fix: Set defaults for the securityContext (#149)

# Description
Introduce default security context for the deployment to align with
trivy rules:
```yaml
securityContext:
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  seccompProfile:
    type: RuntimeDefault
```

Please take the rules into the account when upgrading

Author: maksym-iv-ef

.github/workflows/ci.yaml

@@ -18,6 +18,10 @@ jobs:
       }}
     uses: elastiflow/gha-reusable/.github/workflows/reusable_pr_checks.yml@v0
 
+  mandatory_checks:
+    name: Security checks
+    uses: elastiflow/gha-reusable/.github/workflows/reusable_mandatory_checks.yml@v0
+
   renovate_config_validator:
     name: renovate config validator
     runs-on: ubuntu-latest

.github/workflows/reusable_release.yml

@@ -39,6 +39,9 @@ on:
         default: 15
         description: "Job timeout in minutes"
 
+env:
+  CHART_DIR: ${{ inputs.chart_dir }}
+
 jobs:
   # Detect if a commit was made from a release PR with title like '[release v0.1.1] (#49)'
   release_or_pr:
@@ -130,7 +133,7 @@ jobs:
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
       - name: Install Helm dependencies
         run: |
-          (helm dependency list ${{ inputs.chart_dir }} || true) | grep -E 'https://' | while read -r dep; do
+          (helm dependency list ${CHART_DIR} || true) | grep -E 'https://' | while read -r dep; do
             helm repo add $(echo ${dep} | awk '{print $1}') $(echo ${dep} | awk '{print $4}')
           done
       - name: Install chart-releaser
@@ -141,7 +144,7 @@ jobs:
           install_only: true
       - name: Package helm chart
         run: |
-          cr package ${{ inputs.chart_dir }}
+          cr package ${CHART_DIR}
       - name: Create GH release
         if: ${{ fromJson(steps.prepare_release.outputs.new_release_published) }}
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
@@ -154,6 +157,9 @@ jobs:
           make_latest: true
           files: ".cr-release-packages/${{ inputs.chart_name }}-*.tgz"
       - name: Update GH pages index
+        env:
+          REPOSITORY_OWNER: ${{ inputs.repository_owner }}
+          REPOSITORY_NAME: ${{ inputs.repository_name }}
         run: |
           mkdir .cr-index
-          cr index --push -t ${{ secrets.GITHUB_TOKEN }} --owner ${{ inputs.repository_owner	}} --git-repo ${{ inputs.repository_name	}}
+          cr index --push -t ${{ secrets.GITHUB_TOKEN }} --owner ${REPOSITORY_OWNER} --git-repo ${REPOSITORY_NAME}

.pre-commit-config.yaml

@@ -11,3 +11,16 @@ repos:
       - id: check-yaml
         files: \.(yaml|yml)$
         exclude: charts/.*
+  - repo: local
+    hooks:
+      - id: trivy
+        name: trivy
+        language: system
+        pass_filenames: false
+        entry: |
+          trivy -q config --skip-files '*.hcl' --skip-dirs '**/.terragrunt-cache/*' --exit-code 1 .
+  - repo: https://github.com/semgrep/pre-commit
+    rev: 'v1.163.0'
+    hooks:
+      - id: semgrep
+        entry: semgrep

.semgrepignore

@@ -0,0 +1 @@
+charts/netobserv-flow/tls/netobserv.key

charts/netobserv-flow/templates/deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "netobserv.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "netobserv.labels" . | nindent 4 }}
 spec:

charts/netobserv-flow/templates/gateway.yaml

@@ -13,6 +13,10 @@ metadata:
   {{- end }}
 spec:
   gatewayClassName: {{ .Values.gateway.className }}
+  {{- with .Values.gateway.infrastructure }}
+  infrastructure:
+    {{- tpl (toYaml . | nindent 4) $ }}
+  {{- end }}
   {{- with .Values.gateway.listeners }}
   listeners:
     {{- toYaml . | nindent 4 }}

charts/netobserv-flow/values.yaml

@@ -176,13 +176,16 @@ podSecurityContext:
   runAsUser: 1000
   runAsGroup: 1000
 
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+  allowPrivilegeEscalation: false
+  seccompProfile:
+    type: RuntimeDefault
 
 # The netobserv container's ports to expose.
 ports:
@@ -290,18 +293,23 @@ gateway:
             - name: '{{ include "netobserv.fullname" $ }}'
               port: 8080
   # GRPCRoutes to be provisioned with the Gateway
-  # grpcRoutes:
-  #   - name: api
-  #     # hostnames: ["foo.bar.com"] # Overrides the gateway.defaultHostNames
-  #     rules:
-  #       - matches:
-  #         - type: Exact
-  #           method:
-  #           service: "foo"
+  # https://gateway-api.sigs.k8s.io/guides/user-guides/grpc-routing/
+  grpcRoutes: []
+  # - name: api # Supports templating
+  #   # hostnames: ["foo.bar.com"] # Overrides the gateway.defaultHostNames, supports templating
+  #   rules:
+  #     - matches:
+  #         - method:
+  #             type: "Exact"
+  #             service: "foo"
+  #             method: "Bar"
   #           headers:
-  #         backendRefs:
-  #           - name: '{{ include "netobserv.fullname" $ }}'
-  #             port: 8080
+  #             - type: Exact
+  #               name: magic
+  #               value: foo
+  #       backendRefs:
+  #         - name: '{{ include "triton.fullname" $ }}'
+  #           port: 8080
 
 resources:
   limits:

lintconf.yaml

@@ -39,4 +39,4 @@ rules:
     type: unix
   trailing-spaces: enable
   truthy:
-    level: warning
+    level: warning

trivy.yaml

@@ -0,0 +1 @@
+ignorefile: trivyignore.yaml

trivyignore.yaml

@@ -0,0 +1,13 @@
+misconfigurations:
+  - id: KSV-0020
+    statement: Historically running as UID/GID 1000.
+    paths:
+      - charts/netobserv-flow/**/*
+  - id: KSV-0021
+    statement: Historically running as UID/GID 1000.
+    paths:
+      - charts/netobserv-flow/**/*
+  - id: KSV-0125
+    statement: "`elastiflow/flow-collector` is a NetObserv image registry"
+    paths:
+      - charts/netobserv-flow/**/*