Skip to content

Commit 183bbfe

Browse files
perdasilvaperdasilva
committed
Revert "Update unpack job pod security (#2793)"
This reverts commit eedad28. Signed-off-by: perdasilva <[email protected]>
1 parent 4d7c8de commit 183bbfe

File tree

5 files changed

+27
-105
lines changed

5 files changed

+27
-105
lines changed

Diff for: ‎pkg/controller/bundle/bundle_unpacker.go

-5
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ import (
2828
listersoperatorsv1alpha1 "github.com/operator-framework/operator-lifecycle-manager/pkg/api/client/listers/operators/v1alpha1"
2929
"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install"
3030
"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/resolver/projection"
31-
"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/security"
3231
)
3332

3433
const (
@@ -191,10 +190,6 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
191190
},
192191
},
193192
}
194-
195-
// Apply Pod security
196-
security.ApplyPodSpecSecurity(&job.Spec.Template.Spec)
197-
198193
job.SetNamespace(cmRef.Namespace)
199194
job.SetName(cmRef.Name)
200195
job.SetOwnerReferences([]metav1.OwnerReference{ownerRef(cmRef)})

Diff for: ‎pkg/controller/bundle/bundle_unpacker_test.go

+5-52
Original file line numberDiff line numberDiff line change
@@ -68,29 +68,6 @@ func TestConfigMapUnpacker(t *testing.T) {
6868
roleBindings []*rbacv1.RoleBinding
6969
}
7070

71-
var expectedReadOnlyRootFilesystem = false
72-
var expectedAllowPrivilegeEscalation = false
73-
var expectedRunAsNonRoot = true
74-
var expectedRunAsUser int64 = 1001
75-
var expectedPrivileged = false
76-
77-
var expectedContainerSecurityContext = &corev1.SecurityContext{
78-
Privileged: &expectedPrivileged,
79-
ReadOnlyRootFilesystem: &expectedReadOnlyRootFilesystem,
80-
AllowPrivilegeEscalation: &expectedAllowPrivilegeEscalation,
81-
Capabilities: &corev1.Capabilities{
82-
Drop: []corev1.Capability{"ALL"},
83-
},
84-
}
85-
86-
var expectedPodSecurityContext = &corev1.PodSecurityContext{
87-
RunAsNonRoot: &expectedRunAsNonRoot,
88-
RunAsUser: &expectedRunAsUser,
89-
SeccompProfile: &corev1.SeccompProfile{
90-
Type: corev1.SeccompProfileTypeRuntimeDefault,
91-
},
92-
}
93-
9471
tests := []struct {
9572
description string
9673
fields fields
@@ -243,7 +220,6 @@ func TestConfigMapUnpacker(t *testing.T) {
243220
Spec: corev1.PodSpec{
244221
RestartPolicy: corev1.RestartPolicyNever,
245222
ImagePullSecrets: []corev1.LocalObjectReference{{Name: "my-secret"}},
246-
SecurityContext: expectedPodSecurityContext,
247223
Containers: []corev1.Container{
248224
{
249225
Name: "extract",
@@ -267,7 +243,6 @@ func TestConfigMapUnpacker(t *testing.T) {
267243
corev1.ResourceMemory: resource.MustParse("50Mi"),
268244
},
269245
},
270-
SecurityContext: expectedContainerSecurityContext,
271246
},
272247
},
273248
InitContainers: []corev1.Container{
@@ -287,7 +262,6 @@ func TestConfigMapUnpacker(t *testing.T) {
287262
corev1.ResourceMemory: resource.MustParse("50Mi"),
288263
},
289264
},
290-
SecurityContext: expectedContainerSecurityContext,
291265
},
292266
{
293267
Name: "pull",
@@ -310,7 +284,6 @@ func TestConfigMapUnpacker(t *testing.T) {
310284
corev1.ResourceMemory: resource.MustParse("50Mi"),
311285
},
312286
},
313-
SecurityContext: expectedContainerSecurityContext,
314287
},
315288
},
316289
Volumes: []corev1.Volume{
@@ -423,8 +396,7 @@ func TestConfigMapUnpacker(t *testing.T) {
423396
Name: pathHash,
424397
},
425398
Spec: corev1.PodSpec{
426-
RestartPolicy: corev1.RestartPolicyNever,
427-
SecurityContext: expectedPodSecurityContext,
399+
RestartPolicy: corev1.RestartPolicyNever,
428400
Containers: []corev1.Container{
429401
{
430402
Name: "extract",
@@ -448,7 +420,6 @@ func TestConfigMapUnpacker(t *testing.T) {
448420
corev1.ResourceMemory: resource.MustParse("50Mi"),
449421
},
450422
},
451-
SecurityContext: expectedContainerSecurityContext,
452423
},
453424
},
454425
InitContainers: []corev1.Container{
@@ -468,7 +439,6 @@ func TestConfigMapUnpacker(t *testing.T) {
468439
corev1.ResourceMemory: resource.MustParse("50Mi"),
469440
},
470441
},
471-
SecurityContext: expectedContainerSecurityContext,
472442
},
473443
{
474444
Name: "pull",
@@ -491,7 +461,6 @@ func TestConfigMapUnpacker(t *testing.T) {
491461
corev1.ResourceMemory: resource.MustParse("50Mi"),
492462
},
493463
},
494-
SecurityContext: expectedContainerSecurityContext,
495464
},
496465
},
497466
Volumes: []corev1.Volume{
@@ -645,8 +614,7 @@ func TestConfigMapUnpacker(t *testing.T) {
645614
Name: pathHash,
646615
},
647616
Spec: corev1.PodSpec{
648-
RestartPolicy: corev1.RestartPolicyNever,
649-
SecurityContext: expectedPodSecurityContext,
617+
RestartPolicy: corev1.RestartPolicyNever,
650618
Containers: []corev1.Container{
651619
{
652620
Name: "extract",
@@ -670,7 +638,6 @@ func TestConfigMapUnpacker(t *testing.T) {
670638
corev1.ResourceMemory: resource.MustParse("50Mi"),
671639
},
672640
},
673-
SecurityContext: expectedContainerSecurityContext,
674641
},
675642
},
676643
InitContainers: []corev1.Container{
@@ -690,7 +657,6 @@ func TestConfigMapUnpacker(t *testing.T) {
690657
corev1.ResourceMemory: resource.MustParse("50Mi"),
691658
},
692659
},
693-
SecurityContext: expectedContainerSecurityContext,
694660
},
695661
{
696662
Name: "pull",
@@ -713,7 +679,6 @@ func TestConfigMapUnpacker(t *testing.T) {
713679
corev1.ResourceMemory: resource.MustParse("50Mi"),
714680
},
715681
},
716-
SecurityContext: expectedContainerSecurityContext,
717682
},
718683
},
719684
Volumes: []corev1.Volume{
@@ -861,8 +826,7 @@ func TestConfigMapUnpacker(t *testing.T) {
861826
Name: pathHash,
862827
},
863828
Spec: corev1.PodSpec{
864-
RestartPolicy: corev1.RestartPolicyNever,
865-
SecurityContext: expectedPodSecurityContext,
829+
RestartPolicy: corev1.RestartPolicyNever,
866830
Containers: []corev1.Container{
867831
{
868832
Name: "extract",
@@ -886,7 +850,6 @@ func TestConfigMapUnpacker(t *testing.T) {
886850
corev1.ResourceMemory: resource.MustParse("50Mi"),
887851
},
888852
},
889-
SecurityContext: expectedContainerSecurityContext,
890853
},
891854
},
892855
InitContainers: []corev1.Container{
@@ -906,7 +869,6 @@ func TestConfigMapUnpacker(t *testing.T) {
906869
corev1.ResourceMemory: resource.MustParse("50Mi"),
907870
},
908871
},
909-
SecurityContext: expectedContainerSecurityContext,
910872
},
911873
{
912874
Name: "pull",
@@ -929,7 +891,6 @@ func TestConfigMapUnpacker(t *testing.T) {
929891
corev1.ResourceMemory: resource.MustParse("50Mi"),
930892
},
931893
},
932-
SecurityContext: expectedContainerSecurityContext,
933894
},
934895
},
935896
Volumes: []corev1.Volume{
@@ -1047,8 +1008,7 @@ func TestConfigMapUnpacker(t *testing.T) {
10471008
Name: pathHash,
10481009
},
10491010
Spec: corev1.PodSpec{
1050-
RestartPolicy: corev1.RestartPolicyNever,
1051-
SecurityContext: expectedPodSecurityContext,
1011+
RestartPolicy: corev1.RestartPolicyNever,
10521012
Containers: []corev1.Container{
10531013
{
10541014
Name: "extract",
@@ -1072,7 +1032,6 @@ func TestConfigMapUnpacker(t *testing.T) {
10721032
corev1.ResourceMemory: resource.MustParse("50Mi"),
10731033
},
10741034
},
1075-
SecurityContext: expectedContainerSecurityContext,
10761035
},
10771036
},
10781037
InitContainers: []corev1.Container{
@@ -1092,7 +1051,6 @@ func TestConfigMapUnpacker(t *testing.T) {
10921051
corev1.ResourceMemory: resource.MustParse("50Mi"),
10931052
},
10941053
},
1095-
SecurityContext: expectedContainerSecurityContext,
10961054
},
10971055
{
10981056
Name: "pull",
@@ -1115,7 +1073,6 @@ func TestConfigMapUnpacker(t *testing.T) {
11151073
corev1.ResourceMemory: resource.MustParse("50Mi"),
11161074
},
11171075
},
1118-
SecurityContext: expectedContainerSecurityContext,
11191076
},
11201077
},
11211078
Volumes: []corev1.Volume{
@@ -1244,8 +1201,7 @@ func TestConfigMapUnpacker(t *testing.T) {
12441201
Name: pathHash,
12451202
},
12461203
Spec: corev1.PodSpec{
1247-
RestartPolicy: corev1.RestartPolicyNever,
1248-
SecurityContext: expectedPodSecurityContext,
1204+
RestartPolicy: corev1.RestartPolicyNever,
12491205
Containers: []corev1.Container{
12501206
{
12511207
Name: "extract",
@@ -1269,7 +1225,6 @@ func TestConfigMapUnpacker(t *testing.T) {
12691225
corev1.ResourceMemory: resource.MustParse("50Mi"),
12701226
},
12711227
},
1272-
SecurityContext: expectedContainerSecurityContext,
12731228
},
12741229
},
12751230
InitContainers: []corev1.Container{
@@ -1289,7 +1244,6 @@ func TestConfigMapUnpacker(t *testing.T) {
12891244
corev1.ResourceMemory: resource.MustParse("50Mi"),
12901245
},
12911246
},
1292-
SecurityContext: expectedContainerSecurityContext,
12931247
},
12941248
{
12951249
Name: "pull",
@@ -1312,7 +1266,6 @@ func TestConfigMapUnpacker(t *testing.T) {
13121266
corev1.ResourceMemory: resource.MustParse("50Mi"),
13131267
},
13141268
},
1315-
SecurityContext: expectedContainerSecurityContext,
13161269
},
13171270
},
13181271
Volumes: []corev1.Volume{

Diff for: ‎pkg/controller/registry/reconciler/reconciler.go

+22-4
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ import (
1212
"k8s.io/apimachinery/pkg/util/rand"
1313

1414
operatorsv1alpha1 "github.com/operator-framework/api/pkg/operators/v1alpha1"
15-
"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/security"
1615
controllerclient "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/controller-runtime/client"
1716
hashutil "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/hash"
1817
"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient"
@@ -114,6 +113,14 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name string, image string, saN
114113
pullPolicy = corev1.PullAlways
115114
}
116115

116+
// Security context
117+
readOnlyRootFilesystem := false
118+
allowPrivilegeEscalation := false
119+
runAsNonRoot := true
120+
121+
// See: https://github.com/operator-framework/operator-registry/blob/master/Dockerfile#L27
122+
runAsUser := int64(1001)
123+
117124
pod := &corev1.Pod{
118125
ObjectMeta: metav1.ObjectMeta{
119126
GenerateName: source.GetName() + "-",
@@ -165,20 +172,31 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name string, image string, saN
165172
corev1.ResourceMemory: resource.MustParse("50Mi"),
166173
},
167174
},
175+
SecurityContext: &corev1.SecurityContext{
176+
ReadOnlyRootFilesystem: &readOnlyRootFilesystem,
177+
AllowPrivilegeEscalation: &allowPrivilegeEscalation,
178+
Capabilities: &corev1.Capabilities{
179+
Drop: []corev1.Capability{"ALL"},
180+
},
181+
},
168182
ImagePullPolicy: pullPolicy,
169183
TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
170184
},
171185
},
186+
SecurityContext: &corev1.PodSecurityContext{
187+
RunAsNonRoot: &runAsNonRoot,
188+
RunAsUser: &runAsUser,
189+
SeccompProfile: &corev1.SeccompProfile{
190+
Type: corev1.SeccompProfileTypeRuntimeDefault,
191+
},
192+
},
172193
NodeSelector: map[string]string{
173194
"kubernetes.io/os": "linux",
174195
},
175196
ServiceAccountName: saName,
176197
},
177198
}
178199

179-
// Update pod security
180-
security.ApplyPodSpecSecurity(&pod.Spec)
181-
182200
// Override scheduling options if specified
183201
if source.Spec.GrpcPodConfig != nil {
184202
grpcPodConfig := source.Spec.GrpcPodConfig

Diff for: ‎pkg/controller/registry/reconciler/reconciler_test.go

-2
Original file line numberDiff line numberDiff line change
@@ -82,10 +82,8 @@ func TestPodContainerSecurityContext(t *testing.T) {
8282
expectedAllowPrivilegeEscalation := false
8383
expectedRunAsNonRoot := true
8484
expectedRunAsUser := int64(1001)
85-
expectedPrivileged := false
8685

8786
expectedContainerSecCtx := &corev1.SecurityContext{
88-
Privileged: &expectedPrivileged,
8987
ReadOnlyRootFilesystem: &expectedReadOnlyRootFilesystem,
9088
AllowPrivilegeEscalation: &expectedAllowPrivilegeEscalation,
9189
Capabilities: &corev1.Capabilities{

Diff for: ‎pkg/controller/security/security.go

-42
This file was deleted.

0 commit comments

Comments
 (0)