Skip to content

Commit cb3fa0d

Browse files
tony-landrethtony-landreth
authored
Set SeccompProfile to RuntimeDefault (#3911)
 Issue: PGO-845
1 parent 2de2b7f commit cb3fa0d

File tree

11 files changed

+74
-4
lines changed

11 files changed

+74
-4
lines changed

‎internal/controller/postgrescluster/instance_test.go

+8
Original file line numberDiff line numberDiff line change
@@ -568,6 +568,8 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
568568
privileged: false
569569
readOnlyRootFilesystem: true
570570
runAsNonRoot: true
571+
seccompProfile:
572+
type: RuntimeDefault
571573
volumeMounts:
572574
- mountPath: /etc/pgbackrest/server
573575
name: pgbackrest-server
@@ -618,6 +620,8 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
618620
privileged: false
619621
readOnlyRootFilesystem: true
620622
runAsNonRoot: true
623+
seccompProfile:
624+
type: RuntimeDefault
621625
volumeMounts:
622626
- mountPath: /etc/pgbackrest/server
623627
name: pgbackrest-server
@@ -676,6 +680,8 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
676680
privileged: false
677681
readOnlyRootFilesystem: true
678682
runAsNonRoot: true
683+
seccompProfile:
684+
type: RuntimeDefault
679685
volumeMounts:
680686
- mountPath: /etc/pgbackrest/server
681687
name: pgbackrest-server
@@ -726,6 +732,8 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
726732
privileged: false
727733
readOnlyRootFilesystem: true
728734
runAsNonRoot: true
735+
seccompProfile:
736+
type: RuntimeDefault
729737
volumeMounts:
730738
- mountPath: /etc/pgbackrest/server
731739
name: pgbackrest-server

‎internal/controller/postgrescluster/pgbackrest_test.go

+2
Original file line numberDiff line numberDiff line change
@@ -2519,6 +2519,8 @@ containers:
25192519
privileged: false
25202520
readOnlyRootFilesystem: true
25212521
runAsNonRoot: true
2522+
seccompProfile:
2523+
type: RuntimeDefault
25222524
volumeMounts:
25232525
- mountPath: /etc/pgbackrest/conf.d
25242526
name: pgbackrest-config

‎internal/controller/postgrescluster/pgmonitor_test.go

+2
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,8 @@ securityContext:
169169
privileged: false
170170
readOnlyRootFilesystem: true
171171
runAsNonRoot: true
172+
seccompProfile:
173+
type: RuntimeDefault
172174
volumeMounts:
173175
- mountPath: /conf
174176
name: exporter-config

‎internal/controller/postgrescluster/volumes_test.go

+6
Original file line numberDiff line numberDiff line change
@@ -776,6 +776,8 @@ containers:
776776
privileged: false
777777
readOnlyRootFilesystem: true
778778
runAsNonRoot: true
779+
seccompProfile:
780+
type: RuntimeDefault
779781
terminationMessagePath: /dev/termination-log
780782
terminationMessagePolicy: File
781783
volumeMounts:
@@ -834,6 +836,8 @@ containers:
834836
privileged: false
835837
readOnlyRootFilesystem: true
836838
runAsNonRoot: true
839+
seccompProfile:
840+
type: RuntimeDefault
837841
terminationMessagePath: /dev/termination-log
838842
terminationMessagePolicy: File
839843
volumeMounts:
@@ -894,6 +898,8 @@ containers:
894898
privileged: false
895899
readOnlyRootFilesystem: true
896900
runAsNonRoot: true
901+
seccompProfile:
902+
type: RuntimeDefault
897903
terminationMessagePath: /dev/termination-log
898904
terminationMessagePolicy: File
899905
volumeMounts:

‎internal/controller/standalone_pgadmin/pod_test.go

+8
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,8 @@ containers:
120120
privileged: false
121121
readOnlyRootFilesystem: true
122122
runAsNonRoot: true
123+
seccompProfile:
124+
type: RuntimeDefault
123125
volumeMounts:
124126
- mountPath: /etc/pgadmin/conf.d
125127
name: pgadmin-config
@@ -172,6 +174,8 @@ initContainers:
172174
privileged: false
173175
readOnlyRootFilesystem: true
174176
runAsNonRoot: true
177+
seccompProfile:
178+
type: RuntimeDefault
175179
volumeMounts:
176180
- mountPath: /etc/pgadmin
177181
name: pgadmin-config-system
@@ -298,6 +302,8 @@ containers:
298302
privileged: false
299303
readOnlyRootFilesystem: true
300304
runAsNonRoot: true
305+
seccompProfile:
306+
type: RuntimeDefault
301307
volumeMounts:
302308
- mountPath: /etc/pgadmin/conf.d
303309
name: pgadmin-config
@@ -354,6 +360,8 @@ initContainers:
354360
privileged: false
355361
readOnlyRootFilesystem: true
356362
runAsNonRoot: true
363+
seccompProfile:
364+
type: RuntimeDefault
357365
volumeMounts:
358366
- mountPath: /etc/pgadmin
359367
name: pgadmin-config-system

‎internal/initialize/security.go

+4
Original file line numberDiff line numberDiff line change
@@ -51,5 +51,9 @@ func RestrictedSecurityContext() *corev1.SecurityContext {
5151

5252
// Fail to start the container if its image runs as UID 0 (root).
5353
RunAsNonRoot: Bool(true),
54+
55+
SeccompProfile: &corev1.SeccompProfile{
56+
Type: corev1.SeccompProfileTypeRuntimeDefault,
57+
},
5458
}
5559
}

‎internal/initialize/security_test.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"testing"
2121

2222
"gotest.tools/v3/assert"
23+
corev1 "k8s.io/api/core/v1"
2324

2425
"github.com/crunchydata/postgres-operator/internal/initialize"
2526
)
@@ -59,9 +60,10 @@ func TestPodSecurityContext(t *testing.T) {
5960
assert.Assert(t, psc.RunAsUser == nil,
6061
`Containers must not set runAsUser to 0`)
6162

62-
// TODO(cbandy): delegate to v1.SecurityContext
63-
assert.Assert(t, psc.SeccompProfile == nil,
64-
`Seccomp profile must be explicitly set to one of the allowed values. Both the Unconfined profile and the absence of a profile are prohibited.`)
63+
if assert.Check(t, psc.SeccompProfile == nil) {
64+
assert.Assert(t, initialize.RestrictedSecurityContext().SeccompProfile != nil,
65+
`SeccompProfile should be delegated to the container-level v1.SecurityContext`)
66+
}
6567
})
6668
}
6769

@@ -121,7 +123,7 @@ func TestRestrictedSecurityContext(t *testing.T) {
121123
// of OpenShift 4.11 uses the "runtime/default" profile.
122124
// - https://docs.openshift.com/container-platform/4.10/security/seccomp-profiles.html
123125
// - https://docs.openshift.com/container-platform/4.11/security/seccomp-profiles.html
124-
assert.Assert(t, sc.SeccompProfile == nil,
126+
assert.Assert(t, sc.SeccompProfile.Type == corev1.SeccompProfileTypeRuntimeDefault,
125127
`Seccomp profile must be explicitly set to one of the allowed values. Both the Unconfined profile and the absence of a profile are prohibited.`)
126128
})
127129

‎internal/pgadmin/reconcile_test.go

+8
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,8 @@ containers:
244244
privileged: false
245245
readOnlyRootFilesystem: true
246246
runAsNonRoot: true
247+
seccompProfile:
248+
type: RuntimeDefault
247249
volumeMounts:
248250
- mountPath: /etc/pgadmin
249251
name: pgadmin-startup
@@ -284,6 +286,8 @@ initContainers:
284286
privileged: false
285287
readOnlyRootFilesystem: true
286288
runAsNonRoot: true
289+
seccompProfile:
290+
type: RuntimeDefault
287291
volumeMounts:
288292
- mountPath: /etc/pgadmin
289293
name: pgadmin-startup
@@ -482,6 +486,8 @@ containers:
482486
privileged: false
483487
readOnlyRootFilesystem: true
484488
runAsNonRoot: true
489+
seccompProfile:
490+
type: RuntimeDefault
485491
volumeMounts:
486492
- mountPath: /etc/pgadmin
487493
name: pgadmin-startup
@@ -526,6 +532,8 @@ initContainers:
526532
privileged: false
527533
readOnlyRootFilesystem: true
528534
runAsNonRoot: true
535+
seccompProfile:
536+
type: RuntimeDefault
529537
volumeMounts:
530538
- mountPath: /etc/pgadmin
531539
name: pgadmin-startup

‎internal/pgbackrest/reconcile_test.go

+12
Original file line numberDiff line numberDiff line change
@@ -620,6 +620,8 @@ func TestAddServerToInstancePod(t *testing.T) {
620620
privileged: false
621621
readOnlyRootFilesystem: true
622622
runAsNonRoot: true
623+
seccompProfile:
624+
type: RuntimeDefault
623625
volumeMounts:
624626
- mountPath: /etc/pgbackrest/server
625627
name: pgbackrest-server
@@ -669,6 +671,8 @@ func TestAddServerToInstancePod(t *testing.T) {
669671
privileged: false
670672
readOnlyRootFilesystem: true
671673
runAsNonRoot: true
674+
seccompProfile:
675+
type: RuntimeDefault
672676
volumeMounts:
673677
- mountPath: /etc/pgbackrest/server
674678
name: pgbackrest-server
@@ -736,6 +740,8 @@ func TestAddServerToInstancePod(t *testing.T) {
736740
privileged: false
737741
readOnlyRootFilesystem: true
738742
runAsNonRoot: true
743+
seccompProfile:
744+
type: RuntimeDefault
739745
volumeMounts:
740746
- mountPath: /etc/pgbackrest/server
741747
name: pgbackrest-server
@@ -787,6 +793,8 @@ func TestAddServerToInstancePod(t *testing.T) {
787793
privileged: false
788794
readOnlyRootFilesystem: true
789795
runAsNonRoot: true
796+
seccompProfile:
797+
type: RuntimeDefault
790798
volumeMounts:
791799
- mountPath: /etc/pgbackrest/server
792800
name: pgbackrest-server
@@ -855,6 +863,8 @@ func TestAddServerToRepoPod(t *testing.T) {
855863
privileged: false
856864
readOnlyRootFilesystem: true
857865
runAsNonRoot: true
866+
seccompProfile:
867+
type: RuntimeDefault
858868
volumeMounts:
859869
- mountPath: /etc/pgbackrest/server
860870
name: pgbackrest-server
@@ -900,6 +910,8 @@ func TestAddServerToRepoPod(t *testing.T) {
900910
privileged: false
901911
readOnlyRootFilesystem: true
902912
runAsNonRoot: true
913+
seccompProfile:
914+
type: RuntimeDefault
903915
volumeMounts:
904916
- mountPath: /etc/pgbackrest/server
905917
name: pgbackrest-server

‎internal/pgbouncer/reconcile_test.go

+12
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,8 @@ containers:
148148
privileged: false
149149
readOnlyRootFilesystem: true
150150
runAsNonRoot: true
151+
seccompProfile:
152+
type: RuntimeDefault
151153
volumeMounts:
152154
- mountPath: /etc/pgbouncer
153155
name: pgbouncer-config
@@ -179,6 +181,8 @@ containers:
179181
privileged: false
180182
readOnlyRootFilesystem: true
181183
runAsNonRoot: true
184+
seccompProfile:
185+
type: RuntimeDefault
182186
volumeMounts:
183187
- mountPath: /etc/pgbouncer
184188
name: pgbouncer-config
@@ -258,6 +262,8 @@ containers:
258262
privileged: false
259263
readOnlyRootFilesystem: true
260264
runAsNonRoot: true
265+
seccompProfile:
266+
type: RuntimeDefault
261267
volumeMounts:
262268
- mountPath: /etc/pgbouncer
263269
name: pgbouncer-config
@@ -294,6 +300,8 @@ containers:
294300
privileged: false
295301
readOnlyRootFilesystem: true
296302
runAsNonRoot: true
303+
seccompProfile:
304+
type: RuntimeDefault
297305
volumeMounts:
298306
- mountPath: /etc/pgbouncer
299307
name: pgbouncer-config
@@ -364,6 +372,8 @@ containers:
364372
privileged: false
365373
readOnlyRootFilesystem: true
366374
runAsNonRoot: true
375+
seccompProfile:
376+
type: RuntimeDefault
367377
volumeMounts:
368378
- mountPath: /etc/pgbouncer
369379
name: pgbouncer-config
@@ -399,6 +409,8 @@ containers:
399409
privileged: false
400410
readOnlyRootFilesystem: true
401411
runAsNonRoot: true
412+
seccompProfile:
413+
type: RuntimeDefault
402414
volumeMounts:
403415
- mountPath: /etc/pgbouncer
404416
name: pgbouncer-config

‎internal/postgres/reconcile_test.go

+6
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,8 @@ containers:
160160
privileged: false
161161
readOnlyRootFilesystem: true
162162
runAsNonRoot: true
163+
seccompProfile:
164+
type: RuntimeDefault
163165
volumeMounts:
164166
- mountPath: /pgconf/tls
165167
name: cert-volume
@@ -201,6 +203,8 @@ containers:
201203
privileged: false
202204
readOnlyRootFilesystem: true
203205
runAsNonRoot: true
206+
seccompProfile:
207+
type: RuntimeDefault
204208
volumeMounts:
205209
- mountPath: /pgconf/tls
206210
name: cert-volume
@@ -289,6 +293,8 @@ initContainers:
289293
privileged: false
290294
readOnlyRootFilesystem: true
291295
runAsNonRoot: true
296+
seccompProfile:
297+
type: RuntimeDefault
292298
volumeMounts:
293299
- mountPath: /pgconf/tls
294300
name: cert-volume

0 commit comments

Comments
 (0)