OCPBUGS-20192: Require non-readonly filesystem in router container #981

rfredette · 2023-10-11T16:37:55Z

Setting the filesystem to read only in the router container prevents it from rendering the haproxy config, and causes haproxy to be unable to start. Adding the security context constraint readOnlyRootFilesystem: false makes sure the security profile it is assigned does not require a read only filesystem.

openshift-ci-robot · 2023-10-11T16:38:01Z

@rfredette: This pull request references Jira Issue OCPBUGS-20192, which is invalid:

expected the bug to target the "4.15.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Setting the filesystem to read only in the router container prevents it from rendering the haproxy config, and causes haproxy to be unable to start. Adding the security context constraint readOnlyRootFilesystem: false makes sure the security profile it is assigned does not require a read only filesystem.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rfredette · 2023-10-11T16:39:24Z

/jira refresh

openshift-ci-robot · 2023-10-11T16:39:31Z

@rfredette: This pull request references Jira Issue OCPBUGS-20192, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rfredette · 2023-10-11T20:00:33Z

e2e-aws-ovn failed the infrastructure step, which likely resulted in other failures.
/test e2e-aws-ovn

Miciah

Please add a test case in Test_deploymentConfigChanged and add the bug reference and details from the PR description to the commit message. Otherwise this looks fine.

pkg/operator/controller/ingress/deployment_test.go

rfredette · 2023-10-12T18:57:17Z

I've made the suggested changes. @Miciah and @frobware, PTAL when you have a chance.

rfredette · 2023-10-12T23:10:47Z

Job failure looks unrelated.
/retest

frobware · 2023-10-13T10:22:48Z

pkg/operator/controller/ingress/deployment_test.go

+				boolFalse := false
+				deployment.Spec.Template.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = &boolFalse


Suggested change

boolFalse := false

deployment.Spec.Template.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = &boolFalse

deployment.Spec.Template.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = pointer.Bool(false)

frobware · 2023-10-13T10:23:22Z

pkg/operator/controller/ingress/deployment_test.go

+				boolTrue := true
+				deployment.Spec.Template.Spec.Containers[0].SecurityContext.ReadOnlyRootFilesystem = &boolTrue


Suggested change

boolTrue := true

deployment.Spec.Template.Spec.Containers[0].SecurityContext.ReadOnlyRootFilesystem = &boolTrue

frobware · 2023-10-13T10:24:28Z

pkg/operator/controller/ingress/deployment_test.go

+										AllowPrivilegeEscalation: &boolTrue,
+										ReadOnlyRootFilesystem:   &boolFalse,


Use pointer.Bool here too.

Setting the filesystem to read only in the router container prevents it from rendering the haproxy config, and causes haproxy to be unable to start. Adding the security context constraint readOnlyRootFilesystem: false makes sure the security profile it is assigned does not require a read only filesystem.

Miciah · 2023-10-13T15:09:26Z

/assign

Miciah · 2023-10-13T15:26:49Z

/approve
/lgtm
/hold
for @frobware.

openshift-ci · 2023-10-13T15:28:43Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

candita · 2023-10-13T15:34:48Z

/assign @frobware

frobware · 2023-10-13T15:41:24Z

/hold cancel
/lgtm

openshift-ci-robot · 2023-10-13T16:34:07Z

/retest-required

Remaining retests: 0 against base HEAD d8a3150 and 2 for PR HEAD 9822f2a in total

rfredette · 2023-10-13T18:53:08Z

test failures look to be unrelated
/test e2e-azure-operator
/test e2e-gcp-operator

rfredette · 2023-10-15T18:30:11Z

/retest

openshift-ci · 2023-10-15T20:13:12Z

@rfredette: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-10-15T20:15:56Z

@rfredette: Jira Issue OCPBUGS-20192: All pull requests linked via external trackers have merged:

openshift/cluster-ingress-operator#981

Jira Issue OCPBUGS-20192 has been moved to the MODIFIED state.

In response to this:

Setting the filesystem to read only in the router container prevents it from rendering the haproxy config, and causes haproxy to be unable to start. Adding the security context constraint readOnlyRootFilesystem: false makes sure the security profile it is assigned does not require a read only filesystem.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-merge-robot · 2023-10-17T13:42:40Z

Fix included in accepted release 4.15.0-0.nightly-2023-10-17-065657

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 11, 2023

openshift-ci bot requested review from ShudiLi, frobware and knobunc October 11, 2023 16:39

Miciah reviewed Oct 11, 2023

View reviewed changes

frobware reviewed Oct 12, 2023

View reviewed changes

pkg/operator/controller/ingress/deployment_test.go Outdated Show resolved Hide resolved

rfredette force-pushed the ocpbugs-20192-securityconstraints branch 2 times, most recently from f41e007 to 1a925fb Compare October 12, 2023 18:56

frobware reviewed Oct 13, 2023

View reviewed changes

rfredette force-pushed the ocpbugs-20192-securityconstraints branch from 1a925fb to 9822f2a Compare October 13, 2023 15:01

openshift-ci bot assigned Miciah Oct 13, 2023

openshift-ci bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm Indicates that a PR is ready to be merged. labels Oct 13, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 13, 2023

openshift-ci bot assigned frobware Oct 13, 2023

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 13, 2023

openshift-ci bot merged commit e27d000 into openshift:master Oct 15, 2023
14 checks passed

Miciah mentioned this pull request Apr 10, 2024

AUTH-482: set required-scc for openshift workloads #1031

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-20192: Require non-readonly filesystem in router container #981

OCPBUGS-20192: Require non-readonly filesystem in router container #981

rfredette commented Oct 11, 2023

openshift-ci-robot commented Oct 11, 2023

rfredette commented Oct 11, 2023

openshift-ci-robot commented Oct 11, 2023

rfredette commented Oct 11, 2023

Miciah left a comment

rfredette commented Oct 12, 2023

rfredette commented Oct 12, 2023

frobware Oct 13, 2023

frobware Oct 13, 2023

frobware Oct 13, 2023

Miciah commented Oct 13, 2023

Miciah commented Oct 13, 2023

openshift-ci bot commented Oct 13, 2023

candita commented Oct 13, 2023

frobware commented Oct 13, 2023

openshift-ci-robot commented Oct 13, 2023

rfredette commented Oct 13, 2023

rfredette commented Oct 15, 2023

openshift-ci bot commented Oct 15, 2023

openshift-ci-robot commented Oct 15, 2023

openshift-merge-robot commented Oct 17, 2023

		boolFalse := false
		deployment.Spec.Template.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = &boolFalse

		boolTrue := true
		deployment.Spec.Template.Spec.Containers[0].SecurityContext.ReadOnlyRootFilesystem = &boolTrue

		AllowPrivilegeEscalation: &boolTrue,
		ReadOnlyRootFilesystem: &boolFalse,

OCPBUGS-20192: Require non-readonly filesystem in router container #981

OCPBUGS-20192: Require non-readonly filesystem in router container #981

Conversation

rfredette commented Oct 11, 2023

openshift-ci-robot commented Oct 11, 2023

rfredette commented Oct 11, 2023

openshift-ci-robot commented Oct 11, 2023

rfredette commented Oct 11, 2023

Miciah left a comment

Choose a reason for hiding this comment

rfredette commented Oct 12, 2023

rfredette commented Oct 12, 2023

frobware Oct 13, 2023

Choose a reason for hiding this comment

frobware Oct 13, 2023

Choose a reason for hiding this comment

frobware Oct 13, 2023

Choose a reason for hiding this comment

Miciah commented Oct 13, 2023

Miciah commented Oct 13, 2023

openshift-ci bot commented Oct 13, 2023

candita commented Oct 13, 2023

frobware commented Oct 13, 2023

openshift-ci-robot commented Oct 13, 2023

rfredette commented Oct 13, 2023

rfredette commented Oct 15, 2023

openshift-ci bot commented Oct 15, 2023

openshift-ci-robot commented Oct 15, 2023

openshift-merge-robot commented Oct 17, 2023