Bind admin role so that SA can use PSP #863

fiunchinho · 2020-12-15T09:50:41Z

Changes

Examples fail because the ServiceAccount used has no permissions to use the PodSecurityPolicy. We need to bind the admin role to the ServiceAccount so that it can use the PSP.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices
Release notes block has been filled in or deleted (only if no user facing changes)

tekton-robot · 2020-12-15T09:50:43Z

@fiunchinho: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

linux-foundation-easycla · 2020-12-15T09:50:45Z

The committers are authorized under a signed CLA.

✅ Jose Armesto (458542e)

tekton-robot · 2020-12-15T09:50:56Z

Hi @fiunchinho. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dibyom · 2020-12-15T15:59:04Z

/ok-to-test

dibyom · 2020-12-15T16:02:02Z

examples/rbac.yaml

@@ -37,6 +37,18 @@ roleRef:
  kind: Role
  name: tekton-triggers-example-minimal
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding


Instead of adding a binding to the admin role, could we add the rule of using pod security policies to the role defined above in this file?

dibyom · 2020-12-15T16:02:33Z

Question: Is this needed due to #862?

Also, /cc @gabemontero our resident PSP expert!

gabemontero · 2020-12-15T16:23:54Z

Question: Is this needed due to #862?

Yes I believe it is @dibyom .... the slack discussion thread we've had with these folks on their issue is https://tektoncd.slack.com/archives/CKUSJ2A5D/p1607949867225500

Subsequent to getting this to work for them, I am curious how long triggers has been broke with PSP turned on. Or if it ever worked with PSP turned on. I would think it had worked with PSP sometime in the past but am not certain. If it did, that might mean something changed in the image or controller to necessitate these changes.

By comparison, the PSP analogous feature in openshift, SCC, (which is what I typically run with), has not seen this (unless we need to retry with the very latest ... it has been a couple of weeks for me). @savitaashture attested to the same experience.

Also, /cc @gabemontero our resident PSP expert!

oooh, that is a very dangerous characterization man ;-) .... "expert" at best is a relative term here :-)

dibyom · 2020-12-15T16:42:28Z

Subsequent to getting this to work for them, I am curious how long triggers has been broke with PSP turned on. Or if it ever worked with PSP turned on. I would think it had worked with PSP sometime in the past but am not certain. If it did, that might mean something changed in the image or controller to necessitate these changes.

well, #862 got merged yesterday so I'm guessing since then 😛 The conroller/webhook already had roles to use PSPs. The EL sink deployment did not have this role, but the deployment spec also did not have a securityContext (until yesterday).

gabemontero · 2020-12-15T16:47:05Z

Subsequent to getting this to work for them, I am curious how long triggers has been broke with PSP turned on. Or if it ever worked with PSP turned on. I would think it had worked with PSP sometime in the past but am not certain. If it did, that might mean something changed in the image or controller to necessitate these changes.

well, #862 got merged yesterday so I'm guessing since then stuck_out_tongue The conroller/webhook already had roles to use PSPs. The EL sink deployment did not have this role, but the deployment spec also did not have a securityContext (until yesterday).

the opposite actually ... I suggested that to them, along with this PR, to help get past this ... basically mimic what we do for the controller / webhook ... they were seeing the issue before that merged

dibyom · 2020-12-15T17:06:24Z

Makes sense. controllers/webhook had the right policies/securityContext while EL sinks did not. So in environments requiring PSPs, the controller/webhook would work but not the EL.

MarcelMue · 2021-01-05T18:38:04Z

I will take over this PR from @fiunchinho - he is currently on vacation but I'd like to push this forward in the meantime.

dibyom · 2021-01-06T16:05:53Z

I will take over this PR from @fiunchinho - he is currently on vacation but I'd like to push this forward in the meantime.

Thank you 🙏

fiunchinho · 2021-01-11T15:57:55Z

Addressed review comment, please take a look. Thanks.

dibyom · 2021-01-11T22:07:43Z

Looks good. One small thing -- could you squash up the two commits? Thanks!

/approve

tekton-robot · 2021-01-11T22:07:50Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dibyom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [dibyom]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

fiunchinho · 2021-01-12T12:38:37Z

Looks good. One small thing -- could you squash up the two commits? Thanks!

/approve

Done

dibyom · 2021-01-12T16:00:06Z

/lgtm

MarcelMue · 2021-01-12T16:01:59Z

Nice 🎉

tekton-robot added the do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. label Dec 15, 2020

tekton-robot requested review from vtereso and wlynch December 15, 2020 09:50

tekton-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Dec 15, 2020

tekton-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 15, 2020

tekton-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 15, 2020

dibyom reviewed Dec 15, 2020

View reviewed changes

tekton-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 11, 2021

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 11, 2021

dibyom added release-note-none Denotes a PR that doesnt merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jan 11, 2021

Bind admin role so that SA can use PSP

908b6a8

fiunchinho force-pushed the rbac-psp branch from da24691 to 908b6a8 Compare January 12, 2021 12:38

tekton-robot assigned dibyom Jan 12, 2021

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 12, 2021

tekton-robot merged commit 7d49df4 into tektoncd:master Jan 12, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bind admin role so that SA can use PSP #863

Bind admin role so that SA can use PSP #863

fiunchinho commented Dec 15, 2020

tekton-robot commented Dec 15, 2020

linux-foundation-easycla bot commented Dec 15, 2020 •

edited

Loading

tekton-robot commented Dec 15, 2020

dibyom commented Dec 15, 2020

dibyom Dec 15, 2020

dibyom commented Dec 15, 2020

gabemontero commented Dec 15, 2020

dibyom commented Dec 15, 2020

gabemontero commented Dec 15, 2020

dibyom commented Dec 15, 2020

MarcelMue commented Jan 5, 2021

dibyom commented Jan 6, 2021

fiunchinho commented Jan 11, 2021

dibyom commented Jan 11, 2021

tekton-robot commented Jan 11, 2021

fiunchinho commented Jan 12, 2021

dibyom commented Jan 12, 2021

MarcelMue commented Jan 12, 2021

Bind admin role so that SA can use PSP #863

Bind admin role so that SA can use PSP #863

Conversation

fiunchinho commented Dec 15, 2020

Changes

Submitter Checklist

tekton-robot commented Dec 15, 2020

linux-foundation-easycla bot commented Dec 15, 2020 • edited Loading

tekton-robot commented Dec 15, 2020

dibyom commented Dec 15, 2020

dibyom Dec 15, 2020

Choose a reason for hiding this comment

dibyom commented Dec 15, 2020

gabemontero commented Dec 15, 2020

dibyom commented Dec 15, 2020

gabemontero commented Dec 15, 2020

dibyom commented Dec 15, 2020

MarcelMue commented Jan 5, 2021

dibyom commented Jan 6, 2021

fiunchinho commented Jan 11, 2021

dibyom commented Jan 11, 2021

tekton-robot commented Jan 11, 2021

fiunchinho commented Jan 12, 2021

dibyom commented Jan 12, 2021

MarcelMue commented Jan 12, 2021

linux-foundation-easycla bot commented Dec 15, 2020 •

edited

Loading