[release-4.16] OCPBUGS-34979: Updates default security context behavior for catalog source pods by joelanford · Pull Request #765 · openshift/operator-framework-olm

joelanford · 2024-06-05T17:51:36Z

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions
Fix linter issues
fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

openshift-ci-robot · 2024-06-05T17:51:42Z

@joelanford: This pull request references Jira Issue OCPBUGS-29729, which is invalid:

expected the bug to target the "4.16.0" version, but no target version was set
release note text must be set and not match the template OR release note type must be set to "Release Note Not Required"
expected Jira Issue OCPBUGS-29729 to depend on a bug targeting a version in 4.17.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-06-05T17:52:38Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joelanford

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~DOWNSTREAM_OWNERS~~ [joelanford]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

joelanford · 2024-06-05T19:39:40Z

/retest

kevinrizza · 2024-06-05T19:47:29Z

/lgtm

bentito · 2024-06-05T19:54:52Z

 		}
-		objs = clientfake.AddSimpleGeneratedNames(
-			clientfake.AddSimpleGeneratedName(pod),
+		objs = append(objs,


AddSimpleGeneratedNames() can go away, this was the only usage.

bentito · 2024-06-05T20:08:15Z

-			factory, client := fakeReconcilerFactory(t, stopc, withNow(now), withK8sObjs(tt.in.cluster.k8sObjs...), withK8sClientOptions(clientfake.WithNameGeneration(t)))
+			// a defaultNamespace resource must be present so that the reconciler can determine the
+			// security context configuration for the underlying pod
+			clusterState := append(tt.in.cluster.k8sObjs, defaultNamespace())


Think this uses the new func and is a bit easier to read and reason about:

Suggested change

clusterState := append(tt.in.cluster.k8sObjs, defaultNamespace())

clusterState := baseClusterState()```

openshift-ci-robot · 2024-06-05T20:38:54Z

@joelanford: This pull request references Jira Issue OCPBUGS-34979, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required"
expected Jira Issue OCPBUGS-34979 to depend on a bug targeting a version in 4.17.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bentito · 2024-06-05T20:42:26Z

Comments about test changes that might not be desirable for a backport. Other than that /lgtm

joelanford · 2024-06-05T20:50:23Z

/jira refresh

openshift-ci-robot · 2024-06-05T20:50:30Z

@joelanford: This pull request references Jira Issue OCPBUGS-34979, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.16.0) matches configured target version for branch (4.16.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-29729 is in the state MODIFIED, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
dependent Jira Issue OCPBUGS-29729 targets the "4.17.0" version, which is one of the valid target versions: 4.17.0
bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Jira (jiazha@redhat.com), skipping review request.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

joelanford · 2024-06-05T20:51:04Z

/label backport-risk-assessed

joelanford · 2024-06-06T00:25:22Z

/test e2e-gcp-olm

jianzhangbjz · 2024-06-07T01:56:23Z

failed ON_QA test on 4.17 https://issues.redhat.com/browse/OCPBUGS-29729
/hold

perdasilva · 2024-06-11T10:55:59Z

/retest

perdasilva · 2024-06-11T15:49:09Z

@joelanford can you please rebase to pick up the CI changes. Hopefully then it's green =D

…source pods (#3206) * Refactor security context configuration in pod reconciler This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior. Signed-off-by: btofel <btofel@redhat.com> * Add checking of the namespace PSA restrictions Signed-off-by: btofel <btofel@redhat.com> * Fix linter issues Signed-off-by: btofel <btofel@redhat.com> Signed-off-by: Brett Tofel <btofel@redhat.com> * fixes Signed-off-by: Per Goncalves da Silva <pegoncal@redhat.com> --------- Signed-off-by: btofel <btofel@redhat.com> Signed-off-by: Brett Tofel <btofel@redhat.com> Signed-off-by: Per Goncalves da Silva <pegoncal@redhat.com> Co-authored-by: Brett Tofel <btofel@redhat.com> Co-authored-by: Per Goncalves da Silva <pegoncal@redhat.com> Upstream-repository: operator-lifecycle-manager Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

openshift-ci · 2024-06-11T17:22:10Z

New changes are detected. LGTM label has been removed.

perdasilva · 2024-06-12T08:14:39Z

/retest

perdasilva · 2024-06-12T12:17:13Z

/retest

openshift-ci · 2024-06-12T15:39:02Z

@joelanford: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-olm	`c1d2466`	link	true	`/test e2e-gcp-olm`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

perdasilva · 2024-06-17T09:12:58Z

I think if you pull in the commit from this closed PR. It should fix the CRDs. I had to pull in only the CRD changes: api v0.26.0 is on go1.22. Not sure if it's how you'd like to downstream.

perdasilva · 2024-06-17T10:55:58Z

I think if you pull in the commit from this closed PR. It should fix the CRDs. I had to pull in only the CRD changes: api v0.26.0 is on go1.22. Not sure if it's how you'd like to downstream.

Actually, I had to redo the cherry-pick - I'm letting CI roll on #788

perdasilva · 2024-06-17T16:15:09Z

commit 096fed5 from my PR can be cherry-picked in to help unblock

perdasilva · 2024-06-20T11:00:28Z

/close in favor of #788

perdasilva · 2024-06-20T13:15:40Z

/close

openshift-ci · 2024-06-20T13:17:38Z

@perdasilva: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2024-06-20T13:17:38Z

@joelanford: This pull request references Jira Issue OCPBUGS-34979. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot requested review from kevinrizza and oceanc80 June 5, 2024 17:52

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 5, 2024

openshift-ci Bot assigned kevinrizza Jun 5, 2024

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 5, 2024

bentito reviewed Jun 5, 2024

View reviewed changes

joelanford changed the title ~~[release-4.16] OCPBUGS-29729: Updates default security context behavior for catalog source pods~~ [release-4.16] OCPBUGS-34979: Updates default security context behavior for catalog source pods Jun 5, 2024

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 5, 2024

openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jun 5, 2024

openshift-ci Bot assigned bandrade, emmajiafan, jianzhangbjz, KeenonLee, kuiwang02 and Xia-Zhao-rh Jun 5, 2024

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 7, 2024

joelanford force-pushed the default-security-context-4.16 branch from bf825f2 to c1d2466 Compare June 11, 2024 17:22

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Jun 11, 2024

openshift-ci Bot closed this Jun 20, 2024

	clusterState := append(tt.in.cluster.k8sObjs, defaultNamespace())
	clusterState := baseClusterState()```

Conversation

joelanford commented Jun 5, 2024

Uh oh!

openshift-ci-robot commented Jun 5, 2024

Uh oh!

openshift-ci Bot commented Jun 5, 2024

Uh oh!

joelanford commented Jun 5, 2024

Uh oh!

kevinrizza commented Jun 5, 2024

Uh oh!

bentito Jun 5, 2024

Choose a reason for hiding this comment

Uh oh!

bentito Jun 5, 2024

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented Jun 5, 2024

Uh oh!

bentito commented Jun 5, 2024

Uh oh!

joelanford commented Jun 5, 2024

Uh oh!

openshift-ci-robot commented Jun 5, 2024

Uh oh!

joelanford commented Jun 5, 2024

Uh oh!

joelanford commented Jun 6, 2024

Uh oh!

jianzhangbjz commented Jun 7, 2024

Uh oh!

perdasilva commented Jun 11, 2024

Uh oh!

perdasilva commented Jun 11, 2024

Uh oh!

openshift-ci Bot commented Jun 11, 2024

Uh oh!

perdasilva commented Jun 12, 2024

Uh oh!

perdasilva commented Jun 12, 2024

Uh oh!

openshift-ci Bot commented Jun 12, 2024

Uh oh!

perdasilva commented Jun 17, 2024

Uh oh!

perdasilva commented Jun 17, 2024

Uh oh!

perdasilva commented Jun 17, 2024

Uh oh!

perdasilva commented Jun 20, 2024

Uh oh!

perdasilva commented Jun 20, 2024

Uh oh!

openshift-ci Bot commented Jun 20, 2024

Uh oh!

openshift-ci-robot commented Jun 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants