Use the most restrictive service account possible #211

lpiwowar · 2024-09-27T13:28:12Z

This PR ensures that the test-operator spawns test pods with the least amount of privileges that are required for successful execution of the tests inside the pods. Three changes had to be made:

Triage rules assigned to serviceAccounts

This patch ensures that serviceAccounts have only such rights that are really needed for the tests execution.

Do not add capabilities when privileged: false

Previously we were adding the NET_ADMIN and NET_RAW capabilities even when privileged: false. This required to run the test pod with privileged scc.

Remove default value for SELinuxLevel

Setting the SELinuxLevel on a test pod requires it to run with elevated scc. This patch removes the default value for the SELinuxLevel (secure by default) and leaves the setting up to the user (when privileged: true is used).

Depends-On: openstack-k8s-operators/ci-framework#2448

softwarefactory-project-zuul · 2024-09-27T18:29:19Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/56b05f9b280a42b88626ffbc6c3a0935

✔️ openstack-k8s-operators-content-provider SUCCESS in 4h 28m 30s
❌ podified-multinode-edpm-deployment-crc-test-operator TIMED_OUT in 3h 11m 14s

lpiwowar · 2024-09-30T15:07:37Z

/retest

lpiwowar · 2024-09-30T15:07:44Z

recheck

softwarefactory-project-zuul · 2024-09-30T19:26:17Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/54961a06a5914faf961d899fa6ef49ba

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 39m 56s
❌ podified-multinode-edpm-deployment-crc-test-operator TIMED_OUT in 3h 11m 25s

softwarefactory-project-zuul · 2024-10-01T14:44:25Z

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/test-operator for 211,02337169a1415ae63f6a2cb3f4726f6629ce780a

lpiwowar · 2024-10-01T14:48:34Z

The commits need to be cleaned up otherwise this should be good for a review and to be merged.

lpiwowar · 2024-10-04T15:53:37Z

controllers/common.go

+	if privileged {
+		rbacPolicyRules = append(rbacPolicyRules, rbacv1.PolicyRule{
+			APIGroups:     []string{"security.openshift.io"},
+			ResourceNames: []string{"anyuid", "privileged"},


I've been just testing the change and we have to enable at least anyuid by default. Marking as draft to prevent from merging.

Ok, so the correct thing would be to use nonroot and nonroot-v2 when privileged: false.

softwarefactory-project-zuul · 2024-10-10T20:34:36Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/075b08fe8a6f4ae2a4df674867e9f575

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 28m 09s
❌ podified-multinode-edpm-deployment-crc-test-operator TIMED_OUT in 3h 10m 24s

softwarefactory-project-zuul · 2024-10-11T15:08:58Z

This change depends on a change that failed to merge.

Change openstack-k8s-operators/ci-framework#2448 is needed.

lpiwowar · 2024-10-11T15:10:28Z

recheck

softwarefactory-project-zuul · 2024-10-11T18:31:24Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/a073abd0643f4fb5864c8fb8725da8bd

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 20m 21s
❌ podified-multinode-edpm-deployment-crc-test-operator TIMED_OUT in 3h 10m 36s

lpiwowar · 2024-10-14T15:42:38Z

recheck

lpiwowar · 2024-10-14T15:42:50Z

recheck

softwarefactory-project-zuul · 2024-10-14T19:42:29Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/9411c73543604f498d0c9beaae0d30f7

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 34m 34s
❌ podified-multinode-edpm-deployment-crc-test-operator TIMED_OUT in 3h 11m 18s

lpiwowar · 2024-10-16T08:42:45Z

/retest

lpiwowar · 2024-10-21T12:25:34Z

/retest

This patch triages the rights that are assigned to serviceAccounts that are related to the test-operator: - serviceAccount used by the test-operator controller - serviceAccount that is associated with instances of test-operator related CRs.

Previously, the test-operator was spawning pods with NET_ADMIN and NET_RAW capabilities even when privileged: false. Setting these two capabilities requires elevated securitycontextconstraint. This commit addresses this issue by using extra capabilities only when privileged: true.

This commit removes the default value of SELinuxLevel. This option should be only used when privileged: true because scc privileged is required when setting SELinuxLevel on a pod. Setting SELinuxLevel is sometimes required in order to be able to allow RWX for a mounted PVC. We're going to move the setting of the SELinuxLevel to ci-framework and leave the default parameters for the test-operator secure. Depends-On: openstack-k8s-operators/ci-framework#2448

This patch updates the test-operator CSV so that it is up to date with the recent changes.

kopecmartin

seems reasonable

openshift-ci · 2024-10-21T14:17:05Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kopecmartin, lpiwowar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [kopecmartin,lpiwowar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

lpiwowar marked this pull request as draft September 27, 2024 13:28

openshift-ci bot requested review from dprince and kstrenkova September 27, 2024 13:28

openshift-ci bot added do-not-merge/work-in-progress approved labels Sep 27, 2024

lpiwowar removed request for dprince and kstrenkova September 27, 2024 13:28

lpiwowar force-pushed the bugfix/privileges branch from b72fc8b to 0233716 Compare October 1, 2024 14:44

openshift-merge-robot added the needs-rebase label Oct 1, 2024

lpiwowar force-pushed the bugfix/privileges branch from 0233716 to 9f0a276 Compare October 1, 2024 14:46

openshift-merge-robot removed the needs-rebase label Oct 1, 2024

lpiwowar force-pushed the bugfix/privileges branch 2 times, most recently from 5b0db4d to 120e74f Compare October 2, 2024 16:07

lpiwowar marked this pull request as ready for review October 2, 2024 16:07

openshift-ci bot removed the do-not-merge/work-in-progress label Oct 2, 2024

openshift-ci bot requested review from kopecmartin and lewisdenny October 2, 2024 16:12

lpiwowar force-pushed the bugfix/privileges branch from 120e74f to 130aaab Compare October 4, 2024 15:10

lpiwowar commented Oct 4, 2024

View reviewed changes

lpiwowar marked this pull request as draft October 4, 2024 15:53

openshift-ci bot added the do-not-merge/work-in-progress label Oct 4, 2024

lpiwowar force-pushed the bugfix/privileges branch 2 times, most recently from 8eb89ec to 21f71d5 Compare October 10, 2024 16:06

lpiwowar force-pushed the bugfix/privileges branch from 4fad2a8 to dff1d50 Compare October 11, 2024 15:07

lpiwowar changed the title ~~Triage privileges~~ Use the most restrictive service account possible Oct 11, 2024

lpiwowar closed this Oct 14, 2024

lpiwowar reopened this Oct 14, 2024

lpiwowar force-pushed the bugfix/privileges branch from dff1d50 to 0b99d45 Compare October 15, 2024 14:37

lpiwowar force-pushed the bugfix/privileges branch 2 times, most recently from aa9a1f1 to cd2908a Compare October 16, 2024 11:42

lpiwowar added 4 commits October 21, 2024 08:55

Triage rules assigned to serviceAccounts

362e28c

This patch triages the rights that are assigned to serviceAccounts that are related to the test-operator: - serviceAccount used by the test-operator controller - serviceAccount that is associated with instances of test-operator related CRs.

Update test-operator CSV

ca67497

This patch updates the test-operator CSV so that it is up to date with the recent changes.

lpiwowar force-pushed the bugfix/privileges branch from cd2908a to ca67497 Compare October 21, 2024 12:56

lpiwowar marked this pull request as ready for review October 21, 2024 13:04

openshift-ci bot removed the do-not-merge/work-in-progress label Oct 21, 2024

openshift-ci bot requested a review from dprince October 21, 2024 13:04

lpiwowar removed request for lewisdenny and dprince October 21, 2024 14:02

kopecmartin approved these changes Oct 21, 2024

View reviewed changes

openshift-ci bot assigned kopecmartin Oct 21, 2024

openshift-ci bot added the lgtm label Oct 21, 2024

openshift-merge-bot bot merged commit eae3554 into openstack-k8s-operators:main Oct 21, 2024
8 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use the most restrictive service account possible #211

Use the most restrictive service account possible #211

lpiwowar commented Sep 27, 2024 •

edited

Loading

softwarefactory-project-zuul bot commented Sep 27, 2024

lpiwowar commented Sep 30, 2024

lpiwowar commented Sep 30, 2024

softwarefactory-project-zuul bot commented Sep 30, 2024

softwarefactory-project-zuul bot commented Oct 1, 2024

lpiwowar commented Oct 1, 2024

lpiwowar Oct 4, 2024

lpiwowar Oct 9, 2024

softwarefactory-project-zuul bot commented Oct 10, 2024

softwarefactory-project-zuul bot commented Oct 11, 2024

lpiwowar commented Oct 11, 2024

softwarefactory-project-zuul bot commented Oct 11, 2024

lpiwowar commented Oct 14, 2024

lpiwowar commented Oct 14, 2024

softwarefactory-project-zuul bot commented Oct 14, 2024

lpiwowar commented Oct 16, 2024

lpiwowar commented Oct 21, 2024

kopecmartin left a comment

openshift-ci bot commented Oct 21, 2024

Use the most restrictive service account possible #211

Use the most restrictive service account possible #211

Conversation

lpiwowar commented Sep 27, 2024 • edited Loading

softwarefactory-project-zuul bot commented Sep 27, 2024

lpiwowar commented Sep 30, 2024

lpiwowar commented Sep 30, 2024

softwarefactory-project-zuul bot commented Sep 30, 2024

softwarefactory-project-zuul bot commented Oct 1, 2024

lpiwowar commented Oct 1, 2024

lpiwowar Oct 4, 2024

Choose a reason for hiding this comment

lpiwowar Oct 9, 2024

Choose a reason for hiding this comment

softwarefactory-project-zuul bot commented Oct 10, 2024

softwarefactory-project-zuul bot commented Oct 11, 2024

lpiwowar commented Oct 11, 2024

softwarefactory-project-zuul bot commented Oct 11, 2024

lpiwowar commented Oct 14, 2024

lpiwowar commented Oct 14, 2024

softwarefactory-project-zuul bot commented Oct 14, 2024

lpiwowar commented Oct 16, 2024

lpiwowar commented Oct 21, 2024

kopecmartin left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Oct 21, 2024

lpiwowar commented Sep 27, 2024 •

edited

Loading