Adding the ability to define a secuirty context and SELinux options

[Auston-Ivison-Suse]

We were running into the problems with the upgrade job failing on a host with SELinux enabled. So when one would need to upgrade a host's OS, allowing to set a security context and SELinux Options therein will allow you to upgrade the OS, without disabling SELinux beforehand.

Within the yaml file of a plan, you will be able to set plan.Spec.Upgrade.SecurityContext and it will take effect in the upgrade job. The same concept applies to the SELinux Options within a plan.

[brandond]

Are you going to plumb these new fields through to anything? See how the SecurityContext for the upgrade pod is generated at

system-upgrade-controller/pkg/upgrade/job/job.go

Lines 326 to 333 in 04a0b9e

	upgradectr.WithSecurityContext(&corev1.SecurityContext{
	Privileged: &Privileged,
	Capabilities: &corev1.Capabilities{
	Add: []corev1.Capability{
	corev1.Capability("CAP_SYS_BOOT"),
	},
	},
	}),

You need to modify that bit to actually use the SecurityContext from the Plan, if it is non-nil. You also need to similarly wire up the SELinuxOptions.

[brandond]

Also, please fill out the PR body with some background and an example of how and when this might be used.

[brandond]

Couple nits on how this is plumbed through to the upgrade container.

Note that the prepare container also uses all the fields from ContainerSpec; we should probably wire up all the SecurityContext stuff there as well. I'm not sure why it currently doesn't do this, as it's not documented as only supported for the upgrade pod.

[brandond]

I'm not sure this is necessary - you're setting container.SecurityContext.SELinuxOptions, when container.SecurityContext is already set by the WithSecurityContext function. Just set this directly on the SecurityContext.

[brandond]

Currently, the option to enable privilege for the upgrade pod is set at the controller level:

system-upgrade-controller/pkg/upgrade/job/job.go

Lines 73 to 82 in f4a9a0f

	Privileged = func(defaultValue bool) bool {
	if str, ok := os.LookupEnv("SYSTEM_UPGRADE_JOB_PRIVILEGED"); ok {
	if b, err := strconv.ParseBool(str); err != nil {
	logrus.Errorf("failed to parse $%s: %v", "SYSTEM_UPGRADE_JOB_PRIVILEGED", err)
	} else {
	return b
	}
	}
	return defaultValue
	}(defaultPrivileged)

Since this is a security control enforced by the administrator, I feel like we probably also need to wire up a new option to allow administrators to opt in to allowing users to specify a SecurityContext for their pods. It can default to true, but if the option is false the SecurityContext from the Plan should be ignored - perhaps along with a logged warning?

[brandond]

@Auston-Ivison-Suse are you still working on this?

[brandond]

You generally want to rebase your branch on top of master, instead of pulling master into your branch. makes for a cleaner commit log.