[BUG] Built-in PSACT rancher-restricted is not updated to the new version after Rancher is upgraded

[jiaqiluo]

Rancher Server Setup

• Rancher version: 2.7.6
• Installation option (Docker install/Helm Chart): either
  • If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):
• Proxy/Cert Details:

Information about the Cluster

• Kubernetes version: any
• Cluster Type (Local/Downstream): local, either embedded (docker-installed) or external (HA)
  • If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider):

User Information

• What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom) any
  • If custom, define the set of permissions:

Describe the bug

In Rancher v2.7.7, Two new entries, cattle-provisioning-capi-system and cattle-fleet-local-system, are added to the exemptions.namespaces list in the built-in PodSecurityAdmissionConfigurationTemplates (PSACTs) rancher-restricted. (PR)

However, Rancher lacks the ability to update the existing PSACT, rancher-restricted in this case, so when we upgrade Rancher from 2.7.6 to 2.7.7, rancher-restricted is not updated to the new version, i.e. the new entries are missing.

To Reproduce

• run Rancher v2.7.6
• notice that a PSACT rancher-restricted is created in the local cluster
• upgrade Rancher to v2.7.7 or later
• check the PSACT rancher-restricted

Result

The value of the PSACT rancher-restricted is unchanged: it is NOT updated to include cattle-provisioning-capi-system and cattle-fleet-local-system

Expected Result

Rancher should update the PSACT rancher-restricted to include cattle-provisioning-capi-system and cattle-fleet-local-system under the exemptions.namespaces list.

Screenshots

Additional context

[jiaqiluo]

Workaround:

Update the PSACT rancher-restricted to add cattle-provisioning-capi-system and cattle-fleet-local-system under the exemptions.namespaces list. This can be done via Rancher UI, kubectl, or other means.

[martyav]

@jiaqiluo or @btat Added to release notes. Re-requested permissions to add labels to this repo

[snasovich]

Moved to next milestone as release note was added to draft version.

[snasovich]

Added security-required label and moved to "Blocked" status as we're awaiting the security team's evaluation of approaches to address this issue.

[jiaqiluo]

Root cause

Rancher lacks the ability to update the existing built-in PSACTs.

What was fixed, or what changes have occurred

Now, Rancher can update the built-in PSACTs on Rancher's start-up.

it is worth mentioning that Rancher will update the built-in PSACTs in a way that preserves the user's additions to the exemptions and merges everything from the built-in template into the existing one, which means that any value that is from the built-in template but removed by users will be added back. This is to make sure Rancher and its components work properly.

The above logic is applied to all three fields under the .Configuration.Exemptions: Namespaces, Usernames, and RuntimeClasses. Currently, the PSACT rancher-restricted utilizes only Namespaces.

Areas or cases that should be tested

Case 1: Upgrade Rancher from version A to B where the built-in template for the PSACT rancher-restricted is changed ( ie. new namespaces are added to the exception list).

Case 2: Upgrade Rancher from version A to B where the user makes some changes on rancher-restricted while on version A.

In both cases, we would like to see the PSACT rancher-restricted contains the union of the new template and the user's customization (if there is any).

What areas could experience regressions?

After upgrading Rancher, the PSACT rancher-restricted is not upgraded or the user's customization is lost.

Are the repro steps accurate/minimal?

yes

[jiaqiluo]

Wait for Rancher RC