Skip to content

Commit 800fdee

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #2700 from camilamacedo86/containers-created-with-restrictive
⚠️ (go/v3): applying restrictive SCC for all containers scaffolded by the tool (k8s versions < 1.19 does not work with)
2 parents 0d643c0 + 7f34aae commit 800fdee

File tree

17 files changed

+97
-8
lines changed

17 files changed

+97
-8
lines changed

‎pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,11 @@ spec:
5555
spec:
5656
containers:
5757
- name: kube-rbac-proxy
58+
securityContext:
59+
allowPrivilegeEscalation: false
60+
capabilities:
61+
drop:
62+
- ALL
5863
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
5964
args:
6065
- "--secure-listen-address=0.0.0.0:8443"

‎pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/manager/config.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ spec:
7272
spec:
7373
securityContext:
7474
runAsNonRoot: true
75+
seccompProfile:
76+
type: RuntimeDefault
7577
containers:
7678
- command:
7779
- /manager
@@ -83,6 +85,9 @@ spec:
8385
name: manager
8486
securityContext:
8587
allowPrivilegeEscalation: false
88+
capabilities:
89+
drop:
90+
- ALL
8691
livenessProbe:
8792
httpGet:
8893
path: /healthz

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,11 @@ spec:
5555
spec:
5656
containers:
5757
- name: kube-rbac-proxy
58+
securityContext:
59+
allowPrivilegeEscalation: false
60+
capabilities:
61+
drop:
62+
- ALL
5863
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
5964
args:
6065
- "--secure-listen-address=0.0.0.0:8443"

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ spec:
7272
spec:
7373
securityContext:
7474
runAsNonRoot: true
75+
seccompProfile:
76+
type: RuntimeDefault
7577
containers:
7678
- command:
7779
- /manager
@@ -83,6 +85,9 @@ spec:
8385
name: manager
8486
securityContext:
8587
allowPrivilegeEscalation: false
88+
capabilities:
89+
drop:
90+
- ALL
8691
livenessProbe:
8792
httpGet:
8893
path: /healthz

‎test/e2e/v3/plugin_cluster_test.go

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ var _ = Describe("kubebuilder", func() {
8484
kbc.UninstallCertManager(true)
8585
})
8686

87-
It("should generate a runnable project", func() {
87+
It("should generate a runnable project go/v2 with default SA", func() {
8888
// go/v3 uses a unqiue-per-project service account name,
8989
// while go/v2 still uses "default".
9090
tmp := kbc.Kubectl.ServiceAccount
@@ -106,30 +106,39 @@ var _ = Describe("kubebuilder", func() {
106106
kbc.UninstallCertManager(false)
107107
})
108108

109-
It("should generate a runnable project", func() {
109+
It("should generate a runnable project go/v3 with v1 CRDs and Webhooks", func() {
110110
// Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist.
111-
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 17 {
112-
Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks", srvVer.GitVersion))
111+
// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
112+
// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
113+
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 {
114+
Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks"+
115+
"and securityContext.seccompProfile", srvVer.GitVersion))
113116
}
114117

115118
GenerateV3(kbc, "v1")
116119
Run(kbc)
117120
})
118121
It("should generate a runnable project with the golang base plugin v3 and kustomize v4-alpha", func() {
119122
// Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist.
120-
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 17 {
121-
Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks", srvVer.GitVersion))
123+
// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
124+
// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
125+
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 {
126+
Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks "+
127+
"and securityContext.seccompProfile", srvVer.GitVersion))
122128
}
123129

124130
GenerateV3WithKustomizeV2(kbc, "v1")
125131
Run(kbc)
126132
})
127133
It("should generate a runnable project with v1beta1 CRDs and Webhooks", func() {
128134
// Skip if cluster version < 1.15, when `.spec.preserveUnknownFields` was not a v1beta1 CRD field.
135+
// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
136+
// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
129137
// Skip if cluster version >= 1.22 because pre v1 CRDs and webhooks no longer exist.
130-
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 16 ||
138+
if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 ||
131139
srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() >= 22 {
132-
Skip(fmt.Sprintf("cluster version %s does not support project defaults", srvVer.GitVersion))
140+
Skip(fmt.Sprintf("cluster version %s does not support project defaults "+
141+
"and securityContext.seccompProfile", srvVer.GitVersion))
133142
}
134143

135144
GenerateV3(kbc, "v1beta1")

‎testdata/project-v3-addon/config/default/manager_auth_proxy_patch.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@ spec:
1010
spec:
1111
containers:
1212
- name: kube-rbac-proxy
13+
securityContext:
14+
allowPrivilegeEscalation: false
15+
capabilities:
16+
drop:
17+
- ALL
1318
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
1419
args:
1520
- "--secure-listen-address=0.0.0.0:8443"

‎testdata/project-v3-addon/config/manager/manager.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ spec:
2626
spec:
2727
securityContext:
2828
runAsNonRoot: true
29+
seccompProfile:
30+
type: RuntimeDefault
2931
containers:
3032
- command:
3133
- /manager
@@ -35,6 +37,9 @@ spec:
3537
name: manager
3638
securityContext:
3739
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop:
42+
- ALL
3843
livenessProbe:
3944
httpGet:
4045
path: /healthz

‎testdata/project-v3-config/config/default/manager_auth_proxy_patch.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@ spec:
1010
spec:
1111
containers:
1212
- name: kube-rbac-proxy
13+
securityContext:
14+
allowPrivilegeEscalation: false
15+
capabilities:
16+
drop:
17+
- ALL
1318
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
1419
args:
1520
- "--secure-listen-address=0.0.0.0:8443"

‎testdata/project-v3-config/config/manager/manager.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,18 @@ spec:
2626
spec:
2727
securityContext:
2828
runAsNonRoot: true
29+
seccompProfile:
30+
type: RuntimeDefault
2931
containers:
3032
- command:
3133
- /manager
3234
image: controller:latest
3335
name: manager
3436
securityContext:
3537
allowPrivilegeEscalation: false
38+
capabilities:
39+
drop:
40+
- ALL
3641
livenessProbe:
3742
httpGet:
3843
path: /healthz

‎testdata/project-v3-multigroup/config/default/manager_auth_proxy_patch.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@ spec:
1010
spec:
1111
containers:
1212
- name: kube-rbac-proxy
13+
securityContext:
14+
allowPrivilegeEscalation: false
15+
capabilities:
16+
drop:
17+
- ALL
1318
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
1419
args:
1520
- "--secure-listen-address=0.0.0.0:8443"

0 commit comments

Comments
 (0)