OCPBUGS-1666: Expose flag to enable/disable PodSecurity by jmrodri · Pull Request #6062 · operator-framework/operator-sdk

jmrodri · 2022-10-07T02:37:07Z

Description of the change:

Added --security-context-config flag to enable seccompprofile. It defaults to enabled to support k8s 1.25. You can disable it with --security-context-config=legacy

Signed-off-by: jesus m. rodriguez jesusr@redhat.com

Motivation for the change:
In k8s 1.25 PodSecurityAdmission is enabled. https://kubernetes.io/blog/2022/08/04/upcoming-changes-in-kubernetes-1-25/#podsecuritypolicy-removal

Fixes a few issues found downstream but affect upstream as well:

Checklist

If the pull request includes user-facing changes, extra documentation is required:

Add a new changelog fragment in changelog/fragments (see changelog/fragments/00-template.yaml)
Add or update relevant sections of the docs website in website/content/en/docs

jmrodri · 2022-10-07T02:46:44Z

Fixes a few issues upstream and downstream:

jmrodri · 2022-10-07T02:56:15Z

If you pass in an unsupported option you get the help message:

$ operator-sdk run bundle quay.io/olmqe/upgradeindex-bundle:v0.1 --index-image quay.io/olmqe/largefbcindexwithupgradefbc:v4.11 --timeout 5m --security-context-config=fake -n jesusr
Error: invalid argument "fake" for "--security-context-config" flag: must be one of "legacy", or "restricted"
Usage:
  operator-sdk run bundle <bundle-image> [flags]

Flags:
      --ca-secret-name string                     Name of a generic secret containing a PEM root certificate file required to pull bundle images. This secret *must* be in the namespace that this command is configured to run in, and the file *must* be encoded under the key "cert.pem"
  -h, --help                                      help for bundle
      --index-image string                        index image in which to inject bundle (default "quay.io/operator-framework/opm:latest")
      --install-mode InstallModeValue             install mode
      --kubeconfig string                         Path to the kubeconfig file to use for CLI requests.
  -n, --namespace string                          If present, namespace scope for this CLI request
      --pull-secret-name string                   Name of image pull secret ("type: kubernetes.io/dockerconfigjson") required to pull bundle images. This secret *must* be both in the namespace and an imagePullSecret of the service account that this command is configured to run in
      --security-context-config SecurityContext   specifies the security context to use for the catalog pod
      --service-account string                    Service account name to bind registry objects to. If unset, the default service account is used. This value does not override the operator's service account
      --skip-tls                                  skip authentication of image registry TLS certificate when pulling a bundle image in-cluster
      --skip-tls-verify                           skip TLS certificate verification for container image registries while pulling bundles
      --timeout duration                          Duration to wait for the command to complete before failing (default 2m0s)
      --use-http                                  use plain HTTP for container image registries while pulling bundles

Global Flags:
      --plugins strings   plugin keys to be used for this subcommand execution
      --verbose           Enable verbose logging

FATA[0000] invalid argument "fake" for "--security-context-config" flag: must be one of "legacy", or "restricted"

jmrodri · 2022-10-07T02:59:04Z

When restricted is enabled, the pod will have the seccompProfile set on it.

$ operator-sdk run bundle quay.io/olmqe/upgradeindex-bundle:v0.1 --index-image quay.io/olmqe/largefbcindexwithupgradefbc:v4.11 --timeout 5m --security-context-config=restricted -n jesusr

$ k get pod quay-io-olmqe-upgradeindex-bundle-v0-1 -o yaml -n jesusr | grep -i seccompProfile -A5 -B1
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:

jmrodri · 2022-10-07T02:59:57Z

if legacy is enabled then no seccompprofile is added to the Pod.

$ operator-sdk run bundle quay.io/olmqe/upgradeindex-bundle:v0.1 --index-image quay.io/olmqe/largefbcindexwithupgradefbc:v4.11 --timeout 5m --security-context-config=legacy -n jesusr

$ k get pod quay-io-olmqe-upgradeindex-bundle-v0-1 -o yaml -n jesusr | grep -i seccompProfile -A5 -B1

everettraven

Just a teeny nit on the changelog. Also need to run make generate to update the CLI docs with the latest changes.

Added --security-context-config flag to enable seccompprofile. It defaults to enabled to support k8s 1.25. You can disable it with --security-context-config=legacy Signed-off-by: jesus m. rodriguez <jesusr@redhat.com>

* Ignoring error from Set call in test * Update .cncf maintainers * Update run bundle(-upgrade) CLI docs Signed-off-by: jesus m. rodriguez <jmrodri@gmail.com>

This was being duplicated because we had it in the text but were not setting the value to a default value. Once we set the value to the default cobra realized this and would output "(default: restricted)". So removing the manually entered text fixes the duplicate. Signed-off-by: jesus m. rodriguez <jesusr@redhat.com>

everettraven

/lgtm

jmrodri · 2022-10-13T03:56:07Z

/cherry-pick v1.24.x

openshift-cherrypick-robot · 2022-10-13T03:56:53Z

@jmrodri: new pull request created: #6080

Details

In response to this:

/cherry-pick v1.24.x

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

…text Add a parameter to let the users specify a value for --security-context-config (legacy/restricted, default restricted) to by used by the operator-sdk for its catalog pod. See: operator-framework/operator-sdk#6062 Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>

…text (#41134) Add a parameter to let the users specify a value for --security-context-config (legacy/restricted, default restricted) to by used by the operator-sdk for its catalog pod. See: operator-framework/operator-sdk#6062 Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>

openshift-ci Bot requested review from fabianvf and joelanford October 7, 2022 02:37

jmrodri temporarily deployed to deploy October 7, 2022 02:37 Inactive

jmrodri force-pushed the run-bundle-bug branch from 41fd64f to 910d990 Compare October 7, 2022 02:40

jmrodri temporarily deployed to deploy October 7, 2022 02:42 Inactive

jmrodri temporarily deployed to deploy October 7, 2022 02:45 Inactive

jmrodri temporarily deployed to deploy October 7, 2022 02:46 Inactive

jmrodri temporarily deployed to deploy October 7, 2022 02:47 Inactive

jmrodri temporarily deployed to deploy October 7, 2022 02:49 Inactive

jmrodri requested a review from everettraven October 7, 2022 02:54

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 7, 2022

grokspawn reviewed Oct 7, 2022

View reviewed changes

Comment thread website/content/en/docs/cli/operator-sdk_run_bundle-upgrade.md Outdated

grokspawn reviewed Oct 7, 2022

View reviewed changes

Comment thread website/content/en/docs/cli/operator-sdk_run_bundle-upgrade.md Outdated

grokspawn reviewed Oct 7, 2022

View reviewed changes

Comment thread website/content/en/docs/cli/operator-sdk_run_bundle.md Outdated

everettraven requested changes Oct 7, 2022

View reviewed changes

Comment thread changelog/fragments/enable-seccompprofile-run-bundle.yaml Outdated

grokspawn reviewed Oct 7, 2022

View reviewed changes

Comment thread .cncf-maintainers Outdated

jmrodri and others added 2 commits October 7, 2022 21:56

OCPBUGS-1666: Expose flag to enable/disable PodSecurity

b7e416b

Added --security-context-config flag to enable seccompprofile. It defaults to enabled to support k8s 1.25. You can disable it with --security-context-config=legacy Signed-off-by: jesus m. rodriguez <jesusr@redhat.com>

fix test-sanity: update docs & fix test.

c4d6a31

* Ignoring error from Set call in test * Update .cncf maintainers * Update run bundle(-upgrade) CLI docs Signed-off-by: jesus m. rodriguez <jmrodri@gmail.com>

jmrodri temporarily deployed to deploy October 12, 2022 13:45 Inactive

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 12, 2022

jmrodri force-pushed the run-bundle-bug branch from 662a486 to e67aa04 Compare October 12, 2022 14:15

jmrodri temporarily deployed to deploy October 12, 2022 14:16 Inactive

everettraven approved these changes Oct 12, 2022

View reviewed changes

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Oct 12, 2022

grokspawn approved these changes Oct 12, 2022

View reviewed changes

jmrodri merged commit ead5efa into operator-framework:master Oct 13, 2022

openshift-cherrypick-robot mentioned this pull request Oct 13, 2022

[v1.24.x] OCPBUGS-1666: Expose flag to enable/disable PodSecurity #6080

Merged

jmrodri mentioned this pull request Nov 23, 2022

Add PSA Flag to Scorecard #6187

Merged

tiraboschi mentioned this pull request Jul 11, 2023

optional-operators/operator-sdk: add a parameter for the security context openshift/release#41134

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-1666: Expose flag to enable/disable PodSecurity#6062

OCPBUGS-1666: Expose flag to enable/disable PodSecurity#6062
jmrodri merged 7 commits into
operator-framework:masterfrom
jmrodri:run-bundle-bug

jmrodri commented Oct 7, 2022 •

edited

Loading

Uh oh!

jmrodri commented Oct 7, 2022

Uh oh!

jmrodri commented Oct 7, 2022 •

edited

Loading

Uh oh!

jmrodri commented Oct 7, 2022

Uh oh!

jmrodri commented Oct 7, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

everettraven left a comment

Uh oh!

Uh oh!

Uh oh!

everettraven left a comment

Uh oh!

jmrodri commented Oct 13, 2022

Uh oh!

openshift-cherrypick-robot commented Oct 13, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

jmrodri commented Oct 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmrodri commented Oct 7, 2022

Uh oh!

jmrodri commented Oct 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmrodri commented Oct 7, 2022

Uh oh!

jmrodri commented Oct 7, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

everettraven left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

everettraven left a comment

Choose a reason for hiding this comment

Uh oh!

jmrodri commented Oct 13, 2022

Uh oh!

openshift-cherrypick-robot commented Oct 13, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jmrodri commented Oct 7, 2022 •

edited

Loading

jmrodri commented Oct 7, 2022 •

edited

Loading