Update skopeo pod for psa (#2844)

Signed-off-by: perdasilva <[email protected]>
Upstream-repository: operator-lifecycle-manager
Upstream-commit: d9908b4278db30855473ff9abfb4ea25255c26ab

Author: perdasilva

staging/operator-lifecycle-manager/pkg/controller/operators/olm/downstream_csv_labeler.go

@@ -0,0 +1,61 @@
+package olm
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/operator-framework/api/pkg/operators/v1alpha1"
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient"
+	"github.com/sirupsen/logrus"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const labelSyncerLabelKey = ""
+
+func NewCSVLabelSyncerLabeler(client operatorclient.ClientInterface, logger *logrus.Logger) *CSVLabelSyncerLabeler {
+	return &CSVLabelSyncerLabeler{
+		client: client,
+		logger: logger,
+	}
+}
+
+type CSVLabelSyncerLabeler struct {
+	client operatorclient.ClientInterface
+	logger *logrus.Logger
+}
+
+func (c *CSVLabelSyncerLabeler) OnAddOrUpdate(csv *v1alpha1.ClusterServiceVersion) error {
+	// ignore copied csvs
+	if csv.IsCopied() {
+		return nil
+	}
+
+	// ignore csv updates
+	if csv.Status.LastTransitionTime != nil {
+		return nil
+	}
+
+	namespace, err := c.client.KubernetesInterface().CoreV1().Namespaces().Get(context.Background(), csv.GetNamespace(), metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("error getting csv namespace (%s) for label sync'er labeling", csv.GetNamespace())
+	}
+
+	// add label sync'er label if it does not exist
+	if _, ok := namespace.Labels[labelSyncerLabelKey]; !ok {
+		nsCopy := namespace.DeepCopy()
+		nsCopy.Labels[labelSyncerLabelKey] = "true"
+		if _, err := c.client.KubernetesInterface().CoreV1().Namespaces().Update(context.Background(), namespace, metav1.UpdateOptions{}); err != nil {
+			return fmt.Errorf("error updating csv namespace (%s) with label sync'er label", nsCopy.GetNamespace())
+		}
+
+		if c.logger != nil {
+			c.logger.Printf("[CSV LABEL] applied %s=true label to namespace %s", labelSyncerLabelKey, nsCopy.GetNamespace())
+		}
+	}
+
+	return nil
+}
+
+func (c *CSVLabelSyncerLabeler) OnDelete(_ *v1alpha1.ClusterServiceVersion) error {
+	return nil
+}

staging/operator-lifecycle-manager/test/e2e/skopeo.go

@@ -6,6 +6,7 @@ import (
 	"os/exec"
 
 	"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient"
+	"k8s.io/utils/pointer"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -81,11 +82,25 @@ func createSkopeoPod(client operatorclient.ClientInterface, args []string, names
 			Labels:    map[string]string{"name": skopeo},
 		},
 		Spec: corev1.PodSpec{
+			SecurityContext: &corev1.PodSecurityContext{
+				SeccompProfile: &corev1.SeccompProfile{
+					Type: corev1.SeccompProfileTypeRuntimeDefault,
+				},
+			},
 			Containers: []corev1.Container{
 				{
 					Name:  skopeo,
 					Image: skopeoImage,
 					Args:  args,
+					SecurityContext: &corev1.SecurityContext{
+						ReadOnlyRootFilesystem:   pointer.Bool(false),
+						AllowPrivilegeEscalation: pointer.Bool(false),
+						Capabilities: &corev1.Capabilities{
+							Drop: []corev1.Capability{"ALL"},
+						},
+						RunAsNonRoot: pointer.Bool(true),
+						RunAsUser:    pointer.Int64(1001),
+					},
 				},
 			},
 			RestartPolicy: corev1.RestartPolicyNever,