullswitches fromUSER pythonto the numericUSER 1001:1001so the kubelet can verifyrunAsNonRootwithout an explicitrunAsUser.Behavior change for skills users who relied on the implicit privileged sandbox: bash commands on clusters without unprivileged user namespaces will return per-command sandbox errors until
executeCodeBlocks: true(orsecurityContext.privileged: true) is set. BYO images that run as root now need an explicitsecurityContext.Tests
TestSecurityContext_SkillsDefaultNotPrivileged(flipped from the previousSkillsDefaultPrivilegedSandbox, incl. skills-init),TestSecurityContext_ExecuteCodeBlocksKeepsPrivileged,TestSecurityContext_DefaultIsRestricted; golden files regenerated.