Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug 2088202: Adjust the namespace for the restricted Pod Security Admission #38

Merged
merged 2 commits into from
May 23, 2022

Conversation

jhrozek
Copy link

@jhrozek jhrozek commented May 19, 2022

The PR contains two patches:

  1. deploy: Label the operator namespace so that the privileged Pod Security Admission can be used
    On clusters where Pod Security Admission is used and the restricted profile
    is used by default, namespaces where privileged workloads are running must
    be labeled with the appropriate pod-security.kubernetes.io/XXX:YYY labels
    to allow privileged execution.

  2. deploy: Tighten operator securityContext

  • makes the operator and some workloads run as non root explicitly
  • drops all caps where appropriate

@jhrozek jhrozek changed the title Adjust the namespace for the restricted Pod Security Admission Bug 2088202: Adjust the namespace for the restricted Pod Security Admission May 19, 2022
@openshift-ci
Copy link

openshift-ci bot commented May 19, 2022

@jhrozek: This pull request references Bugzilla bug 2088202, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.11.0) matches configured target release for branch (4.11.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 2088202: Adjust the namespace for the restricted Pod Security Admission

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@jhrozek
Copy link
Author

jhrozek commented May 19, 2022

/retest

@jhrozek
Copy link
Author

jhrozek commented May 19, 2022

@xiaojiey PTAL

@jhrozek
Copy link
Author

jhrozek commented May 19, 2022

/hold
so that @xiaojiey has a chance to test

@xiaojiey
Copy link
Collaborator

/bugzilla cc-qa

@openshift-ci
Copy link

openshift-ci bot commented May 20, 2022

@xiaojiey: This pull request references Bugzilla bug 2088202, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.11.0) matches configured target release for branch (4.11.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)
Bugzilla bug 2088202 does not have a QA contact, skipping assignment

In response to this:

/bugzilla cc-qa

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@xiaojiey
Copy link
Collaborator

/label qe-approved

@openshift-ci
Copy link

openshift-ci bot commented May 20, 2022

@xiaojiey: The label(s) qe-approved cannot be applied, because the repository doesn't have them.

In response to this:

/label qe-approved

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@xiaojiey
Copy link
Collaborator

/label qe-approved

@openshift-ci
Copy link

openshift-ci bot commented May 20, 2022

@xiaojiey: The label(s) qe-approved cannot be applied, because the repository doesn't have them.

In response to this:

/label qe-approved

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@xiaojiey
Copy link
Collaborator

/lgtm

@openshift-ci
Copy link

openshift-ci bot commented May 20, 2022

@xiaojiey: changing LGTM is restricted to collaborators

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@xiaojiey
Copy link
Collaborator

/bugzilla cc-qa

@openshift-ci
Copy link

openshift-ci bot commented May 20, 2022

@xiaojiey: This pull request references Bugzilla bug 2088202, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.11.0) matches configured target release for branch (4.11.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @xiaojiey

In response to this:

/bugzilla cc-qa

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci
Copy link

openshift-ci bot commented May 20, 2022

@openshift-ci[bot]: GitHub didn't allow me to request PR reviews from the following users: xiaojiey.

Note that only ComplianceAsCode members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

@xiaojiey: This pull request references Bugzilla bug 2088202, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.11.0) matches configured target release for branch (4.11.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @xiaojiey

In response to this:

/bugzilla cc-qa

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@xiaojiey
Copy link
Collaborator

/label qe-approved

@openshift-ci
Copy link

openshift-ci bot commented May 20, 2022

@xiaojiey: The label(s) qe-approved cannot be applied, because the repository doesn't have them.

In response to this:

/label qe-approved

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@jhrozek
Copy link
Author

jhrozek commented May 20, 2022

/hold cancel
because the testing went well

…ity Admission can be used

On clusters where Pod Security Admission is used and the restricted
profile is used by default, namespaces where privileged workloads are
running must be labeled with the appropriate
pod-security.kubernetes.io/XXX:YYY labels to allow privileged execution.
- makes the operator and some workloads run as non root explicitly
- drops all caps where appropriate
@jhrozek
Copy link
Author

jhrozek commented May 20, 2022

The new version just adds CHANGELOG entries.

Copy link

@Vincent056 Vincent056 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci
Copy link

openshift-ci bot commented May 20, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhrozek, Vincent056

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jhrozek jhrozek merged commit 7d37ae7 into ComplianceAsCode:master May 23, 2022
@openshift-ci
Copy link

openshift-ci bot commented May 23, 2022

@jhrozek: All pull requests linked via external trackers have merged:

Bugzilla bug 2088202 has been moved to the MODIFIED state.

In response to this:

Bug 2088202: Adjust the namespace for the restricted Pod Security Admission

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants