Release Environment - Security Hardening - Run the runner with limited permission
As a recommendation in https://gitlab.com/gitlab-com/gl-security/security-operations/infrastructure-security/bau/-/issues/2955+, the runner using for release-environments should have limited privileges, by using security context and privilege escalation security mechanisms. More details can be found in this comment.
Implementation/Testing Hint
Thank to @ggillies :
You can actually configure multiple runners in the same runner deployment, by using different headings in the runners section. This means you can add a new runner alongside the current one (with a new tag), and try running jobs on it in an MR first, making sure they work, before cutting over
Exit Criteria
-
Define the list of the runner's required privileges -
The runner only runs with required privileges -
The deployment pipeline of release-environments works normally
Edited by Dat Tang