Skip to content

Commit e41024e

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #349 from anik120/psa-downstream
Psa downstream
2 parents 84e208a + 462a0c8 commit e41024e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+498
-162
lines changed

Diff for: ‎manifests/0000_50_olm_00-namespace.yaml

+7-5
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,25 @@ apiVersion: v1
22
kind: Namespace
33
metadata:
44
name: openshift-operator-lifecycle-manager
5+
labels:
6+
openshift.io/scc: "anyuid"
7+
openshift.io/cluster-monitoring: "true"
58
annotations:
69
openshift.io/node-selector: ""
710
workload.openshift.io/allowed: "management"
811
include.release.openshift.io/ibm-cloud-managed: "true"
912
include.release.openshift.io/self-managed-high-availability: "true"
10-
labels:
11-
openshift.io/scc: "anyuid"
12-
openshift.io/cluster-monitoring: "true"
1313
---
1414
apiVersion: v1
1515
kind: Namespace
1616
metadata:
1717
name: openshift-operators
18+
labels:
19+
pod-security.kubernetes.io/enforce: baseline
20+
pod-security.kubernetes.io/enforce-version: "v1.24"
21+
openshift.io/scc: "anyuid"
1822
annotations:
1923
openshift.io/node-selector: ""
2024
workload.openshift.io/allowed: "management"
2125
include.release.openshift.io/ibm-cloud-managed: "true"
2226
include.release.openshift.io/self-managed-high-availability: "true"
23-
labels:
24-
openshift.io/scc: "anyuid"

Diff for: ‎manifests/0000_50_olm_06-psm-operator.deployment.ibm-cloud-managed.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ spec:
2323
spec:
2424
securityContext:
2525
runAsNonRoot: true
26-
runAsUser: 65534
2726
seccompProfile:
2827
type: RuntimeDefault
2928
serviceAccountName: olm-operator-serviceaccount

Diff for: ‎manifests/0000_50_olm_06-psm-operator.deployment.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ spec:
2323
spec:
2424
securityContext:
2525
runAsNonRoot: true
26-
runAsUser: 65534
2726
seccompProfile:
2827
type: RuntimeDefault
2928
serviceAccountName: olm-operator-serviceaccount

Diff for: ‎manifests/0000_50_olm_07-olm-operator.deployment.ibm-cloud-managed.yaml

+8-9
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ spec:
2121
annotations:
2222
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
seccompProfile:
27+
type: RuntimeDefault
2428
serviceAccountName: olm-operator-serviceaccount
2529
volumes:
2630
- name: srv-cert
@@ -31,6 +35,10 @@ spec:
3135
secretName: pprof-cert
3236
containers:
3337
- name: olm-operator
38+
securityContext:
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop: ["ALL"]
3442
volumeMounts:
3543
- name: srv-cert
3644
mountPath: "/srv-cert"
@@ -84,10 +92,6 @@ spec:
8492
requests:
8593
cpu: 10m
8694
memory: 160Mi
87-
securityContext:
88-
allowPrivilegeEscalation: false
89-
capabilities:
90-
drop: ["ALL"]
9195
nodeSelector:
9296
kubernetes.io/os: linux
9397
tolerations:
@@ -103,8 +107,3 @@ spec:
103107
operator: Exists
104108
tolerationSeconds: 120
105109
priorityClassName: system-cluster-critical
106-
securityContext:
107-
runAsNonRoot: true
108-
runAsUser: 65534
109-
seccompProfile:
110-
type: RuntimeDefault

Diff for: ‎manifests/0000_50_olm_07-olm-operator.deployment.yaml

+8-9
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ spec:
2121
annotations:
2222
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
seccompProfile:
27+
type: RuntimeDefault
2428
serviceAccountName: olm-operator-serviceaccount
2529
volumes:
2630
- name: srv-cert
@@ -31,6 +35,10 @@ spec:
3135
secretName: pprof-cert
3236
containers:
3337
- name: olm-operator
38+
securityContext:
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop: ["ALL"]
3442
volumeMounts:
3543
- name: srv-cert
3644
mountPath: "/srv-cert"
@@ -84,10 +92,6 @@ spec:
8492
requests:
8593
cpu: 10m
8694
memory: 160Mi
87-
securityContext:
88-
allowPrivilegeEscalation: false
89-
capabilities:
90-
drop: ["ALL"]
9195
nodeSelector:
9296
kubernetes.io/os: linux
9397
node-role.kubernetes.io/master: ""
@@ -104,8 +108,3 @@ spec:
104108
operator: Exists
105109
tolerationSeconds: 120
106110
priorityClassName: system-cluster-critical
107-
securityContext:
108-
runAsNonRoot: true
109-
runAsUser: 65534
110-
seccompProfile:
111-
type: RuntimeDefault

Diff for: ‎manifests/0000_50_olm_08-catalog-operator.deployment.ibm-cloud-managed.yaml

+9-9
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ spec:
2121
annotations:
2222
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
seccompProfile:
27+
type: RuntimeDefault
2428
serviceAccountName: olm-operator-serviceaccount
2529
volumes:
2630
- name: srv-cert
@@ -31,6 +35,10 @@ spec:
3135
secretName: pprof-cert
3236
containers:
3337
- name: catalog-operator
38+
securityContext:
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop: ["ALL"]
3442
volumeMounts:
3543
- name: srv-cert
3644
mountPath: "/srv-cert"
@@ -55,6 +63,7 @@ spec:
5563
- /srv-cert/tls.key
5664
- --client-ca
5765
- /profile-collector-cert/tls.crt
66+
- --set-workload-user-id=false
5867
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
5968
imagePullPolicy: IfNotPresent
6069
ports:
@@ -78,10 +87,6 @@ spec:
7887
env:
7988
- name: RELEASE_VERSION
8089
value: "0.0.1-snapshot"
81-
securityContext:
82-
allowPrivilegeEscalation: false
83-
capabilities:
84-
drop: ["ALL"]
8590
nodeSelector:
8691
kubernetes.io/os: linux
8792
tolerations:
@@ -97,8 +102,3 @@ spec:
97102
operator: Exists
98103
tolerationSeconds: 120
99104
priorityClassName: system-cluster-critical
100-
securityContext:
101-
runAsNonRoot: true
102-
runAsUser: 65534
103-
seccompProfile:
104-
type: RuntimeDefault

Diff for: ‎manifests/0000_50_olm_08-catalog-operator.deployment.yaml

+9-9
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ spec:
2121
annotations:
2222
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
seccompProfile:
27+
type: RuntimeDefault
2428
serviceAccountName: olm-operator-serviceaccount
2529
volumes:
2630
- name: srv-cert
@@ -31,6 +35,10 @@ spec:
3135
secretName: pprof-cert
3236
containers:
3337
- name: catalog-operator
38+
securityContext:
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop: ["ALL"]
3442
volumeMounts:
3543
- name: srv-cert
3644
mountPath: "/srv-cert"
@@ -55,6 +63,7 @@ spec:
5563
- /srv-cert/tls.key
5664
- --client-ca
5765
- /profile-collector-cert/tls.crt
66+
- --set-workload-user-id=false
5867
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
5968
imagePullPolicy: IfNotPresent
6069
ports:
@@ -78,10 +87,6 @@ spec:
7887
env:
7988
- name: RELEASE_VERSION
8089
value: "0.0.1-snapshot"
81-
securityContext:
82-
allowPrivilegeEscalation: false
83-
capabilities:
84-
drop: ["ALL"]
8590
nodeSelector:
8691
kubernetes.io/os: linux
8792
node-role.kubernetes.io/master: ""
@@ -98,8 +103,3 @@ spec:
98103
operator: Exists
99104
tolerationSeconds: 120
100105
priorityClassName: system-cluster-critical
101-
securityContext:
102-
runAsNonRoot: true
103-
runAsUser: 65534
104-
seccompProfile:
105-
type: RuntimeDefault

Diff for: ‎pkg/manifests/csv.yaml

+8-9
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,10 @@ spec:
8888
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
8989
creationTimestamp: null
9090
spec:
91+
securityContext:
92+
runAsNonRoot: true
93+
seccompProfile:
94+
type: RuntimeDefault
9195
serviceAccountName: olm-operator-serviceaccount
9296
nodeSelector:
9397
kubernetes.io/os: linux
@@ -106,6 +110,10 @@ spec:
106110
tolerationSeconds: 120
107111
containers:
108112
- name: packageserver
113+
securityContext:
114+
allowPrivilegeEscalation: false
115+
capabilities:
116+
drop: ["ALL"]
109117
command:
110118
- /bin/package-server
111119
- -v=4
@@ -136,10 +144,6 @@ spec:
136144
volumeMounts:
137145
- name: tmpfs
138146
mountPath: /tmp
139-
securityContext:
140-
allowPrivilegeEscalation: false
141-
capabilities:
142-
drop: ["ALL"]
143147
volumes:
144148
- name: tmpfs
145149
emptyDir: {}
@@ -154,11 +158,6 @@ spec:
154158
values:
155159
- packageserver
156160
topologyKey: "kubernetes.io/hostname"
157-
securityContext:
158-
runAsNonRoot: true
159-
runAsUser: 65534
160-
seccompProfile:
161-
type: RuntimeDefault
162161
maturity: alpha
163162
version: 0.19.0
164163
apiservicedefinitions:

Diff for: ‎scripts/catalog-deployment.patch.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,5 @@
1919
path: spec.template.spec.securityContext
2020
value:
2121
runAsNonRoot: true
22-
runAsUser: 65534
2322
seccompProfile:
2423
type: RuntimeDefault

Diff for: ‎scripts/generate_crds_manifests.sh

+2-1
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,6 @@ spec:
133133
spec:
134134
securityContext:
135135
runAsNonRoot: true
136-
runAsUser: 65534
137136
seccompProfile:
138137
type: RuntimeDefault
139138
serviceAccountName: olm-operator-serviceaccount
@@ -402,3 +401,5 @@ add_ibm_managed_cloud_annotations "${ROOT_DIR}/manifests"
402401

403402
find "${ROOT_DIR}/manifests" -type f -exec $SED -i "/^#/d" {} \;
404403
find "${ROOT_DIR}/manifests" -type f -exec $SED -i "1{/---/d}" {} \;
404+
405+
${YQ} delete --inplace -d'0' manifests/0000_50_olm_00-namespace.yaml 'metadata.labels."pod-security.kubernetes.io/enforce*"'

Diff for: ‎scripts/olm-deployment.patch.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,5 @@
2727
path: spec.template.spec.securityContext
2828
value:
2929
runAsNonRoot: true
30-
runAsUser: 65534
3130
seccompProfile:
3231
type: RuntimeDefault

Diff for: ‎scripts/packageserver-deployment.patch.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,5 @@
4343
path: spec.install.spec.deployments[0].spec.template.spec.securityContext
4444
value:
4545
runAsNonRoot: true
46-
runAsUser: 65534
4746
seccompProfile:
4847
type: RuntimeDefault

Diff for: ‎staging/operator-lifecycle-manager/Dockerfile

+1
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ COPY --from=builder /build/bin/olm /bin/olm
3333
COPY --from=builder /build/bin/catalog /bin/catalog
3434
COPY --from=builder /build/bin/package-server /bin/package-server
3535
COPY --from=builder /build/bin/cpb /bin/cpb
36+
USER 1001
3637
EXPOSE 8080
3738
EXPOSE 5443
3839
CMD ["/bin/olm"]

Diff for: ‎staging/operator-lifecycle-manager/Dockerfile.goreleaser

+1
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,5 @@ COPY package-server /bin/package-server
1010
COPY cpb /bin/cpb
1111
EXPOSE 8080
1212
EXPOSE 5443
13+
USER 1001
1314
ENTRYPOINT ["/bin/olm"]

Diff for: ‎staging/operator-lifecycle-manager/cmd/catalog/main.go

+6
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ const (
3030
defaultOPMImage = "quay.io/operator-framework/upstream-opm-builder:latest"
3131
defaultUtilImage = "quay.io/operator-framework/olm:latest"
3232
defaultOperatorName = ""
33+
defaultWorkLoadUserID = int64(1001)
3334
)
3435

3536
// config flags defined globally so that they appear on the test binary as well
@@ -83,6 +84,10 @@ func (o *options) run(ctx context.Context, logger *logrus.Logger) error {
8384
return fmt.Errorf("error configuring client: %s", err.Error())
8485
}
8586

87+
workloadUserID := int64(-1)
88+
if o.setWorkloadUserID {
89+
workloadUserID = defaultWorkLoadUserID
90+
}
8691
// TODO(tflannag): Use options pattern for catalog operator
8792
// Create a new instance of the operator.
8893
op, err := catalog.NewOperator(
@@ -98,6 +103,7 @@ func (o *options) run(ctx context.Context, logger *logrus.Logger) error {
98103
k8sscheme.Scheme,
99104
o.installPlanTimeout,
100105
o.bundleUnpackTimeout,
106+
workloadUserID,
101107
)
102108
if err != nil {
103109
return fmt.Errorf("error configuring catalog operator: %s", err.Error())

Diff for: ‎staging/operator-lifecycle-manager/cmd/catalog/start.go

+2
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ type options struct {
2525
tlsKeyPath string
2626
tlsCertPath string
2727
clientCAPath string
28+
setWorkloadUserID bool
2829

2930
installPlanTimeout time.Duration
3031
bundleUnpackTimeout time.Duration
@@ -66,6 +67,7 @@ func newRootCmd() *cobra.Command {
6667
cmd.Flags().StringVar(&o.opmImage, "opmImage", defaultOPMImage, "the image to use for unpacking bundle content with opm")
6768
cmd.Flags().StringVar(&o.utilImage, "util-image", defaultUtilImage, "an image containing custom olm utilities")
6869
cmd.Flags().StringVar(&o.writeStatusName, "writeStatusName", defaultOperatorName, "ClusterOperator name in which to write status, set to \"\" to disable.")
70+
cmd.Flags().BoolVar(&o.setWorkloadUserID, "set-workload-user-id", false, "set user ID for all workloads (registry pods/bundle unpack jobs to default 1001")
6971

7072
cmd.Flags().BoolVar(&o.debug, "debug", false, "use debug log level")
7173
cmd.Flags().BoolVar(&o.version, "version", false, "displays the olm version")

Diff for: ‎staging/operator-lifecycle-manager/deploy/chart/templates/0000_50_olm_00-namespace.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,19 @@ apiVersion: v1
22
kind: Namespace
33
metadata:
44
name: {{ .Values.namespace }}
5+
labels:
6+
{{- if .Values.namespace_psa }}
7+
pod-security.kubernetes.io/enforce: {{ .Values.namespace_psa.enforceLevel }}
8+
pod-security.kubernetes.io/enforce-version: {{ .Values.namespace_psa.enforceVersion }}
9+
{{- end }}
510

611
---
712
apiVersion: v1
813
kind: Namespace
914
metadata:
1015
name: {{ .Values.operator_namespace }}
16+
labels:
17+
{{- if .Values.operator_namespace_psa }}
18+
pod-security.kubernetes.io/enforce: {{ .Values.operator_namespace_psa.enforceLevel }}
19+
pod-security.kubernetes.io/enforce-version: {{ .Values.operator_namespace_psa.enforceVersion }}
20+
{{- end }}

0 commit comments

Comments
 (0)