[agent] Add support for running unprivileged

charts/prefect-agent/README.md

@@ -34,6 +34,11 @@ Prefect Agent application bundle
 | agent.config.apiUrl | string | `"https://api.prefect.cloud"` | prefect API url |
 | agent.config.workQueueName | string | `""` | prefect workqueue name |
 | agent.config.workspaceId | string | `""` | prefect workspace ID |
+| agent.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | set agent containers' security context allowPrivilegeEscalation |
+| agent.containerSecurityContext.enabled | bool | `true` | enabled agent containers' security context |
+| agent.containerSecurityContext.readOnlyRootFilesystem | bool | `true` | set agent containers' security context readOnlyRootFilesystem |
+| agent.containerSecurityContext.runAsNonRoot | bool | `true` | set agent containers' security context runAsNonRoot |
+| agent.containerSecurityContext.runAsUser | int | `1001` | set agent containers' security context runAsUser |
 | agent.extraEnvVars | list | `[]` | array with extra environment variables to add to agent nodes |
 | agent.extraEnvVarsCM | string | `""` | name of existing ConfigMap containing extra env vars to add to agent nodes |
 | agent.extraEnvVarsSecret | string | `""` | name of existing Secret containing extra env vars to add to agent nodes |
@@ -47,6 +52,8 @@ Prefect Agent application bundle
 | agent.podLabels | object | `{}` | extra labels for agent pod |
 | agent.podSecurityContext.enabled | bool | `true` | enabled agent pods' security context |
 | agent.podSecurityContext.fsGroup | int | `1001` | set agent pod's security context fsGroup |
+| agent.podSecurityContext.runAsNonRoot | bool | `true` | set agent pod's security context runAsNonRoot |
+| agent.podSecurityContext.runAsUser | int | `1001` | set agent pod's security context runAsUser |
 | agent.replicaCount | int | `1` | number of agent replicas to deploy |
 | agent.resources.limits | object | `{}` | the requested limits for the agent container |
 | agent.resources.requests | object | `{}` | the requested resources for the agent container |

charts/prefect-agent/templates/deployment.yaml

@@ -52,15 +52,17 @@ spec:
           imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
           command: ["prefect", "agent", "start", "-q", {{ .Values.agent.config.workQueueName }}]
           env:
-            - name: PREFECT_DEBUG_MODE
-              value: {{ .Values.agent.image.debug | quote }}
             - name: PREFECT_API_URL
               value: {{ template "agent.apiUrl" . }}
             - name: PREFECT_API_KEY
               valueFrom:
                 secretKeyRef:
                   name: {{ .Values.agent.config.apiKeySecret.name }}
                   key:  {{ .Values.agent.config.apiKeySecret.key }}
+            - name: PREFECT_DEBUG_MODE
+              value: {{ .Values.agent.image.debug | quote }}
+            - name: PREFECT_HOME
+              value: /opt/prefect
             {{- if .Values.agent.extraEnvVars }}
             {{- include "common.tplvalues.render" (dict "value" .Values.agent.extraEnvVars "context" $) | nindent 12 }}
             {{- end }}
@@ -76,3 +78,9 @@ spec:
           {{- if .Values.agent.resources }}
           resources: {{- toYaml .Values.agent.resources | nindent 12 }}
           {{- end }}
+          volumeMounts:
+            - mountPath: /opt/prefect/.prefect
+              name: agent-home
+      volumes:
+        - name: agent-home
+          emptyDir: {}

charts/prefect-agent/values.yaml

@@ -58,9 +58,26 @@ agent:
   podSecurityContext:
     # -- enabled agent pods' security context
     enabled: true
+    # -- set agent pod's security context runAsUser
+    runAsUser: 1001
+    # -- set agent pod's security context runAsNonRoot
+    runAsNonRoot: true
     # -- set agent pod's security context fsGroup
     fsGroup: 1001
 
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+  containerSecurityContext:
+    # -- enabled agent containers' security context
+    enabled: true
+    # -- set agent containers' security context runAsUser
+    runAsUser: 1001
+    # -- set agent containers' security context runAsNonRoot
+    runAsNonRoot: true
+    # -- set agent containers' security context readOnlyRootFilesystem
+    readOnlyRootFilesystem: true
+    # -- set agent containers' security context allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+
   ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
   # -- extra labels for agent pod
   podLabels: {}