Skip to content

manifests/*: comply to restricted pod security level #299

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
May 9, 2022
Merged

manifests/*: comply to restricted pod security level #299

merged 3 commits into from
May 9, 2022

Conversation

timflannagan
Copy link
Contributor

Follow-up to #295 which has additional scripts/* changes.

@openshift-ci openshift-ci bot requested review from anik120 and gallettilance May 2, 2022 16:30
@openshift-ci
Copy link
Contributor

openshift-ci bot commented May 2, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: timflannagan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 2, 2022
@timflannagan
Copy link
Contributor Author

/retest-required

1 similar comment
@s-urbaniak
Copy link
Contributor

/retest-required

@s-urbaniak
Copy link
Contributor

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 3, 2022
@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

2 similar comments
@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@timflannagan
Copy link
Contributor Author

Waiting for fixes to the e2e/upgrade checks.

/hold

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 3, 2022
@s-urbaniak
Copy link
Contributor

/retest-required

s-urbaniak
s-urbaniak reviewed May 9, 2022
View reviewed changes
manifests/0000_50_olm_07-collect-profiles.cronjob.yaml Outdated
@@ -13,10 +13,19 @@ spec:
spec:
template:
spec:
securityContext:
runAsNonRoot: true
runAsUser: 65534
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it turns out collect-profiles only has permissions to use the restricted SCC, hence we have to remove this line, the UID will be picked automatically from a safe range by SCC admission). The e2e failure is:

Error creating: pods "collect-profiles-27529095-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, spec.containers[0].securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000380000, 1000389999], provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount] for Job.batch/v1/collect-profiles-27529095 -n openshift-operator-lifecycle-manager happened 5 times

s-urbaniak
s-urbaniak reviewed May 9, 2022
View reviewed changes
scripts/generate_crds_manifests.sh Outdated
@@ -262,10 +271,19 @@ spec:
spec:
template:
spec:
securityContext:
runAsNonRoot: true
runAsUser: 65534
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see https://github.com/openshift/operator-framework-olm/pull/299/files#r868043811

@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label May 9, 2022
@s-urbaniak
Copy link
Contributor

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 9, 2022
@timflannagan
Copy link
Contributor Author

/retest-required

1 similar comment
@timflannagan
Copy link
Contributor Author

/retest-required

@openshift-ci
Copy link
Contributor

openshift-ci bot commented May 9, 2022

@timflannagan: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@timflannagan
Copy link
Contributor Author

/hold cancel

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 9, 2022
@openshift-merge-robot openshift-merge-robot merged commit ec696d9 into openshift:master May 9, 2022
@timflannagan timflannagan deleted the pod-security-context-4.11 branch May 9, 2022 18:34
tmshort pushed a commit to tmshort/operator-framework-olm that referenced this pull request Oct 12, 2023
@dependabot @tmshort
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
00d5b02 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 16, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
ffe27dc 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 16, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
2c459d3 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 16, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
9e704e1 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](httpts://github.com/golang/net/compare/v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 16, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
7a77ea7 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 16, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
82b4693 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
stevekuznetsov pushed a commit to stevekuznetsov/operator-framework-olm that referenced this pull request Oct 18, 2023
@dependabot @stevekuznetsov
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
c7617fe 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Steve Kuznetsov <[email protected]>
stevekuznetsov pushed a commit to stevekuznetsov/operator-framework-olm that referenced this pull request Oct 18, 2023
@dependabot @stevekuznetsov
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
bfd521d 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 19, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
45828f9 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 19, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
606a984 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](httpts://github.com/golang/net/compare/v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 19, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
3329816 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 19, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
4217646 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35
awgreene pushed a commit to awgreene/operator-framework-olm that referenced this pull request Oct 19, 2023
@dependabot @awgreene
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 (openshift#299)
5ae493a 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Upstream-repository: api
Upstream-commit: d52e6b24617a980e471dbfde1ec1780de9d23f35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@s-urbaniak s-urbaniak s-urbaniak left review comments

@anik120 anik120 Awaiting requested review from anik120

@gallettilance gallettilance Awaiting requested review from gallettilance

Assignees

@s-urbaniak s-urbaniak

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@timflannagan @s-urbaniak @openshift-bot @openshift-merge-robot