From 834a49287b48697bdd57c4d61a981df0f4e1f600 Mon Sep 17 00:00:00 2001
From: Jennifer Richards <jennifer@staff.ietf.org>
Date: Wed, 24 Apr 2024 14:53:10 -0300
Subject: [PATCH 1/4] ci: securityContext for rabbitmq

---
 helm/values.yaml | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/helm/values.yaml b/helm/values.yaml
index dae391aaaa9..f555a26e1d8 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -419,9 +419,6 @@ rabbitmq:
   podAnnotations: {}
   podLabels: {}
 
-  podSecurityContext: {}
-    # fsGroup: 2000
-
   replicaCount: 1
 
   resources: {}
@@ -436,13 +433,18 @@ rabbitmq:
     #   cpu: 100m
     #   memory: 128Mi
 
-  securityContext: {}
-    # capabilities:
-    #   drop:
-    #   - ALL
-    # readOnlyRootFilesystem: true
-    # runAsNonRoot: true
-    # runAsUser: 1000
+  podSecurityContext:
+    runAsNonRoot: true
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    readOnlyRootFilesystem: true
+    # rabbitmq image sets up uid/gid 100/101
+    runAsUser: 100
+    runAsGroup: 101
 
   service:
     type: ClusterIP
@@ -531,8 +533,6 @@ memcached:
 
   podSecurityContext:
     runAsNonRoot: true
-    runAsUser: 11211
-    runAsGroup: 11211
 
   securityContext:
     allowPrivilegeEscalation: false
@@ -540,6 +540,9 @@ memcached:
       drop:
       - ALL
     readOnlyRootFilesystem: true
+    # memcached image sets up uid/gid 11211
+    runAsUser: 11211
+    runAsGroup: 11211
 
   service:
     type: ClusterIP

From fa4add3fd8e012d6e0e4979894db5a966df4c70c Mon Sep 17 00:00:00 2001
From: Jennifer Richards <jennifer@staff.ietf.org>
Date: Wed, 24 Apr 2024 20:07:14 -0300
Subject: [PATCH 2/4] ci: logs from rabbitmq as json to console

---
 helm/templates/configmap.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/helm/templates/configmap.yaml b/helm/templates/configmap.yaml
index e0261f0f49d..06cda4a04b1 100644
--- a/helm/templates/configmap.yaml
+++ b/helm/templates/configmap.yaml
@@ -61,3 +61,9 @@ data:
     # absolute number because relative will be proprtional to the full machine
     # memory.
     vm_memory_high_watermark.absolute = 1600MB
+    
+    # Logging
+    log.file = false
+    log.console = true
+    log.console.level = info
+    log.console.formatter = json

From 03e7338af0a4ab7bc41f5805a8d957dc0eda7ad6 Mon Sep 17 00:00:00 2001
From: Jennifer Richards <jennifer@staff.ietf.org>
Date: Wed, 24 Apr 2024 20:08:30 -0300
Subject: [PATCH 3/4] ci: tmp volume for rabbitmq

Needed since rootfs is now read-only
---
 helm/values.yaml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/helm/values.yaml b/helm/values.yaml
index f555a26e1d8..c7a8b43dcfa 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -405,7 +405,6 @@ rabbitmq:
     repository: "ghcr.io/ietf-tools/datatracker-mq"
     pullPolicy: IfNotPresent
     tag: "3.12-alpine"
-
   imagePullSecrets: []
   nameOverride: ""
   fullnameOverride: ""
@@ -478,6 +477,9 @@ rabbitmq:
     - name: "rabbitmq-config"
       configMap:
         name: "rabbitmq-configmap"
+    - name: "rabbitmq-tmp"
+      emptyDir:
+        sizeLimit: 50Mi
     # - name: foo
     #   secret:
     #     secretName: mysecret
@@ -489,9 +491,8 @@ rabbitmq:
       mountPath: "/var/lib/rabbitmq/mnesia"
     - name: "rabbitmq-config"
       mountPath: "/etc/rabbitmq"
-    # - name: foo
-    #   mountPath: "/etc/foo"
-    #   readOnly: true
+    - name: "rabbitmq-tmp"
+      mountPath: "/tmp"
 
   tolerations: []
 

From af353352d198fd5ceb8bcf234ae9ef3d8b05e5a1 Mon Sep 17 00:00:00 2001
From: Jennifer Richards <jennifer@staff.ietf.org>
Date: Wed, 24 Apr 2024 20:11:58 -0300
Subject: [PATCH 4/4] ci: fix permissions on /var/lib/rabbitmq vol

Rabbitmq needs to be able to write to the fs at
/var/lib/rabbitmq. It may be possible to get rid
of the initContainer and use fsGroup in the pod
securityContext to manage this, but that does not
work for the hostVolume mounts I use for dev.
The solution here moves the actual mount to the
rabbitmq/ directory in the rabbitmq-data volume
and uses an initContainer to set the permissions
on that. That should work for any volume type.
---
 helm/templates/statefulsets/rabbitmq.yaml | 14 ++++++++++++++
 helm/values.yaml                          |  3 ++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/helm/templates/statefulsets/rabbitmq.yaml b/helm/templates/statefulsets/rabbitmq.yaml
index dcffe176714..6cb2cc83674 100644
--- a/helm/templates/statefulsets/rabbitmq.yaml
+++ b/helm/templates/statefulsets/rabbitmq.yaml
@@ -26,6 +26,20 @@ spec:
       serviceAccountName: {{ include "datatracker.serviceAccountName.rabbitmq" . }}
       securityContext:
         {{- toYaml $podValues.podSecurityContext | nindent 8 }}
+      initContainers:
+        - name: init-rabbitmq
+          image: busybox:stable
+          command:
+            - "sh"
+            - "-c"
+            - "mkdir -p -m700 /mnt/rabbitmq && chown 100:101 /mnt/rabbitmq"
+          securityContext:
+            runAsNonRoot: false
+            runAsUser: 0
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: "rabbitmq-data"
+              mountPath: "/mnt"
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
diff --git a/helm/values.yaml b/helm/values.yaml
index c7a8b43dcfa..366cea3d466 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -488,7 +488,8 @@ rabbitmq:
     # Additional volumeMounts on the output Deployment definition.
   volumeMounts:
     - name: "rabbitmq-data"
-      mountPath: "/var/lib/rabbitmq/mnesia"
+      mountPath: "/var/lib/rabbitmq"
+      subPath: "rabbitmq"
     - name: "rabbitmq-config"
       mountPath: "/etc/rabbitmq"
     - name: "rabbitmq-tmp"