Update unpack job security

Signed-off-by: perdasilva <[email protected]>

Author: perdasilva

Diff for: pkg/controller/bundle/bundle_unpacker.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/security"
 	"github.com/operator-framework/operator-registry/pkg/api"
 	"github.com/operator-framework/operator-registry/pkg/configmap"
 	"github.com/sirupsen/logrus"
@@ -190,6 +191,10 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
 			},
 		},
 	}
+
+	// Apply Pod security
+	security.ApplyPodSpecSecurity(&job.Spec.Template.Spec)
+
 	job.SetNamespace(cmRef.Namespace)
 	job.SetName(cmRef.Name)
 	job.SetOwnerReferences([]metav1.OwnerReference{ownerRef(cmRef)})

Diff for: pkg/controller/registry/reconciler/reconciler.go

@@ -6,6 +6,7 @@ import (
 	"hash/fnv"
 	"strings"
 
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/security"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -113,14 +114,6 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name string, image string, saN
 		pullPolicy = corev1.PullAlways
 	}
 
-	// Security context
-	readOnlyRootFilesystem := false
-	allowPrivilegeEscalation := false
-	runAsNonRoot := true
-
-	// See: https://github.com/operator-framework/operator-registry/blob/master/Dockerfile#L27
-	runAsUser := int64(1001)
-
 	pod := &corev1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
 			GenerateName: source.GetName() + "-",
@@ -172,31 +165,20 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name string, image string, saN
 							corev1.ResourceMemory: resource.MustParse("50Mi"),
 						},
 					},
-					SecurityContext: &corev1.SecurityContext{
-						ReadOnlyRootFilesystem:   &readOnlyRootFilesystem,
-						AllowPrivilegeEscalation: &allowPrivilegeEscalation,
-						Capabilities: &corev1.Capabilities{
-							Drop: []corev1.Capability{"ALL"},
-						},
-					},
 					ImagePullPolicy:          pullPolicy,
 					TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 				},
 			},
-			SecurityContext: &corev1.PodSecurityContext{
-				RunAsNonRoot: &runAsNonRoot,
-				RunAsUser:    &runAsUser,
-				SeccompProfile: &corev1.SeccompProfile{
-					Type: corev1.SeccompProfileTypeRuntimeDefault,
-				},
-			},
 			NodeSelector: map[string]string{
 				"kubernetes.io/os": "linux",
 			},
 			ServiceAccountName: saName,
 		},
 	}
 
+	// Apply Pod security
+	security.ApplyPodSpecSecurity(&pod.Spec)
+
 	// Override scheduling options if specified
 	if source.Spec.GrpcPodConfig != nil {
 		grpcPodConfig := source.Spec.GrpcPodConfig

Diff for: pkg/controller/security/security.go

@@ -0,0 +1,35 @@
+package security
+
+import corev1 "k8s.io/api/core/v1"
+
+var readOnlyRootFilesystem = false
+var allowPrivilegeEscalation = false
+var runAsNonRoot = true
+var runAsUser int64 = 1001
+
+var containerSecurityContext = &corev1.SecurityContext{
+	ReadOnlyRootFilesystem:   &readOnlyRootFilesystem,
+	AllowPrivilegeEscalation: &allowPrivilegeEscalation,
+	Capabilities: &corev1.Capabilities{
+		Drop: []corev1.Capability{"ALL"},
+	},
+}
+
+var podSecurityContext = &corev1.PodSecurityContext{
+	RunAsNonRoot: &runAsNonRoot,
+	RunAsUser:    &runAsUser,
+	SeccompProfile: &corev1.SeccompProfile{
+		Type: corev1.SeccompProfileTypeRuntimeDefault,
+	},
+}
+
+// ApplyPodSpecSecurity applies the standard security profile to a pod spec
+func ApplyPodSpecSecurity(spec *corev1.PodSpec) {
+	spec.SecurityContext = podSecurityContext
+	for idx := 0; idx < len(spec.Containers); idx++ {
+		spec.Containers[idx].SecurityContext = containerSecurityContext
+	}
+	for idx := 0; idx < len(spec.InitContainers); idx++ {
+		spec.InitContainers[idx].SecurityContext = containerSecurityContext
+	}
+}