[WIP] PSA Updates #2810

perdasilva · 2022-07-04T12:19:23Z

Description of the change:
This PR updates the namespace and operator deployment resources and the catalog source and bundle unpacker job to enforce the PSA restricted profile.

NOTE These changes will break sqlite-based catalog sources due to a bug in opm fix, in which a copy of the database was made on the root of the filesystem.

Motivation for the change:
Upstream k8s is rolling out the new Pod Security Admission (PSA) mechanism to improve cluster security and substitute the Pod Security Policies feature link.

Architectural changes:
None

Testing remarks:
Manually tested on kind with k8s 1.24

Reviewer Checklist

* Update ci artifact collection Signed-off-by: perdasilva <perdasilva@redhat.com> * Update e2e test images to use FBC Signed-off-by: perdasilva <perdasilva@redhat.com> * Update CatalogSource Pod security context Signed-off-by: perdasilva <perdasilva@redhat.com>

* Update unpack job security Signed-off-by: perdasilva <perdasilva@redhat.com> * Refactor catsrc pod creation to use security package Signed-off-by: perdasilva <perdasilva@redhat.com>

Signed-off-by: perdasilva <perdasilva@redhat.com>

openshift-ci · 2022-07-04T12:19:38Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: perdasilva

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [perdasilva]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

camilamacedo86 · 2022-07-04T12:31:47Z

deploy/chart/templates/0000_50_olm_08-catalog-operator.deployment.yaml

      serviceAccountName: olm-operator-serviceaccount
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001


This one cannot be qualified to access restricted-v2 because of the runAsUser
That will requires access to anyuid SCC. However, if we test in k8s env that can run in a restricted ns and is qualified under the k8s rules to be restricted. See:

⚠️ With some configurations your solution might comply with the restricted Kubernetes definition but will not be accepted under the SCC restricted-v2 in OCP. In K8s you can specify the runAsUser and get the Pod/Container running in a restricted namespace however, for Openshift’s restricted/restricted-v2 SCC you MUST leave the runAsUser field empty, or provide a value that falls within the specific user range for the namespace. Otherwise, you will only be able to run the Pod if it has access to the SCC nonroot-v2 or anyuid.

Therefore, do we really need to define userId?

⚠️ Be aware that this code will not work on OCP since there you would need to define a user in a big range. The range is not fixed as well and depends on the ns. So, the best approach is not needed to define it at all. Following an example of the error that will be faced if we try to apply this config in OCP:

Leave the runAsUser field empty, or provide a value that falls within the specific user range for the namespace. provide a value in the ranges: [1000680000, 1000689999

camilamacedo86 · 2022-07-04T12:40:34Z

Dockerfile

 WORKDIR /build

-# install dependencies and go 1.16
+# install dependencies and go 1.17


Any reason for we are not using 1.18 yet?

We probably should move to 1.18 here - though I think it should be done in another PR

camilamacedo86 · 2022-07-04T12:43:34Z

pkg/controller/security/security.go

+		RunAsNonRoot: pointer.Bool(runAsNonRoot),
+		RunAsUser:    pointer.Int64(runAsUser),
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeRuntimeDefault,


⚠️ It only works on OCP >= 4.11 and k8s >= 1.19

Signed-off-by: perdasilva <perdasilva@redhat.com>

camilamacedo86 · 2022-07-04T14:41:56Z

pkg/controller/bundle/bundle_unpacker_test.go

+
+	var expectedPodSecurityContext = &corev1.PodSecurityContext{
+		RunAsNonRoot: &expectedRunAsNonRoot,
+		RunAsUser:    &expectedRunAsUser,


@perdasilva ^

camilamacedo86 · 2022-07-04T14:42:16Z

pkg/controller/registry/reconciler/reconciler.go

 	}

+	// Update pod security
+	security.ApplyPodSpecSecurity(&pod.Spec, security.WithRunAsUser(1001))


@perdasilva ^

camilamacedo86 · 2022-07-04T14:42:26Z

pkg/controller/registry/reconciler/reconciler_test.go

 	expectedReadOnlyRootFilesystem := false
+	expectedAllowPrivilegeEscalation := false
+	expectedRunAsNonRoot := true
+	expectedRunAsUser := int64(1001)


We need to use RunAsUser for the catalog source pods for now. Otherwise, only catalogs based off the latest opm image will work. We may need to handle this like a deprecation or something like that giving people some time to rebuild their catalogs.

Signed-off-by: perdasilva <perdasilva@redhat.com>

perdasilva · 2022-07-05T08:48:50Z

/hold until we figure out how to migrate. These changes are only valid from k8s >= 1.19. Should we cut a release before merging and only support 1.19 going forward?

Signed-off-by: perdasilva <perdasilva@redhat.com>

openshift-ci · 2022-07-11T22:28:14Z

@perdasilva: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

anik120 · 2022-08-23T18:33:33Z

/close

as this is out of date.

openshift-ci · 2022-08-23T18:33:38Z

@anik120: Closed this PR.

In response to this:

/close

as this is out of date.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

perdasilva added 3 commits July 4, 2022 11:56

Update unpack job pod security (operator-framework#2793)

17a5b6d

* Update unpack job security Signed-off-by: perdasilva <perdasilva@redhat.com> * Refactor catsrc pod creation to use security package Signed-off-by: perdasilva <perdasilva@redhat.com>

Update namespace and deployments for PSA restricted profile

3dc3e46

Signed-off-by: perdasilva <perdasilva@redhat.com>

openshift-ci bot requested review from awgreene and njhale July 4, 2022 12:19

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 4, 2022

camilamacedo86 reviewed Jul 4, 2022

View reviewed changes

Remove RunAsUser for everything except the catalog source pods

f0c1f90

Signed-off-by: perdasilva <perdasilva@redhat.com>

camilamacedo86 reviewed Jul 4, 2022

View reviewed changes

Fix unit test

8026756

Signed-off-by: perdasilva <perdasilva@redhat.com>

perdasilva force-pushed the catsrc_psa branch from d93481b to 8026756 Compare July 5, 2022 08:47

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 5, 2022

perdasilva added 2 commits July 5, 2022 13:50

Update dockerfiles with user 1001

8f33460

Signed-off-by: perdasilva <perdasilva@redhat.com>

Use RunAsUser for bundle unpack job

3cc6ae8

Signed-off-by: perdasilva <perdasilva@redhat.com>

perdasilva changed the title ~~PSA Updates~~ [WIP] PSA Updates Jul 7, 2022

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jul 7, 2022

This was referenced Aug 18, 2022

(psa) make marketplace namespace restricted operator-framework/operator-marketplace#484

Merged

(psa) restrict olm namespace + remove labels from openshift-operators ns openshift/operator-framework-olm#367

Merged

openshift-ci bot closed this Aug 23, 2022

[WIP] PSA Updates #2810

[WIP] PSA Updates #2810

Uh oh!

Conversation

perdasilva commented Jul 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Jul 4, 2022

Uh oh!

camilamacedo86 Jul 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

camilamacedo86 Jul 4, 2022

Choose a reason for hiding this comment

Uh oh!

perdasilva Jul 4, 2022

Choose a reason for hiding this comment

Uh oh!

camilamacedo86 Jul 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

camilamacedo86 Jul 4, 2022

Choose a reason for hiding this comment

Uh oh!

camilamacedo86 Jul 4, 2022

Choose a reason for hiding this comment

Uh oh!

camilamacedo86 Jul 4, 2022

Choose a reason for hiding this comment

Uh oh!

perdasilva Jul 4, 2022

Choose a reason for hiding this comment

Uh oh!

perdasilva commented Jul 5, 2022

Uh oh!

openshift-ci bot commented Jul 11, 2022

Uh oh!

anik120 commented Aug 23, 2022

Uh oh!

openshift-ci bot commented Aug 23, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

perdasilva commented Jul 4, 2022 •

edited

Loading

camilamacedo86 Jul 4, 2022 •

edited

Loading

camilamacedo86 Jul 4, 2022 •

edited

Loading