OPCT-7 - fix/securityContext: disable default SecurityContext created by Sonobuoy #39
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
PR under validation |
openshift-ci
bot
added
the
do-not-merge/hold
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
This change, and RBAC #34, are mandatory to the 'upgrade' (#33) feature work correctly. I just tested the upgrade without this change, leaving the mode==default (nonroot), and it raised those errors: |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
I've created two cards to address upstream issues found while testing this PR: |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bostrt The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/unhold |
openshift-ci
bot
removed
the
do-not-merge/hold
12 tasks
mtulio
changed the title
mtulio
changed the title
openshift-merge-robot
pushed a commit
that referenced
this pull request
Jan 26, 2023
https://issues.redhat.com/browse/SPLAT-651 Support upgrade conformance. - Introduces new flags to control whether the execution needs to run the upgrade cluster or not: - `--mode=upgrade` - `--upgrade-to-image=<release_digest>` (`$(oc adm release info 4.Y+1.Z -o jsonpath={.image}`) - Create config map with plugin variables (the sonobuoy native feature wipes all existing from `podSpec` which is undesired) - add a new plugin instance of openshift-tests to run upgrades: `05-openshift-cluster-upgrade` Blocked by: - [x] #31 - [x] #34 Blocked by Plugin release: - [x] redhat-openshift-ecosystem/provider-certification-plugins#24 Checklist: - [x] CLI changes to run in upgrade mode - [x] CLI changes to get the release image digest - [x] Plugin implementation: redhat-openshift-ecosystem/provider-certification-plugins#24 - [x] Validate y-stream upgrades - [x] Fix RBAC #34 for Cluster upgrade - [x] Fix SecurityContextMode for Sonobuoy aggregator stuck on 4.10->4.11 #39 - [x] MachineConfigPool validation: 'opct' object is validated if present when running `mode=upgrade` on the runtime (plugin execution). Failures will be raised by the plugin when the MCP is not present (the User Docs should keep it very explicit): Tests described here: redhat-openshift-ecosystem/provider-certification-plugins#24 (comment) - [x] User Documentation Tests checklist: - [x] upgrade 4.12-> 4.13
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The goal of this PR is to change the default mode of the SecurityContext of jobs, encapsulated by "modes". The SecurityContext created by Sonobuoy is not working as expected on the pod admission security pods introduced on the OCP 4.11/Kube 1.24.
We get the issue when running the upgrade from 4.10 to 4.11(using conformance tests / #33 ), the sonobuoy aggregator stuck trying to annotate the resources managed by it right after the cluster finished the upgrade. The issue is detailed on OPCT-7.