BUG 1806438: Remove explicit securityContext and add granular securitycontextconstraints "use" permissions in machine-api-controllers clusterRole #502

enxebre · 2020-03-02T10:39:09Z

Without the runlabel #496, we’ll run as a high user by default, no need to say run me as non root.

Otherwise when removing the runlevel completely for the openshift-machine-api namespace openshift/cluster-autoscaler-operator#133 the kube controller manager complains with Error creating: pods "machine-api-operator-75c887884f-" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000340000, 1000349999] spec.containers[1].securityContext.securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000340000, 1000349999]] https://storage.googleapis.com/origin-ci-test/pr-logs/pull/openshift_cluster-autoscaler-operator/133/pull-ci-openshift-cluster-autoscaler-operator-master-e2e-aws/496/artifacts/e2e-aws/pods/openshift-kube-controller-manager_kube-controller-manager-ip-10-0-133-251.us-east-2.compute.internal_kube-controller-manager.log"

Only after this PR makes it to payload then https://github.com/openshift/cluster-autoscaler-operator/pull/133/files should go green as no pods within the openshift-machine-api namespace will set an invalid user.

openshift-ci-robot · 2020-03-02T10:39:16Z

@enxebre: This pull request references Bugzilla bug 1806438, which is valid. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2020-03-02T10:42:01Z

@enxebre: This pull request references Bugzilla bug 1806438, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2020-03-02T10:43:59Z

@enxebre: This pull request references Bugzilla bug 1806438, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2020-03-02T10:45:15Z

@enxebre: This pull request references Bugzilla bug 1806438, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

enxebre · 2020-03-02T10:45:47Z

/retest

enxebre · 2020-03-02T10:50:53Z

/cherrypick release-4.4
/cherrypick release-4.3

openshift-cherrypick-robot · 2020-03-02T10:50:54Z

@enxebre: once the present PR merges, I will cherry-pick it on top of release-4.4 in a new PR and assign it to you.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2020-03-02T10:53:25Z

@enxebre: This pull request references Bugzilla bug 1806438, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2020-03-02T10:53:40Z

@enxebre: This pull request references Bugzilla bug 1806438, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

JoelSpeed

/lgtm

markmc · 2020-03-02T11:05:20Z

@enxebre As per comment in openshift/cluster-autoscaler-operator#133 the baremetal pod deployment uses hostNetwork, hostPort, and privileged

/cc @sadasu @stbenjam @hardys

enxebre · 2020-03-02T12:32:52Z

@markmc good catch, I believe adding the specifics SCC to the clusterRole used by the machine-api-controllers should be enough as per openshift/cluster-ingress-operator@1409f54
i.e

- apiGroups:
  - security.openshift.io
  resources:
  - securitycontextconstraints
  verbs:
  - use
  resourceNames:
  - hostnetwork
  - privileged

cc @Miciah @smarterclayton can you confirm?

/hold

smarterclayton · 2020-03-02T13:55:52Z

Yes, although ONLY the component that needs those should have a reference to the SCC via a unique service account.

enxebre · 2020-03-02T14:04:35Z

Agreed, currently our granularity let us give this to the pod which run the multiple machine controllers. In near future we might consider breaking this pod down into multiple components.

/hold cancel
/retest

…raints use permissions in machine-api-controllers clusterRole Without the runlabel openshift#496, we’ll run as a high user by default, no need to say run me as non root. Otherwise when removing the runlevel completely for the openshift-machine-api namespace openshift/cluster-autoscaler-operator#133 the kube controller manager complains with 'Error creating: pods "machine-api-operator-75c887884f-" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000340000, 1000349999] spec.containers[1].securityContext.securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000340000, 1000349999]]' https://storage.googleapis.com/origin-ci-test/pr-logs/pull/openshift_cluster-autoscaler-operator/133/pull-ci-openshift-cluster-autoscaler-operator-master-e2e-aws/496/artifacts/e2e-aws/pods/openshift-kube-controller-manager_kube-controller-manager-ip-10-0-133-251.us-east-2.compute.internal_kube-controller-manager.log"

markmc · 2020-03-03T18:13:57Z

/lgtm

Would be good to get feedback from @sadasu's testing too

sadasu · 2020-03-03T20:47:42Z

/approve
I was able to patch in the latest fix for this PR with the fix for openshift/cluster-autoscaler-operator#133 by e2e baremetal (virtual) deployment. Happy to report that the metal3 pod came up fine and so did all the workers.

enxebre · 2020-03-04T08:25:54Z

/retest

enxebre · 2020-03-05T12:47:18Z

/retest

enxebre · 2020-03-05T18:38:24Z

/test e2e-gcp

JoelSpeed · 2020-03-06T14:30:36Z

/approve

openshift-ci-robot · 2020-03-06T14:32:14Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed, sadasu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

JoelSpeed · 2020-03-06T14:49:39Z

/retest

stlaz · 2020-03-06T14:58:39Z

install/0000_30_machine-api-operator_09_rbac.yaml

+    verbs:
+      - use
+    resourceNames:
+      - privileged


why does the operator require privileged SCC to run?

openshift-bot · 2020-03-06T16:12:51Z

/retest

Please review the full test history for this PR and help us cut down flakes.

stlaz · 2020-03-06T16:17:04Z

/hold

if this was the only problem then just the removal of runAsUser should do

enxebre · 2020-03-09T10:19:27Z

/retest

enxebre · 2020-03-10T10:02:45Z

/hold cancel

openshift-bot · 2020-03-10T12:36:25Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-03-10T12:49:25Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-03-10T14:07:45Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-03-10T16:43:50Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-cherrypick-robot · 2020-03-10T18:07:53Z

@enxebre: new pull request created: #511

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Mar 2, 2020

openshift-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Mar 2, 2020

openshift-ci-robot requested review from bison and michaelgugino March 2, 2020 10:40

JoelSpeed reviewed Mar 2, 2020

View reviewed changes

openshift-ci-robot assigned JoelSpeed Mar 2, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 2, 2020

openshift-ci-robot requested review from hardys, sadasu and stbenjam March 2, 2020 11:05

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 2, 2020

enxebre force-pushed the remove-scc branch from 0c7a935 to 1bed517 Compare March 2, 2020 12:40

openshift-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed lgtm Indicates that a PR is ready to be merged. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 2, 2020

enxebre changed the title ~~BUG 1806438: Remove explicit securityContext~~ BUG 1806438: Remove explicit securityContext and add granular securitycontextconstraints "use" permissions in machine-api-controllers clusterRole Mar 2, 2020

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 2, 2020

enxebre force-pushed the remove-scc branch from d8314bb to 08a4e21 Compare March 3, 2020 17:50

openshift-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed lgtm Indicates that a PR is ready to be merged. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 3, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 3, 2020

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 6, 2020

stlaz reviewed Mar 6, 2020

View reviewed changes

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 6, 2020

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 10, 2020

enxebre mentioned this pull request Mar 10, 2020

BUG 1806438: Drop run-level openshift/cluster-autoscaler-operator#133

Merged

openshift-merge-robot merged commit c63fa2b into openshift:master Mar 10, 2020

openshift-cherrypick-robot mentioned this pull request Mar 10, 2020

BUG 1806439: Remove explicit securityContext and add granular securitycontextconstraints "use" permissions in machine-api-controllers clusterRole #511

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BUG 1806438: Remove explicit securityContext and add granular securitycontextconstraints "use" permissions in machine-api-controllers clusterRole #502

BUG 1806438: Remove explicit securityContext and add granular securitycontextconstraints "use" permissions in machine-api-controllers clusterRole #502

enxebre commented Mar 2, 2020 •

edited

openshift-ci-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

enxebre commented Mar 2, 2020

enxebre commented Mar 2, 2020

openshift-cherrypick-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

JoelSpeed left a comment

markmc commented Mar 2, 2020

enxebre commented Mar 2, 2020 •

edited

smarterclayton commented Mar 2, 2020

enxebre commented Mar 2, 2020

markmc commented Mar 3, 2020

sadasu commented Mar 3, 2020

enxebre commented Mar 4, 2020

enxebre commented Mar 5, 2020

enxebre commented Mar 5, 2020

JoelSpeed commented Mar 6, 2020

openshift-ci-robot commented Mar 6, 2020

JoelSpeed commented Mar 6, 2020

stlaz Mar 6, 2020

openshift-bot commented Mar 6, 2020

stlaz commented Mar 6, 2020 •

edited

enxebre commented Mar 9, 2020

enxebre commented Mar 10, 2020

openshift-bot commented Mar 10, 2020

openshift-bot commented Mar 10, 2020

openshift-bot commented Mar 10, 2020

openshift-bot commented Mar 10, 2020

openshift-cherrypick-robot commented Mar 10, 2020

BUG 1806438: Remove explicit securityContext and add granular securitycontextconstraints "use" permissions in machine-api-controllers clusterRole #502

BUG 1806438: Remove explicit securityContext and add granular securitycontextconstraints "use" permissions in machine-api-controllers clusterRole #502

Conversation

enxebre commented Mar 2, 2020 • edited

openshift-ci-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

enxebre commented Mar 2, 2020

enxebre commented Mar 2, 2020

openshift-cherrypick-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

openshift-ci-robot commented Mar 2, 2020

JoelSpeed left a comment

Choose a reason for hiding this comment

markmc commented Mar 2, 2020

enxebre commented Mar 2, 2020 • edited

smarterclayton commented Mar 2, 2020

enxebre commented Mar 2, 2020

markmc commented Mar 3, 2020

sadasu commented Mar 3, 2020

enxebre commented Mar 4, 2020

enxebre commented Mar 5, 2020

enxebre commented Mar 5, 2020

JoelSpeed commented Mar 6, 2020

openshift-ci-robot commented Mar 6, 2020

JoelSpeed commented Mar 6, 2020

stlaz Mar 6, 2020

Choose a reason for hiding this comment

openshift-bot commented Mar 6, 2020

stlaz commented Mar 6, 2020 • edited

enxebre commented Mar 9, 2020

enxebre commented Mar 10, 2020

openshift-bot commented Mar 10, 2020

openshift-bot commented Mar 10, 2020

openshift-bot commented Mar 10, 2020

openshift-bot commented Mar 10, 2020

openshift-cherrypick-robot commented Mar 10, 2020

enxebre commented Mar 2, 2020 •

edited

enxebre commented Mar 2, 2020 •

edited

stlaz commented Mar 6, 2020 •

edited