Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove specific UID from cluster-storage-operator #316

Merged
merged 1 commit into from Oct 12, 2022
Merged

Remove specific UID from cluster-storage-operator #316

merged 1 commit into from Oct 12, 2022

Conversation

jsafrane
Copy link
Contributor

OCP will assign its own UID to the Pod. This helps in HyperShift, where UIDs of different guest control planes should be different.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 16, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jsafrane

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 16, 2022
@jsafrane
Copy link
Contributor Author

cc @openshift/storage

@jsafrane
Copy link
Contributor Author

/label docs-approved
/label px-approved
this is not a user-facing change

@openshift-ci openshift-ci bot added docs-approved Signifies that Docs has signed off on this PR px-approved Signifies that Product Support has signed off on this PR labels Sep 16, 2022
gnufied
gnufied reviewed Sep 19, 2022
View reviewed changes
manifests/10_deployment.yaml
runAsNonRoot: true
runAsUser: 10400
seccompProfile:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CSO seems to be running in nonroot-v2 SCC , which has following policies:

fsGroup:
  type: RunAsAny

Have you tested if this still results in assigning a fsgroup to the pod?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, CI shows that CSO runs with some fsGroup:

https://prow.ci.openshift.org/view/gs/origin-ci-test/pr-logs/pull/openshift_cluster-storage-operator/316/pull-ci-openshift-cluster-storage-operator-master-e2e-azure-csi/1570712022071382016

https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/origin-ci-test/pr-logs/pull/openshift_cluster-storage-operator/316/pull-ci-openshift-cluster-storage-operator-master-e2e-azure-csi/1570712022071382016/artifacts/e2e-azure-csi/gather-extra/artifacts/pods.json

                "name": "cluster-storage-operator-6db7799b89-rxmhq",
                "namespace": "openshift-cluster-storage-operator",
...

                "securityContext": {
                    "fsGroup": 1000150000,
                    "runAsNonRoot": true,
                    "seLinuxOptions": {
                        "level": "s0:c12,c9"
                    },
                    "seccompProfile": {
                        "type": "RuntimeDefault"
                    }
                },
                "serviceAccount": "cluster-storage-operator",
                "serviceAccountName": "cluster-storage-operator",

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW, SCC changed to:

                    "openshift.io/scc": "restricted-v2",

@gnufied
Copy link
Member

gnufied commented Sep 20, 2022

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 20, 2022
@jsafrane
Copy link
Contributor Author

jsafrane commented Oct 4, 2022

/retest-required

@ropatil010
Copy link

/label qe-approved

@openshift-ci openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Oct 4, 2022
@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 53afa77 and 2 for PR HEAD 8ce29fb in total

@jsafrane
Copy link
Contributor Author

jsafrane commented Oct 7, 2022

/retest

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 401cb8b and 1 for PR HEAD 8ce29fb in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 87e0c41 and 0 for PR HEAD 8ce29fb in total

@openshift-ci-robot
Copy link
Contributor

/hold

Revision 8ce29fb was retested 3 times: holding

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 11, 2022
@jsafrane
Copy link
Contributor Author

/hold cancel
/retest

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 12, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 12, 2022

@jsafrane: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-merge-robot openshift-merge-robot merged commit 5101779 into openshift:master Oct 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gnufied gnufied gnufied left review comments

@dobsonj dobsonj Awaiting requested review from dobsonj

@tsmetana tsmetana Awaiting requested review from tsmetana

Assignees

@gnufied gnufied

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. docs-approved Signifies that Docs has signed off on this PR lgtm Indicates that a PR is ready to be merged. px-approved Signifies that Product Support has signed off on this PR qe-approved Signifies that QE has signed off on this PR
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@jsafrane @gnufied @ropatil010 @openshift-ci-robot @openshift-merge-robot