Fix psp in config manifests #13327

skonto · 2022-09-22T10:58:50Z

Fixes partially #13308 for podsecuritypolicy (deprecated since 1.21, will be unavailable on 1.25) as we need to support the Pod Security Admission instead which becomes stable in 1.25.

Running with knative-serving ns labeled with:

  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted

makes all pods not launching. Errors are as follows on the versions tested 1.23+ (events in the corresponding ns):

8s Warning FailedCreate replicaset/autoscaler-99cb65bf Error creating: pods "autoscaler-99cb65bf-9slvd" is forbidden: violates PodSecurity "restricted:latest": unrestricted capabilities (container "autoscaler" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "autoscaler" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Replaces all with ALL in capabilities section because that is the only acceptable string check here and here.
Tested on: Kind v0.15.0 (1.25), v0.14.0(1.24), v0.12.0(v1.23.4)
Instructions for testing here.
TODO: fix third-party projects. Fix queue proxy and user workloads in another PR. This should be tested on a github workflows too.

codecov · 2022-09-22T11:06:00Z

Codecov Report

Base: 86.50% // Head: 86.50% // No change to project coverage 👍

Coverage data is based on head (1b9a1ad) compared to base (2332731).
Patch has no changes to coverable lines.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13327   +/-   ##
=======================================
  Coverage   86.50%   86.50%           
=======================================
  Files         196      196           
  Lines       14544    14544           
=======================================
  Hits        12581    12581           
  Misses       1664     1664           
  Partials      299      299

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

matzew · 2022-09-22T11:14:54Z

@skonto perhaps makes sense (here or different PR) to also use 1.25 w/ the kind setup:
https://github.com/knative/serving/blob/main/.github/workflows/kind-e2e.yaml#L89-L92

skonto · 2022-09-22T11:23:57Z

@matzew yeah we should test eventually on 1.25 on a workflow (added to TODO) but not sure if the project is ready for the migration so I am holding this PR anyway. Out of curiosity will try it here.

skonto · 2022-09-22T12:38:15Z

/retest

skonto · 2022-09-22T13:50:16Z

All tests pass will add the 1.25 flow and see if there is any difference.

skonto · 2022-09-23T15:06:11Z

@psschwei, I am trying 1.25 and we have a dependency that fails, (afaik knative repos are not on v1 could it be the kapp one?):

+ go run github.com/vmware-tanzu/carvel-kapp/cmd/kapp@latest deploy --yes --app serving --file /tmp/knative.GenB3ug8/tmp.AzvkRdEMQj
Target cluster 'https://127.0.0.1:43025/' (nodes: kind-control-plane, 4+)
kapp: Error: Expected to find kind 'policy/v1beta1/PodDisruptionBudget', but did not:

/cc @evankanderson

skonto · 2022-09-23T15:22:18Z

The update to the latest for metallb also does not work out of the box eg. ingress fails:

3:12:25PM:  ^ Load balancer ingress is empty
kapp: Error: Timed out waiting after 15m0s for resources: [service/istio-ingressgateway (v1) namespace: istio-system]

Also cant use the current on 1.25 due to the psps which are not available. Will revert. Adding 1.25 on github flows needs a separate PR. cc @matzew

evankanderson · 2022-09-23T22:29:54Z

I can take a look later tonight; I'm surprised that our other testing passed on those platforms.

skonto · 2022-09-26T18:45:52Z

@evankanderson any update on this one? :)

psschwei · 2022-09-27T13:43:41Z

@psschwei, I am trying 1.25 and we have a dependency that fails, (afaik knative repos are not on v1 could it be the kapp one?):

Yeah, I think that's it... I opened carvel-dev/kapp#620 to report it.

The update to the latest for metallb also does not work out of the box

I've had issues with that too when trying to set it up locally (haven't had a chance to look into why yet). Did the tests work with the old version?

skonto · 2022-09-27T13:51:02Z

Did the tests work with the old version?

No because the old version of metallb defines psps that are removed in 1.25, we need that last version.

skonto · 2022-10-04T10:55:10Z

@psschwei or @evankanderson gentle ping for a merge.

evankanderson · 2022-10-05T01:18:07Z

/lgtm
/approve

knative-prow · 2022-10-05T01:18:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: evankanderson, skonto

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~config/OWNERS~~ [evankanderson]
~~third_party/OWNERS~~ [evankanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

skonto · 2022-10-05T08:44:15Z

/test gateway-api-latest

* fix sc * revert github flow change

* Fix psp in config manifests (knative#13327) * fix sc * revert github flow change * remove seccomp profile * fix indentation * fix deployments scs for ci and release

* Fix psp in config manifests (knative#13327) * fix sc * revert github flow change * remove seccomp profile * fix indentation * fix deployments scs for ci and release Co-authored-by: Stavros Kontopoulos <skontopo@redhat.com>

* I believe this [PR](knative/serving#13327) adds it to the controller in the serving repo, but why not do it in the net-contour repo too?

* believe this [PR](knative/serving#13327) adds the seccompProfile part to the third_party resources in serving, but I think we should do it in this repo too

* I believe this [PR](knative/serving#13327) adds it to the controller in the serving repo, but why not do it in the net-contour repo too?

* believe this [PR](knative/serving#13327) adds the seccompProfile part to the third_party resources in serving, but I think we should do it in this repo too Co-authored-by: Clay Kauzlaric <ckauzlaric@vmware.com>

* I believe this [PR](knative/serving#13327) adds it to the controller in the serving repo, but why not do it in the net-contour repo too? Co-authored-by: Clay Kauzlaric <ckauzlaric@vmware.com>

knative-prow bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. area/networking labels Sep 22, 2022

psschwei mentioned this pull request Sep 22, 2022

Kubernetes v1.25 deprecation tracking #13308

Closed

skonto force-pushed the fix_psp branch 2 times, most recently from 26b562c to e67979d Compare September 23, 2022 13:04

This was referenced Sep 23, 2022

Fix psp in config manifests knative-extensions/net-kourier#922

Merged

Fix psp in config manifests knative-extensions/net-istio#983

Merged

fix sc

16c329f

skonto force-pushed the fix_psp branch from e67979d to 16c329f Compare September 23, 2022 14:45

knative-prow bot requested a review from evankanderson September 23, 2022 15:06

revert github flow change

1b9a1ad

skonto changed the title ~~[wip] Fix psp in config manifests~~ Fix psp in config manifests Sep 26, 2022

knative-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 26, 2022

knative-prow bot assigned evankanderson Oct 5, 2022

knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Oct 5, 2022

knative-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 5, 2022

knative-prow bot merged commit 080aaa5 into knative:main Oct 5, 2022

skonto pushed a commit to skonto/serving that referenced this pull request Oct 10, 2022

Fix psp in config manifests (knative#13327)

e0cd982

* fix sc * revert github flow change

skonto mentioned this pull request Oct 10, 2022

[RELEASE-1.5] [BACKPORT] Fix sc for psp compliance openshift/knative-serving#1272

Merged

skonto pushed a commit to skonto/serving that referenced this pull request Oct 18, 2022

Fix psp in config manifests (knative#13327)

377cf48

* fix sc * revert github flow change

dprotaso mentioned this pull request Jan 19, 2023

Add validation to warn about insecure SecurityContext defaults #13399

Merged

KauzClay added a commit to KauzClay/net-contour that referenced this pull request Sep 12, 2023

add seccompProfile to controller

20e12fd

* I believe this [PR](knative/serving#13327) adds it to the controller in the serving repo, but why not do it in the net-contour repo too?

KauzClay mentioned this pull request Sep 12, 2023

add seccompProfile to controller knative-extensions/net-contour#955

Merged

KauzClay mentioned this pull request Sep 12, 2023

add seccompProfile to controller and webhook knative-extensions/net-certmanager#584

Merged

Fix psp in config manifests #13327

Fix psp in config manifests #13327

Uh oh!

Conversation

skonto commented Sep 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Sep 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

matzew commented Sep 22, 2022

Uh oh!

skonto commented Sep 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skonto commented Sep 22, 2022

Uh oh!

skonto commented Sep 22, 2022

Uh oh!

skonto commented Sep 23, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skonto commented Sep 23, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

evankanderson commented Sep 23, 2022

Uh oh!

skonto commented Sep 26, 2022

Uh oh!

psschwei commented Sep 27, 2022

Uh oh!

skonto commented Sep 27, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skonto commented Oct 4, 2022

Uh oh!

evankanderson commented Oct 5, 2022

Uh oh!

knative-prow bot commented Oct 5, 2022

Uh oh!

skonto commented Oct 5, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

skonto commented Sep 22, 2022 •

edited

Loading

codecov bot commented Sep 22, 2022 •

edited

Loading

skonto commented Sep 22, 2022 •

edited

Loading

skonto commented Sep 23, 2022 •

edited

Loading

skonto commented Sep 23, 2022 •

edited

Loading

skonto commented Sep 27, 2022 •

edited

Loading