Skip to content

Commit 223cdc1

Browse files
dependabot[bot]Amarthya Valija
dependabot[bot]
authored and
Amarthya Valija
committed
Bump golang.org/x/net from 0.28.0 to 0.33.0
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.28.0 to 0.33.0. - [Commits](golang/net@v0.28.0...v0.33.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Revert "Bump golang.org/x/net from 0.28.0 to 0.33.0" Revert "OSD-24275: Validate machineCIDR is contained in default ingresscontro…" Fix admin username that can bypass SDN webhook Update test case to enforce security context settings Fix test case for security context enforcement Fix test case for Security context enforcement Fix test case for Security Context enforcement Fix: Add namespace to security context enforcement in tests
1 parent 6e0b31a commit 223cdc1

File tree

11 files changed

+92
-573
lines changed

11 files changed

+92
-573
lines changed

‎build/resources.go

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,6 @@ const (
3232
roleName string = "validation-webhook"
3333
prometheusRoleName string = "prometheus-k8s"
3434
repoName string = "managed-cluster-validating-webhooks"
35-
// Role and Binding for reading cluster-config-v1 config map...
36-
clusterConfigRole string = "config-v1-reader-wh"
37-
clusterConfigRoleBinding string = "validation-webhook-cluster-config-v1-reader"
3835
// Used to define what phase a resource should be deployed in by package-operator
3936
pkoPhaseAnnotation string = "package-operator.run/phase"
4037
// Defines the 'rbac' package-operator phase for any resources related to RBAC
@@ -214,60 +211,6 @@ func createClusterRoleBinding() *rbacv1.ClusterRoleBinding {
214211
}
215212
}
216213

217-
func createClusterConfigRole() *rbacv1.Role {
218-
return &rbacv1.Role{
219-
TypeMeta: metav1.TypeMeta{
220-
Kind: "Role",
221-
APIVersion: rbacv1.SchemeGroupVersion.String(),
222-
},
223-
ObjectMeta: metav1.ObjectMeta{
224-
Name: clusterConfigRole,
225-
Namespace: "kube-system",
226-
},
227-
Rules: []rbacv1.PolicyRule{
228-
{
229-
APIGroups: []string{
230-
"",
231-
},
232-
Resources: []string{
233-
"configmaps",
234-
},
235-
Verbs: []string{
236-
"get",
237-
},
238-
ResourceNames: []string{
239-
"cluster-config-v1",
240-
},
241-
},
242-
},
243-
}
244-
}
245-
246-
func createClusterConfigRoleBinding() *rbacv1.RoleBinding {
247-
return &rbacv1.RoleBinding{
248-
TypeMeta: metav1.TypeMeta{
249-
Kind: "RoleBinding",
250-
APIVersion: rbacv1.SchemeGroupVersion.String(),
251-
},
252-
ObjectMeta: metav1.ObjectMeta{
253-
Name: clusterConfigRoleBinding,
254-
Namespace: "kube-system",
255-
},
256-
Subjects: []rbacv1.Subject{
257-
{
258-
Kind: "ServiceAccount",
259-
Name: serviceAccountName,
260-
Namespace: *namespace,
261-
},
262-
},
263-
RoleRef: rbacv1.RoleRef{
264-
Name: clusterConfigRole,
265-
Kind: "Role",
266-
APIGroup: rbacv1.GroupName,
267-
},
268-
}
269-
}
270-
271214
func createPrometheusRole() *rbacv1.Role {
272215
return &rbacv1.Role{
273216
TypeMeta: metav1.TypeMeta{
@@ -884,7 +827,6 @@ func sliceContains(needle string, haystack []string) bool {
884827

885828
func main() {
886829
flag.Parse()
887-
utils.BuildRun = true
888830

889831
skip := strings.Split(*excludes, ",")
890832
onlyInclude := strings.Split(*only, "")
@@ -909,8 +851,6 @@ func main() {
909851
templateResources.Add(utils.DefaultLabelSelector(), runtime.RawExtension{Object: createClusterRoleBinding()})
910852
templateResources.Add(utils.DefaultLabelSelector(), runtime.RawExtension{Object: createPrometheusRole()})
911853
templateResources.Add(utils.DefaultLabelSelector(), runtime.RawExtension{Object: createPromethusRoleBinding()})
912-
templateResources.Add(utils.DefaultLabelSelector(), runtime.RawExtension{Object: createClusterConfigRole()})
913-
templateResources.Add(utils.DefaultLabelSelector(), runtime.RawExtension{Object: createClusterConfigRoleBinding()})
914854
templateResources.Add(utils.DefaultLabelSelector(), runtime.RawExtension{Object: createServiceMonitor()})
915855
templateResources.Add(utils.DefaultLabelSelector(), runtime.RawExtension{Object: createCACertConfigMap()})
916856
templateResources.Add(utils.DefaultLabelSelector(), runtime.RawExtension{Object: createService()})

‎build/selectorsyncset.yaml

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -123,35 +123,6 @@ objects:
123123
- kind: ServiceAccount
124124
name: prometheus-k8s
125125
namespace: openshift-monitoring
126-
- apiVersion: rbac.authorization.k8s.io/v1
127-
kind: Role
128-
metadata:
129-
creationTimestamp: null
130-
name: config-v1-reader-wh
131-
namespace: kube-system
132-
rules:
133-
- apiGroups:
134-
- ""
135-
resourceNames:
136-
- cluster-config-v1
137-
resources:
138-
- configmaps
139-
verbs:
140-
- get
141-
- apiVersion: rbac.authorization.k8s.io/v1
142-
kind: RoleBinding
143-
metadata:
144-
creationTimestamp: null
145-
name: validation-webhook-cluster-config-v1-reader
146-
namespace: kube-system
147-
roleRef:
148-
apiGroup: rbac.authorization.k8s.io
149-
kind: Role
150-
name: config-v1-reader-wh
151-
subjects:
152-
- kind: ServiceAccount
153-
name: validation-webhook
154-
namespace: openshift-validation-webhook
155126
- apiVersion: monitoring.coreos.com/v1
156127
kind: ServiceMonitor
157128
metadata:

‎cmd/main.go

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,14 @@ import (
2121
"github.com/openshift/managed-cluster-validating-webhooks/pkg/k8sutil"
2222
"github.com/openshift/managed-cluster-validating-webhooks/pkg/localmetrics"
2323
"github.com/openshift/managed-cluster-validating-webhooks/pkg/webhooks"
24-
"github.com/openshift/managed-cluster-validating-webhooks/pkg/webhooks/utils"
2524
)
2625

2726
var log = logf.Log.WithName("handler")
2827

2928
var (
3029
listenAddress = flag.String("listen", "0.0.0.0", "listen address")
3130
listenPort = flag.String("port", "5000", "port to listen on")
32-
metricsAddr string
31+
testHooks = flag.Bool("testhooks", false, "Test webhook URI uniqueness and quit?")
3332

3433
useTLS = flag.Bool("tls", false, "Use TLS? Must specify -tlskey, -tlscert, -cacert")
3534
tlsKey = flag.String("tlskey", "", "TLS Key for TLS")
@@ -40,18 +39,15 @@ var (
4039
metricsPort = "8080"
4140
)
4241

43-
func init() {
44-
// Allow export webhook var to share flag value...
45-
flag.BoolVar(&utils.TestHooks, "testhooks", false, "Test webhook URI uniqueness and quit?")
42+
func main() {
43+
var metricsAddr string
4644
flag.StringVar(&metricsAddr, "metrics-bind-address", ":"+metricsPort, "The address the metric endpoint binds to.")
4745
flag.Parse()
48-
}
49-
50-
func main() {
5146
klog.SetOutput(os.Stdout)
47+
5248
logf.SetLogger(klogr.New())
5349

54-
if !utils.TestHooks {
50+
if !*testHooks {
5551
log.Info("HTTP server running at", "listen", net.JoinHostPort(*listenAddress, *listenPort))
5652
}
5753
dispatcher := dispatcher.NewDispatcher(webhooks.Webhooks)
@@ -62,12 +58,12 @@ func main() {
6258
panic(fmt.Errorf("Duplicate webhook trying to listen on %s", realHook.GetURI()))
6359
}
6460
seen[name] = true
65-
if !utils.TestHooks {
61+
if !*testHooks {
6662
log.Info("Listening", "webhookName", name, "URI", realHook.GetURI())
6763
}
6864
http.HandleFunc(realHook.GetURI(), dispatcher.HandleRequest)
6965
}
70-
if utils.TestHooks {
66+
if *testHooks {
7167
os.Exit(0)
7268
}
7369

‎go.mod

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,6 @@ require (
5757
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
5858
github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87 // indirect
5959
github.com/openshift/elasticsearch-operator v0.0.0-20220613183908-e1648e67c298 // indirect
60-
github.com/openshift/installer v0.16.1 // indirect
6160
github.com/pkg/errors v0.9.1 // indirect
6261
github.com/prometheus/client_model v0.6.1 // indirect
6362
github.com/prometheus/common v0.59.1 // indirect

‎go.sum

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,8 +187,6 @@ github.com/openshift/elasticsearch-operator v0.0.0-20220613183908-e1648e67c298 h
187187
github.com/openshift/elasticsearch-operator v0.0.0-20220613183908-e1648e67c298/go.mod h1:6dxhWPY3Wr/0b0eGrFpV7gcyeS+ne48Mo9OQ9dxrLNI=
188188
github.com/openshift/hive/apis v0.0.0-20230327212335-7fd70848a6d5 h1:adHXZ1WFqCvXpargpTa6divneeUuvV2xr/D6NWgbqS8=
189189
github.com/openshift/hive/apis v0.0.0-20230327212335-7fd70848a6d5/go.mod h1:VIxA5HhvBmsqVn7aUVQYs004B9K4U5A+HrFwvRq2nK8=
190-
github.com/openshift/installer v0.16.1 h1:PmjALN9x1NVNVi3SCqfz0ZwVCgOkQLQWo2nHYXREq/A=
191-
github.com/openshift/installer v0.16.1/go.mod h1:VWGgpJgF8DGCKQjbccnigglhZnHtRLCZ6cxqkXN4Ck0=
192190
github.com/openshift/operator-custom-metrics v0.5.1 h1:1pk4YMUV+cmqfV0f2fyxY62cl7Gc76kwudJT+EdcfYM=
193191
github.com/openshift/operator-custom-metrics v0.5.1/go.mod h1:0dYDHi/ubKRWzsC9MmW6bRMdBgo1QSOuAh3GupTe0Sw=
194192
github.com/openshift/osde2e-common v0.0.0-20231010150014-8a4449a371e6 h1:MPcnO0eeWEyjLBA4mMgJ8pv8u7DjKC7yS+a39R+zhqs=

‎osde2e/managed_cluster_validating_webhooks_test.go

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"k8s.io/apimachinery/pkg/util/intstr"
2828
"k8s.io/client-go/dynamic"
2929
"k8s.io/client-go/kubernetes/scheme"
30+
"k8s.io/utils/pointer"
3031
"sigs.k8s.io/controller-runtime/pkg/client/config"
3132
"sigs.k8s.io/controller-runtime/pkg/log"
3233
"sigs.k8s.io/e2e-framework/klient/k8s"
@@ -105,6 +106,36 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() {
105106
Expect(err).ToNot(HaveOccurred())
106107
})
107108

109+
It("should create a pod with the correct security context", func() {
110+
pod := &v1.Pod{
111+
ObjectMeta: metav1.ObjectMeta{
112+
Name: "testpod",
113+
Namespace: namespaceName,
114+
},
115+
Spec: v1.PodSpec{
116+
Containers: []v1.Container{
117+
{
118+
Name: "test",
119+
Image: "quay.io/jitesoft/nginx:mainline",
120+
SecurityContext: &v1.SecurityContext{
121+
AllowPrivilegeEscalation: pointer.BoolPtr(false),
122+
Capabilities: &v1.Capabilities{
123+
Drop: []v1.Capability{"ALL"},
124+
},
125+
RunAsNonRoot: pointer.BoolPtr(true),
126+
SeccompProfile: &v1.SeccompProfile{
127+
Type: v1.SeccompProfileTypeRuntimeDefault,
128+
},
129+
},
130+
},
131+
},
132+
},
133+
}
134+
135+
err := client.Create(context.TODO(), pod)
136+
Expect(err).NotTo(HaveOccurred())
137+
})
138+
108139
Describe("sre-pod-validation", Ordered, func() {
109140
const (
110141
privilegedNamespace = "openshift-backplane"
@@ -120,21 +151,47 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() {
120151
name := envconf.RandomName("testpod", 12)
121152
pod = &v1.Pod{
122153
ObjectMeta: metav1.ObjectMeta{
123-
Name: name,
154+
Name: name,
155+
Namespace: testNsName,
124156
},
125157
Spec: v1.PodSpec{
126158
Containers: []v1.Container{
127159
{
128-
Name: "test",
160+
Name: "test-ubi",
129161
Image: "registry.access.redhat.com/ubi8/ubi-minimal",
162+
SecurityContext: &v1.SecurityContext{
163+
AllowPrivilegeEscalation: pointer.BoolPtr(false),
164+
Capabilities: &v1.Capabilities{
165+
Drop: []v1.Capability{"ALL"},
166+
},
167+
RunAsNonRoot: pointer.BoolPtr(true),
168+
SeccompProfile: &v1.SeccompProfile{
169+
Type: v1.SeccompProfileTypeRuntimeDefault,
170+
},
171+
},
172+
},
173+
{
174+
Name: "test-nginx",
175+
Image: "quay.io/jitesoft/nginx:mainline",
176+
SecurityContext: &v1.SecurityContext{
177+
AllowPrivilegeEscalation: pointer.BoolPtr(false),
178+
Capabilities: &v1.Capabilities{
179+
Drop: []v1.Capability{"ALL"},
180+
},
181+
RunAsNonRoot: pointer.BoolPtr(true),
182+
SeccompProfile: &v1.SeccompProfile{
183+
Type: v1.SeccompProfileTypeRuntimeDefault,
184+
},
185+
},
130186
},
131187
},
132188
Tolerations: []v1.Toleration{
133189
{
134190
Key: "node-role.kubernetes.io/master",
135191
Value: "toleration-key-value",
136192
Effect: v1.TaintEffectNoSchedule,
137-
}, {
193+
},
194+
{
138195
Key: "node-role.kubernetes.io/infra",
139196
Value: "toleration-key-value2",
140197
Effect: v1.TaintEffectNoSchedule,

0 commit comments

Comments
 (0)