[TEST-ONLY] [WIP] Test sec default #134

skonto · 2023-01-20T09:04:34Z

Adapted from Add secure-pod-defaults flag to default Pods to 'restricted' profile by default knative/serving#13398
We will enable the feature by default at the S-O side on OCP 4.11+ as we did with deprecated apis.
The feature flag is: secure-pod-defaults.
Tested on 4.13 for audit warnings. To test follow the process here (you need the latest oc version to avoid failures):

oc adm must-gather -- /usr/bin/gather_audit_logs
cd must-gather.local....
gunzip -r *
find ./ -type f -exec grep -l "violation" {} \; | xargs cat | grep violation

Introduces "serving.knative.openshift.io/skipSeccompProfile" as a revision annotation that allows to skip setting seccomProfile for a service so it can run with the default image user. Since we support versions < 4.11 SeccompProfile is only set by default in versions > 4.10.

…ative#13565) (knative#131)" This reverts commit f12a329.

openshift-ci · 2023-01-20T09:04:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: skonto

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [skonto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

skonto · 2023-01-20T09:05:09Z

/hold

…ged. (knative#13565) (knative#131)"" This reverts commit 81e9cc0.

skonto · 2023-01-23T13:20:09Z

The problematic test now passed. Will unblock the rest.

skonto · 2023-01-24T08:50:34Z

Now that all tests pass I will test again without the capabilities flag as upstream tests pass without it.

skonto · 2023-02-16T08:17:10Z

/retest

skonto · 2023-02-16T10:15:02Z

/test 48-e2e-aws-ocp-48

openshift-ci · 2023-02-16T10:15:05Z

@skonto: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test 410-e2e-aws-ocp-410
/test 410-images
/test 411-e2e-aws-ocp-411
/test 411-images
/test 48-e2e-aws-ocp-48
/test 48-images
/test 49-e2e-aws-ocp-49
/test 49-images

Use /test all to run all jobs.

Details

In response to this:

/retest 48-e2e-aws-ocp-48

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

skonto · 2023-02-16T10:15:26Z

/test 48-e2e-aws-ocp-48

skonto · 2023-02-23T17:27:30Z

/retest

skonto · 2023-02-23T17:37:43Z

/retest

skonto · 2023-02-23T20:04:59Z

/retest

matzew · 2023-02-28T14:57:14Z

vendor/knative.dev/pkg/injection/sharedmain/main.go

 	CheckK8sClientMinimumVersionOrDie(ctx, logger)
+	// HACK: should go away when we move away from < 4.11 releases
+	if err := CheckMinimumKubeVersion(kubeclient.Get(ctx).Discovery(), "1.24.0"); err == nil {
+		os.Setenv("OCP_SECCOMP_PROFILE_WITHOUT_SCC", "true")


@skonto is that our env-var? If so, I'd prefix it slightly different, to not confuse w/ actual OCP bits

matzew · 2023-02-28T15:24:35Z

vendor/knative.dev/pkg/injection/sharedmain/main.go


 	CheckK8sClientMinimumVersionOrDie(ctx, logger)
+	// HACK: should go away when we move away from < 4.11 releases
+	if err := CheckMinimumKubeVersion(kubeclient.Get(ctx).Discovery(), "1.24.0"); err == nil {


why on this file?

the pkg/version has already the normalizeVersion func

matzew · 2023-02-28T15:26:12Z

vendor/knative.dev/pkg/injection/sharedmain/main.go


 	CheckK8sClientMinimumVersionOrDie(ctx, logger)
+	// HACK: should go away when we move away from < 4.11 releases
+	if err := CheckMinimumKubeVersion(kubeclient.Get(ctx).Discovery(), "1.24.0"); err == nil {


let's just hard-code against 1.24?

matzew · 2023-02-28T15:26:39Z

vendor/knative.dev/pkg/injection/sharedmain/main.go

+
+// CheckMinimumKubeVersion checks if current K8s version we are on is higher than the one passed.
+// If an error is returned then the version is not higher than the minimum
+func CheckMinimumKubeVersion(versioner discovery.ServerVersionInterface, version string) error {


we can remove the version ? since we anyways want to check here for 1.24.0

skonto · 2023-03-01T11:21:22Z

/test 411-e2e-aws-ocp-411

skonto added 2 commits January 20, 2023 10:46

add revision security defaults

69e2768

Revert "Don't default Revision values when BYO name is unchanged. (kn…

81e9cc0

…ative#13565) (knative#131)" This reverts commit f12a329.

openshift-ci bot requested review from mgencur and mvinkler January 20, 2023 09:04

openshift-ci bot added the approved label Jan 20, 2023

openshift-ci bot added the do-not-merge/hold label Jan 20, 2023

skonto added 8 commits January 20, 2023 12:38

disable cap

d9aec78

closest to upstream

7dec285

Revert "Revert "Don't default Revision values when BYO name is unchan…

3107dd0

…ged. (knative#13565) (knative#131)"" This reverts commit 81e9cc0.

enable debug to get the diff

d272a82

add more logs

cee9f47

logs

71cb1dd

run one

fed1c32

find diff

45307e6

skonto changed the title ~~[TEST-ONLY] [WIP] Test sec default no byo~~ [TEST-ONLY] [WIP] Test sec default Jan 21, 2023

skonto added 2 commits January 23, 2023 12:10

updates

168c64e

update test cr

f63c8c0

skonto added 4 commits January 23, 2023 15:49

run all tests

333c87e

set RunAsNonRoot

c0dec98

fix issues

515838a

fix secPodDefaults test

d29cc34

disable addcapabilities

c977f49

nak3 mentioned this pull request Jan 24, 2023

[TEST-ONLY] [WIP] Test sec default #138

Closed

skonto added 2 commits January 24, 2023 16:59

improve test condition

c854a51

try unconfined

ff52090

skonto added 9 commits February 16, 2023 14:45

debug test

fcaab1b

cleanup

5dd4573

fix annotation

d90fefc

run one debug

1b2d0ef

use revision annotation instead

537868e

fix assignement

6f00ba5

cover all paths

2432189

refactoring

231c529

fix queue proxy seccompProfile

1612157

skonto added 5 commits February 23, 2023 23:36

fix run with image user for queue proxy

cfe8619

run all tests

445f875

test one

d0a3026

test all

eb19542

fix queue sc

39cc661

skonto changed the title ~~[TEST-ONLY] [WIP] Test sec default~~ [RELEASE-1.7][SRVKS-985] Add revision security defaults Feb 28, 2023

skonto changed the title ~~[RELEASE-1.7][SRVKS-985] Add revision security defaults~~ [TEST-ONLY] [WIP] Test sec default Feb 28, 2023

matzew reviewed Feb 28, 2023

View reviewed changes

skonto added 2 commits March 1, 2023 02:31

fixes

2f02325

fixes tests

ea1b659

skonto closed this Mar 3, 2023

[TEST-ONLY] [WIP] Test sec default #134

[TEST-ONLY] [WIP] Test sec default #134

Uh oh!

Conversation

skonto commented Jan 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Jan 20, 2023

Uh oh!

skonto commented Jan 20, 2023

Uh oh!

skonto commented Jan 23, 2023

Uh oh!

skonto commented Jan 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skonto commented Feb 16, 2023

Uh oh!

skonto commented Feb 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Feb 16, 2023

Uh oh!

skonto commented Feb 16, 2023

Uh oh!

skonto commented Feb 23, 2023

Uh oh!

skonto commented Feb 23, 2023

Uh oh!

skonto commented Feb 23, 2023

Uh oh!

matzew Feb 28, 2023

Choose a reason for hiding this comment

Uh oh!

matzew Feb 28, 2023

Choose a reason for hiding this comment

Uh oh!

matzew Feb 28, 2023

Choose a reason for hiding this comment

Uh oh!

matzew Feb 28, 2023

Choose a reason for hiding this comment

Uh oh!

skonto commented Mar 1, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

skonto commented Jan 20, 2023 •

edited

Loading

skonto commented Jan 24, 2023 •

edited

Loading

skonto commented Feb 16, 2023 •

edited

Loading