[release-4.16] OCPBUGS-34979: Updates default security context behavior for catalog source pods by perdasilva · Pull Request #788 · openshift/operator-framework-olm

perdasilva · 2024-06-17T08:12:35Z

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

openshift-ci-robot · 2024-06-17T08:12:41Z

@perdasilva: This pull request references Jira Issue OCPBUGS-34979, which is invalid:

expected dependent Jira Issue OCPBUGS-29729 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2024-06-17T09:01:25Z

@perdasilva: This pull request references Jira Issue OCPBUGS-34979. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2024-06-17T10:12:13Z

@perdasilva: This pull request references Jira Issue OCPBUGS-34979, which is invalid:

expected dependent Jira Issue OCPBUGS-29729 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

perdasilva · 2024-06-17T10:12:34Z

/retest

…source pods (#3206) * Refactor security context configuration in pod reconciler This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior. Signed-off-by: btofel <btofel@redhat.com> * Add checking of the namespace PSA restrictions Signed-off-by: btofel <btofel@redhat.com> * Fix linter issues Signed-off-by: btofel <btofel@redhat.com> Signed-off-by: Brett Tofel <btofel@redhat.com> * fixes Signed-off-by: Per Goncalves da Silva <pegoncal@redhat.com> --------- Signed-off-by: btofel <btofel@redhat.com> Signed-off-by: Brett Tofel <btofel@redhat.com> Signed-off-by: Per Goncalves da Silva <pegoncal@redhat.com> Co-authored-by: Brett Tofel <btofel@redhat.com> Co-authored-by: Per Goncalves da Silva <pegoncal@redhat.com> Upstream-repository: operator-lifecycle-manager Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

…ig (openshift#342) Signed-off-by: Joe Lanford <joe.lanford@gmail.com> Upstream-repository: api Upstream-commit: 5d2d3fbe061b7b4a942747877efa58958fa9889e

perdasilva · 2024-06-17T12:58:10Z

/retest

tmshort

/lgtm

openshift-ci · 2024-06-17T15:18:07Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: perdasilva, tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~DOWNSTREAM_OWNERS~~ [perdasilva,tmshort]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2024-06-17T16:14:26Z

@perdasilva: This pull request references Jira Issue OCPBUGS-34979. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2024-06-20T09:29:03Z

@perdasilva: This pull request references Jira Issue OCPBUGS-34979, which is invalid:

expected dependent Jira Issue OCPBUGS-29729 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

perdasilva · 2024-06-20T11:00:46Z

/label backport-risk-assessed

jianzhangbjz · 2024-06-21T03:14:37Z

Pre-merge test pass, details: https://issues.redhat.com/browse/OCPBUGS-34979
/lgtm
/label qe-approved
/label cherry-pick-approved

openshift-ci-robot · 2024-06-21T03:14:45Z

@perdasilva: This pull request references Jira Issue OCPBUGS-34979, which is valid.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.16.0) matches configured target version for branch (4.16.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-29729 is in the state MODIFIED, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
dependent Jira Issue OCPBUGS-29729 targets the "4.17.0" version, which is one of the valid target versions: 4.17.0
bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Jira (jiazha@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

joelanford · 2024-06-21T11:58:17Z

This isn't a critical bug fix, so I'm holding off until we have a 4.16.0. We can get this into a 4.16.z.

everettraven · 2024-06-21T18:16:58Z


                        More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
                      type: string
-                      default: legacy


Isn't this technically a breaking change? Is this something we should be concerned about?

Great catch. Kinda, we subbed the default for a probe. We look at the namespace for PSA annotations and make a decision.

That PR went ahead. It didn't include the API fixes T_T

perdasilva · 2024-07-08T05:57:41Z

/retest

openshift-ci-robot · 2024-07-08T10:31:34Z

/retest-required

Remaining retests: 0 against base HEAD 555e529 and 2 for PR HEAD 096fed5 in total

openshift-ci · 2024-07-08T14:22:22Z

@perdasilva: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-07-08T14:24:36Z

@perdasilva: Jira Issue OCPBUGS-34979: All pull requests linked via external trackers have merged:

openshift/operator-framework-olm#788

Jira Issue OCPBUGS-34979 has been moved to the MODIFIED state.

Details

In response to this:

Cherry pick of 47978e1

Refactor security context configuration in pod reconciler

This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior.

Add checking of the namespace PSA restrictions

Fix linter issues

fixes

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-bot · 2024-07-08T20:25:29Z

[ART PR BUILD NOTIFIER]

This PR has been included in build operator-lifecycle-manager-container-v4.16.0-202407081937.p0.gabccea9.assembly.stream.el9 for distgit operator-lifecycle-manager.
All builds following this will include this PR.

openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Jun 17, 2024

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 17, 2024

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jun 17, 2024

perdasilva changed the title ~~[WIP] [release-4.16] OCPBUGS-34979: fix some stuff~~ [WIP] [release-4.16] OCPBUGS-34979: Updates default security context behavior for catalog source pods Jun 17, 2024

openshift-ci Bot requested review from m1kola and oceanc80 June 17, 2024 08:19

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 17, 2024

perdasilva force-pushed the perdasilva/34979 branch 2 times, most recently from 52b1250 to 4f30b02 Compare June 17, 2024 08:48

perdasilva closed this Jun 17, 2024

perdasilva mentioned this pull request Jun 17, 2024

[release-4.16] OCPBUGS-34979: Updates default security context behavior for catalog source pods #765

Closed

perdasilva reopened this Jun 17, 2024

perdasilva and others added 2 commits June 17, 2024 12:52

remove default value of catsrc.spec.grpcPodConfig.securityContextConf…

096fed5

…ig (openshift#342) Signed-off-by: Joe Lanford <joe.lanford@gmail.com> Upstream-repository: api Upstream-commit: 5d2d3fbe061b7b4a942747877efa58958fa9889e

perdasilva force-pushed the perdasilva/34979 branch from 4f30b02 to 096fed5 Compare June 17, 2024 10:54

tmshort approved these changes Jun 17, 2024

View reviewed changes

openshift-ci Bot assigned tmshort Jun 17, 2024

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 17, 2024

perdasilva closed this Jun 17, 2024

perdasilva deleted the perdasilva/34979 branch June 17, 2024 16:15

perdasilva restored the perdasilva/34979 branch June 20, 2024 09:28

perdasilva reopened this Jun 20, 2024

perdasilva changed the title ~~[WIP] [release-4.16] OCPBUGS-34979: Updates default security context behavior for catalog source pods~~ [release-4.16] OCPBUGS-34979: Updates default security context behavior for catalog source pods Jun 20, 2024

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 20, 2024

openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jun 20, 2024

openshift-ci Bot assigned bandrade, emmajiafan, jianzhangbjz, KeenonLee, kuiwang02 and Xia-Zhao-rh Jun 20, 2024

openshift-ci Bot added qe-approved Signifies that QE has signed off on this PR cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. labels Jun 21, 2024

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jun 21, 2024

openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jun 21, 2024

everettraven reviewed Jun 21, 2024

View reviewed changes

openshift-merge-bot Bot merged commit abccea9 into openshift:release-4.16 Jul 8, 2024

Conversation

perdasilva commented Jun 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jun 17, 2024

Uh oh!

openshift-ci-robot commented Jun 17, 2024

Uh oh!

openshift-ci-robot commented Jun 17, 2024

Uh oh!

perdasilva commented Jun 17, 2024

Uh oh!

perdasilva commented Jun 17, 2024

Uh oh!

tmshort left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jun 17, 2024

Uh oh!

openshift-ci-robot commented Jun 17, 2024

Uh oh!

openshift-ci-robot commented Jun 20, 2024

Uh oh!

perdasilva commented Jun 20, 2024

Uh oh!

jianzhangbjz commented Jun 21, 2024

Uh oh!

openshift-ci-robot commented Jun 21, 2024

Uh oh!

joelanford commented Jun 21, 2024

Uh oh!

everettraven Jun 21, 2024

Choose a reason for hiding this comment

Uh oh!

perdasilva Jun 25, 2024

Choose a reason for hiding this comment

Uh oh!

perdasilva Jun 25, 2024

Choose a reason for hiding this comment

Uh oh!

perdasilva commented Jul 8, 2024

Uh oh!

openshift-ci-robot commented Jul 8, 2024

Uh oh!

openshift-ci Bot commented Jul 8, 2024

Uh oh!

openshift-ci-robot commented Jul 8, 2024

Uh oh!

openshift-bot commented Jul 8, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

perdasilva commented Jun 17, 2024 •

edited

Loading