commit 95c65eb4b6f93d59fc502730ecdc3c69ffc87105
Author: Jiří Suchomel <jiri.suchomel@suse.com>
Date:   Mon Oct 26 16:46:04 2020 +0100

    Do not run containers as root
    
    The main reason why some SUSE Private Registry containers still
    need to run as root is because installing container-wide CA certificates
    requires root access. This change makes use of init containers to
    install certificates as root, while running the regular workload
    processes as a non-privileged user.

diff --git a/templates/core/core-dpl.yaml b/templates/core/core-dpl.yaml
index 339aec7..bdc3812 100644
--- a/templates/core/core-dpl.yaml
+++ b/templates/core/core-dpl.yaml
@@ -41,6 +41,29 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       automountServiceAccountToken: false
+      {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+      initContainers:
+      - name: "install-certificates"
+        securityContext:
+          runAsUser: 0
+        image: {{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        command: ["/bin/sh"]
+        args: [
+          '-c',
+          '/usr/bin/harbor-install-cert.sh && cp -ar /var/lib/ca-certificates/* /tmp/ca-certificates' ]
+        volumeMounts:
+        - name: ca-certificates
+          mountPath: /tmp/ca-certificates
+          readOnly: false
+        {{- if .Values.internalTLS.enabled }}
+        - name: core-internal-certs
+          mountPath: /etc/harbor/ssl/core
+        {{- end }}
+        {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
+        {{- end }}
+      {{- end }}
       containers:
       - name: core
         image: {{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}
@@ -111,6 +134,10 @@ spec:
         ports:
         - containerPort: {{ template "harbor.core.containerPort" . }}
         volumeMounts:
+        {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+        - name: ca-certificates
+          mountPath: /var/lib/ca-certificates
+        {{- end }}
         - name: config
           mountPath: /etc/core/app.conf
           subPath: app.conf
@@ -143,6 +170,10 @@ spec:
 {{ toYaml .Values.core.resources | indent 10 }}
 {{- end }}
       volumes:
+      {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+      - name: "ca-certificates"
+        emptyDir: {}
+      {{- end }}
       - name: config
         configMap:
           name: {{ template "harbor.core" . }}
diff --git a/templates/jobservice/jobservice-dpl.yaml b/templates/jobservice/jobservice-dpl.yaml
index ad41362..f1c83a9 100644
--- a/templates/jobservice/jobservice-dpl.yaml
+++ b/templates/jobservice/jobservice-dpl.yaml
@@ -46,6 +46,29 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       automountServiceAccountToken: false
+      {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+      initContainers:
+      - name: "install-certificates"
+        securityContext:
+          runAsUser: 0
+        image: {{ .Values.jobservice.image.repository }}:{{ .Values.jobservice.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        command: ["/bin/sh"]
+        args: [
+            '-c',
+            '/usr/bin/harbor-install-cert.sh && cp -ar /var/lib/ca-certificates/* /tmp/ca-certificates' ]
+        volumeMounts:
+        - name: ca-certificates
+          mountPath: /tmp/ca-certificates
+          readOnly: false
+        {{- if .Values.internalTLS.enabled }}
+        - name: jobservice-internal-certs
+          mountPath: /etc/harbor/ssl/jobservice
+        {{- end }}
+        {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
+        {{- end }}
+      {{- end }}
       containers:
       - name: jobservice
         image: {{ .Values.jobservice.image.repository }}:{{ .Values.jobservice.image.tag }}
@@ -97,6 +120,10 @@ spec:
         ports:
         - containerPort: {{ template "harbor.jobservice.containerPort" . }}
         volumeMounts:
+        {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+        - name: ca-certificates
+          mountPath: /var/lib/ca-certificates
+        {{- end }}
         - name: jobservice-config
           mountPath: /etc/jobservice/config.yml
           subPath: config.yml
@@ -111,6 +138,10 @@ spec:
 {{ include "harbor.caBundleVolumeMount" . | indent 8 }}
         {{- end }}
       volumes:
+      {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+      - name: "ca-certificates"
+        emptyDir: {}
+      {{- end }}
       - name: jobservice-config
         configMap:
           name: "{{ template "harbor.jobservice" . }}"
diff --git a/templates/registry/registry-dpl.yaml b/templates/registry/registry-dpl.yaml
index 6321950..f4a2a55 100644
--- a/templates/registry/registry-dpl.yaml
+++ b/templates/registry/registry-dpl.yaml
@@ -46,6 +46,34 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       automountServiceAccountToken: false
+      {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName .Values.persistence.imageChartStorage.caBundleSecretName }}
+      initContainers:
+      - name: "install-certificates"
+        securityContext:
+          runAsUser: 0
+        image: {{ .Values.registry.registry.image.repository }}:{{ .Values.registry.registry.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        command: ["/bin/sh"]
+        args: [
+            '-c',
+            '/usr/bin/harbor-install-cert.sh && cp -ar /var/lib/ca-certificates/* /tmp/ca-certificates' ]
+        volumeMounts:
+        - name: ca-certificates
+          mountPath: /tmp/ca-certificates
+          readOnly: false
+        {{- if .Values.internalTLS.enabled }}
+        - name: registry-internal-certs
+          mountPath: /etc/harbor/ssl/registry
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
+        - name: storage-service-ca
+          mountPath: /harbor_cust_cert/custom-ca-bundle.crt
+          subPath: ca.crt
+        {{- end }}
+        {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
+        {{- end }}
+      {{- end }}
       containers:
       - name: registry
         image: {{ .Values.registry.registry.image.repository }}:{{ .Values.registry.registry.image.tag }}
@@ -100,6 +128,10 @@ spec:
         - containerPort: {{ template "harbor.registry.containerPort" . }}
         - containerPort: 5001
         volumeMounts:
+        {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName .Values.persistence.imageChartStorage.caBundleSecretName }}
+        - name: ca-certificates
+          mountPath: /var/lib/ca-certificates
+        {{- end }}
         - name: registry-data
           mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
           subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }}
@@ -184,6 +216,10 @@ spec:
         ports:
         - containerPort: {{ template "harbor.registryctl.containerPort" . }}
         volumeMounts:
+        {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName .Values.persistence.imageChartStorage.caBundleSecretName }}
+        - name: ca-certificates
+          mountPath: /var/lib/ca-certificates
+        {{- end }}
         - name: registry-data
           mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
           subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }}
@@ -211,6 +247,10 @@ spec:
 {{ include "harbor.caBundleVolumeMount" . | indent 8 }}
         {{- end }}
       volumes:
+      {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName .Values.persistence.imageChartStorage.caBundleSecretName }}
+      - name: "ca-certificates"
+        emptyDir: {}
+      {{- end }}
       - name: registry-htpasswd
         secret:
           secretName: {{ template "harbor.registry" . }}
diff --git a/templates/trivy/trivy-sts.yaml b/templates/trivy/trivy-sts.yaml
index ede4298..459148a 100644
--- a/templates/trivy/trivy-sts.yaml
+++ b/templates/trivy/trivy-sts.yaml
@@ -43,6 +43,30 @@ spec:
         runAsUser: 10000
         fsGroup: 10000
       automountServiceAccountToken: false
+      {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+      initContainers:
+        - name: "install-certificates"
+          securityContext:
+            runAsNonRoot: false
+            runAsUser: 0
+          image: {{ .Values.trivy.image.repository }}:{{ .Values.trivy.image.tag }}
+          imagePullPolicy: {{ .Values.imagePullPolicy }}
+          command: ["/bin/sh"]
+          args: [
+             '-c',
+             '/usr/bin/harbor-install-cert.sh && cp -ar /var/lib/ca-certificates/* /tmp/ca-certificates' ]
+          volumeMounts:
+          - name: ca-certificates
+            mountPath: /tmp/ca-certificates
+            readOnly: false
+          {{- if .Values.internalTLS.enabled }}
+          - name: trivy-internal-certs
+            mountPath: /etc/harbor/ssl/trivy
+          {{- end }}
+          {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 10 }}
+          {{- end }}
+      {{- end }}
       containers:
         - name: trivy
           image: {{ .Values.trivy.image.repository }}:{{ .Values.trivy.image.tag }}
@@ -111,6 +135,10 @@ spec:
             - name: api-server
               containerPort: {{ template "harbor.trivy.containerPort" . }}
           volumeMounts:
+          {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+          - name: ca-certificates
+            mountPath: /var/lib/ca-certificates
+          {{- end }}
           - name: data
             mountPath: /home/scanner/.cache
             subPath: {{ .Values.persistence.persistentVolumeClaim.trivy.subPath }}
@@ -144,6 +172,10 @@ spec:
 {{ toYaml .Values.trivy.resources | indent 12 }}
       {{- if or (or .Values.internalTLS.enabled .Values.caBundleSecretName) (or (not .Values.persistence.enabled) $trivy.existingClaim) }}
       volumes:
+      {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
+      - name: "ca-certificates"
+        emptyDir: {}
+      {{- end }}
       {{- if .Values.internalTLS.enabled }}
       - name: trivy-internal-certs
         secret:
