Bug 1824800: explicitly set oauth-server container's root file system to writable #273

stlaz · 2020-04-17T15:19:23Z

We are doing root write with the copying of the trusted cert bundle
so we unfortunately need the FS to be writable.

The SA running the pod has broad privileges and if there's a more
restrictive SCC with higher priority than what anyuid has, this
would make the container fail to start as it would choose to
default to non-writable root system.

openshift-ci-robot · 2020-04-17T15:19:37Z

@stlaz: This pull request references Bugzilla bug 1824800, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1824800: explicitly set oauth-server container's root file system to writable

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

stlaz · 2020-04-20T06:56:54Z

/retest

bindata/oauth-openshift/deployment.yaml

sttts · 2020-04-21T07:59:59Z

bindata/oauth-openshift/deployment.yaml

@@ -62,6 +62,8 @@ spec:
            - name: https
              containerPort: 6443
              protocol: TCP
+          securityContext:
+            readOnlyRootFilesystem: false # because of the `cm` in args


🤦 somebody kill me please

stlaz · 2020-04-21T11:19:30Z

/hold
need to fix the operator, too, I shouldn't start with fixes in late afternoons

…to writable We are doing root write with the copying of the trusted cert bundle so we unfortunately need the FS to be writable. The SA running the pod has broad privileges and if there's a more restrictive SCC with higher priority than what anyuid has, this would make the container fail to start as it would choose to default to non-writable root system.

stlaz · 2020-04-21T11:29:12Z

/hold cancel

sttts · 2020-04-21T11:59:39Z

bindata/oauth-openshift/deployment.yaml

@@ -62,6 +62,8 @@ spec:
            - name: https
              containerPort: 6443
              protocol: TCP
+          securityContext:
+            readOnlyRootFilesystem: false # because of the `cp` in args


@smarterclayton how do you feel about this? Any workaround? Note: we copy the proxy CA to /etc.

sttts · 2020-05-26T13:00:33Z

/lgtm

openshift-ci-robot · 2020-05-26T13:00:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stlaz, sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [stlaz,sttts]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2020-05-26T15:05:10Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot · 2020-05-26T16:36:46Z

@stlaz: All pull requests linked via external trackers have merged: openshift/cluster-authentication-operator#273. Bugzilla bug 1824800 has been moved to the MODIFIED state.

In response to this:

Bug 1824800: explicitly set oauth-server container's root file system to writable

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2020-06-01T09:29:05Z

@stlaz: cannot checkout 4.4: error checking out 4.4: exit status 1. output: error: pathspec '4.4' did not match any file(s) known to git.

In response to this:

/cherry-pick 4.4
/cherry-pick 4.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

stlaz · 2020-06-01T09:29:28Z

/cherry-pick release-4.4

openshift-cherrypick-robot · 2020-06-01T09:29:35Z

@stlaz: new pull request created: #286

In response to this:

/cherry-pick release-4.4

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

stlaz · 2020-06-01T09:29:54Z

/cherry-pick release-4.3

openshift-cherrypick-robot · 2020-06-01T09:30:01Z

@stlaz: #273 failed to apply on top of branch "release-4.3":

error: Failed to merge in the changes.
Using index info to reconstruct a base tree...
A	bindata/oauth-openshift/deployment.yaml
M	manifests/07_deployment.yaml
A	pkg/operator2/assets/bindata.go
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): pkg/operator2/assets/bindata.go deleted in HEAD and modified in explicitly set operator's and operand's container's root file system to writable. Version explicitly set operator's and operand's container's root file system to writable of pkg/operator2/assets/bindata.go left in tree.
Auto-merging manifests/07_deployment.yaml
CONFLICT (modify/delete): bindata/oauth-openshift/deployment.yaml deleted in HEAD and modified in explicitly set operator's and operand's container's root file system to writable. Version explicitly set operator's and operand's container's root file system to writable of bindata/oauth-openshift/deployment.yaml left in tree.
Patch failed at 0001 explicitly set operator's and operand's container's root file system to writable

In response to this:

/cherry-pick release-4.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

stlaz changed the title ~~explicitly set oauth-server container's root file system to writable~~ Bug 1824800: explicitly set oauth-server container's root file system to writable Apr 17, 2020

openshift-ci-robot added the bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. label Apr 17, 2020

openshift-ci-robot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Apr 17, 2020

openshift-ci-robot requested review from deads2k and sttts April 17, 2020 15:19

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 17, 2020

sttts reviewed Apr 20, 2020

View reviewed changes

bindata/oauth-openshift/deployment.yaml Outdated Show resolved Hide resolved

stlaz force-pushed the write_fs_payload branch from eb80ba6 to b3bbf35 Compare April 20, 2020 14:50

sttts reviewed Apr 21, 2020

View reviewed changes

stlaz force-pushed the write_fs_payload branch from b3bbf35 to 0219dcf Compare April 21, 2020 08:22

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 21, 2020

stlaz force-pushed the write_fs_payload branch from 0219dcf to c857739 Compare April 21, 2020 11:28

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 21, 2020

sttts reviewed Apr 21, 2020

View reviewed changes

stlaz mentioned this pull request May 11, 2020

oauth-openshift pod failed to start due to permission issue. #283

Closed

openshift-ci-robot assigned sttts May 26, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label May 26, 2020

openshift-merge-robot merged commit 61cd967 into openshift:master May 26, 2020

openshift-cherrypick-robot mentioned this pull request Jun 1, 2020

[release-4.4] Bug 1842442: explicitly set oauth-server container's root file system to writable #286

Merged

stlaz deleted the write_fs_payload branch July 2, 2020 09:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bug 1824800: explicitly set oauth-server container's root file system to writable #273

Bug 1824800: explicitly set oauth-server container's root file system to writable #273

stlaz commented Apr 17, 2020

openshift-ci-robot commented Apr 17, 2020

stlaz commented Apr 20, 2020

sttts Apr 21, 2020

stlaz Apr 21, 2020

stlaz commented Apr 21, 2020

stlaz commented Apr 21, 2020

sttts Apr 21, 2020

sttts commented May 26, 2020

openshift-ci-robot commented May 26, 2020

openshift-bot commented May 26, 2020

openshift-ci-robot commented May 26, 2020

openshift-cherrypick-robot commented Jun 1, 2020

stlaz commented Jun 1, 2020

openshift-cherrypick-robot commented Jun 1, 2020

stlaz commented Jun 1, 2020

openshift-cherrypick-robot commented Jun 1, 2020

Bug 1824800: explicitly set oauth-server container's root file system to writable #273

Bug 1824800: explicitly set oauth-server container's root file system to writable #273

Conversation

stlaz commented Apr 17, 2020

openshift-ci-robot commented Apr 17, 2020

stlaz commented Apr 20, 2020

sttts Apr 21, 2020

Choose a reason for hiding this comment

stlaz Apr 21, 2020

Choose a reason for hiding this comment

stlaz commented Apr 21, 2020

stlaz commented Apr 21, 2020

sttts Apr 21, 2020

Choose a reason for hiding this comment

sttts commented May 26, 2020

openshift-ci-robot commented May 26, 2020

openshift-bot commented May 26, 2020

openshift-ci-robot commented May 26, 2020

openshift-cherrypick-robot commented Jun 1, 2020

stlaz commented Jun 1, 2020

openshift-cherrypick-robot commented Jun 1, 2020

stlaz commented Jun 1, 2020

openshift-cherrypick-robot commented Jun 1, 2020