Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RHDEVDOCS-3306: Document running image build tasks as unprivileged builds #44733

Closed
wants to merge 1 commit into from
Closed

RHDEVDOCS-3306: Document running image build tasks as unprivileged builds #44733

wants to merge 1 commit into from

Conversation

HarshCasper
Copy link
Contributor

@HarshCasper HarshCasper commented Apr 20, 2022 •
edited by abrennan89

@netlify
Copy link

netlify bot commented Apr 20, 2022 •
edited

✅ Deploy Preview for osdocs ready!

Name Link
🔨 Latest commit e51a3c8f3e883c7332158f689b302f72fba5ce05
🔍 Latest deploy log https://app.netlify.com/sites/osdocs/deploys/62725929aead870008037a49
😎 Deploy Preview https://deploy-preview-44733--osdocs.netlify.app/openshift-enterprise/latest/cicd/pipelines/running-workloads-and-buildah-as-user-namespaces-on-openshift-pipelines
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

@openshift-ci openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 20, 2022
chmouel
chmouel reviewed Apr 21, 2022
View reviewed changes
modules/op-security-with-custom-scc.adoc Outdated Show resolved Hide resolved
modules/op-security-with-custom-scc.adoc Outdated Show resolved Hide resolved
@HarshCasper HarshCasper force-pushed the RHDEVDOCS-3306 branch 2 times, most recently from 8b73e1f to b33ca75 Compare April 21, 2022 18:01
@rolfedh
Copy link
Contributor

rolfedh commented Apr 22, 2022

Please make sure to include elements/follow practices that are required by the mod docs standard and Jupiter.
Here's an excerpt from a template that I generated using the newdoc tool. (I used "trash" as the filename, so ignore that.) Some of these requirements involve:

  • the file name
  • the id
  • the content type
////
Base the file name and the ID on the module title. For example:
* file name: proc-doing-procedure-a.adoc
* ID: [id="proc-doing-procedure-a_{context}"]
* Title: = Doing procedure A

The ID is an anchor that links to the module. Avoid changing it after the module has been published to ensure existing links are not broken.

The `context` attribute enables module reuse. Every module ID includes {context}, which ensures that the module has a unique ID even if it is reused multiple times in a guide.
////

////
Indicate the module type in one of the following
ways:
Add the prefix proc- or proc_ to the file name.
Add the following attribute before the module ID:
////
:_content-type: PROCEDURE

[id="proc_trash_{context}"]
= trash

abrennan89
abrennan89 requested changes Jun 15, 2022
View reviewed changes
Copy link
Contributor

@abrennan89 abrennan89 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some review comments. Happy to take another look once a new preview has been added.

See https://docs.google.com/document/u/2/d/e/2PACX-1vRLKWEMHQ3DZroxZKfTu3XcrSdREr6D3oSSayBanEprXhkA2Ciyr2SQuDTYI4aIKUiOPPIQMHgjHeh8/pub#h.vrlifsbvvjd8 for instructions on adding a manual preview @HarshCasper

@abrennan89 abrennan89 added the dev-tools Label for all Odo/Pipelines/Helm/Developer Console/Perspective PRs label Jun 15, 2022
@abrennan89
Copy link
Contributor

@HarshCasper please also add the affected versions to the description

abrennan89
abrennan89 requested changes Jun 15, 2022
View reviewed changes
Copy link
Contributor

@abrennan89 abrennan89 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a review

cicd/pipelines/running-workloads-and-buildah-as-user-namespaces-on-openshift-pipelines.adoc Outdated Show resolved Hide resolved
modules/op-running-as-root-user-namespace.adoc Outdated Show resolved Hide resolved
modules/op-running-as-root-user-namespace.adoc Show resolved Hide resolved
modules/op-running-as-root-user-namespace.adoc Outdated Show resolved Hide resolved
modules/op-running-as-root-user-namespace.adoc Outdated Show resolved Hide resolved
modules/op-running-unpriveleged-builds-in-a-container.adoc Outdated Show resolved Hide resolved
modules/op-running-unpriveleged-builds-in-a-container.adoc Outdated Show resolved Hide resolved
modules/op-using-custom-scc-to-improve-prod-security.adoc Show resolved Hide resolved
modules/op-using-custom-scc-to-improve-prod-security.adoc Outdated Show resolved Hide resolved
modules/op-using-custom-scc-to-improve-prod-security.adoc
* Edit the `pipelines-scc` and modify the `runAsUser` and `seLinuxContext`.

[source,yaml,subs="attributes+"]
----
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comment as per runAsUser and seLinuxContext - literals should always have a noun explaining them

@HarshCasper HarshCasper force-pushed the RHDEVDOCS-3306 branch 2 times, most recently from 638e40c to a91e16f Compare June 17, 2022 17:07
HarshCasper
HarshCasper commented Jun 17, 2022
View reviewed changes
modules/op-running-unpriveleged-builds-in-a-container.adoc Outdated
Comment on lines 43 to 66
The following output is displayed:
+
[source,terminal]
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need SME input here.

ppitonak
ppitonak suggested changes Jun 21, 2022
View reviewed changes
modules/op-running-unpriveleged-builds-in-a-container.adoc Outdated Show resolved Hide resolved
modules/op-running-unpriveleged-builds-in-a-container.adoc Outdated Show resolved Hide resolved
modules/op-running-unpriveleged-builds-in-a-container.adoc
...
----

. Test it using the above `ConfigMap` object workspace along with a sample DockerFile and a sample taskrun.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which sample?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Who is this question for? As the SMEs here, @chmouel and @ppitonak, please make actionable recommendations.

modules/op-using-custom-scc-to-improve-prod-security.adoc Outdated

.Procedure

* Edit the `pipelines-scc` and modify the `runAsUser` and `seLinuxContext`:
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMHO it's safer to create a new SCC. This one is managed by operator so it could be removed or changed after updating OpenShift Pipelines.

rolfedh
rolfedh reviewed Jun 23, 2022
View reviewed changes
modules/op-running-as-root-user-namespace.adoc Outdated
:_content-type: PROCEDURE

[id="op-running-as-root-user-namespace_{context}"]
= Running as root in a user namespace
Copy link
Contributor

@rolfedh rolfedh Jun 23, 2022 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on Jake's comment below, how about:

Suggested change
= Running as root in a user namespace
= Running buildah as root in a user namespace

Okay @jc-berger ?

@HarshCasper HarshCasper closed this Jul 5, 2022
@HarshCasper HarshCasper deleted the RHDEVDOCS-3306 branch July 5, 2022 07:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@chmouel chmouel chmouel left review comments

@rolfedh rolfedh rolfedh requested changes

@siamaksade siamaksade siamaksade left review comments

@sferich888 sferich888 sferich888 left review comments

@bburt-rh bburt-rh bburt-rh left review comments

@ppitonak ppitonak ppitonak requested changes

@abrennan89 abrennan89 abrennan89 requested changes

@jc-berger jc-berger jc-berger requested changes

Assignees
No one assigned
Labels
branch/enterprise-4.10 branch/enterprise-4.11 dev-tools Label for all Odo/Pipelines/Helm/Developer Console/Perspective PRs size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
9 participants
@HarshCasper @rolfedh @abrennan89 @chmouel @ppitonak @siamaksade @sferich888 @jc-berger @bburt-rh