Skip to content

Commit 77ae211

Browse files
dusk125dusk125
authored
NO-ISSUE: Enabled readonlyRootFilesystem by default (#3614)
* Enabled readonlyRootFilesystem by default * Enable in reconciler as well * Enable in chart templates * Fix typo * Ensure volumes and volumeMount objects exists * Fixing default rorfs for legacy mode and fix tests * Only enable rorfs when running as non-root user * Update tests * Fix errors * Update unit tests
1 parent 3d81ef2 commit 77ae211

File tree

7 files changed

+73
-26
lines changed

7 files changed

+73
-26
lines changed

‎deploy/chart/templates/0000_50_olm_07-olm-operator.deployment.yaml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,7 @@ spec:
2222
seccompProfile:
2323
type: RuntimeDefault
2424
serviceAccountName: olm-operator-serviceaccount
25-
{{- if or .Values.olm.tlsSecret .Values.olm.clientCASecret }}
2625
volumes:
27-
{{- end }}
2826
{{- if .Values.olm.tlsSecret }}
2927
- name: srv-cert
3028
secret:
@@ -35,15 +33,16 @@ spec:
3533
secret:
3634
secretName: {{ .Values.olm.clientCASecret }}
3735
{{- end }}
36+
- name: tmpfs
37+
emptyDir: {}
3838
containers:
3939
- name: olm-operator
4040
securityContext:
4141
allowPrivilegeEscalation: false
42+
readOnlyRootFilesystem: true
4243
capabilities:
4344
drop: [ "ALL" ]
44-
{{- if or .Values.olm.tlsSecret .Values.olm.clientCASecret }}
4545
volumeMounts:
46-
{{- end }}
4746
{{- if .Values.olm.tlsSecret }}
4847
- name: srv-cert
4948
mountPath: "/srv-cert"
@@ -54,6 +53,8 @@ spec:
5453
mountPath: "/profile-collector-cert"
5554
readOnly: true
5655
{{- end }}
56+
- name: tmpfs
57+
mountPath: /tmp
5758
command:
5859
- /bin/olm
5960
args:

‎deploy/chart/templates/0000_50_olm_08-catalog-operator.deployment.yaml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,7 @@ spec:
2222
seccompProfile:
2323
type: RuntimeDefault
2424
serviceAccountName: olm-operator-serviceaccount
25-
{{- if or .Values.catalog.tlsSecret .Values.catalog.clientCASecret }}
2625
volumes:
27-
{{- end }}
2826
{{- if .Values.catalog.tlsSecret }}
2927
- name: srv-cert
3028
secret:
@@ -35,15 +33,16 @@ spec:
3533
secret:
3634
secretName: {{ .Values.catalog.clientCASecret }}
3735
{{- end }}
36+
- name: tmpfs
37+
emptyDir: {}
3838
containers:
3939
- name: catalog-operator
4040
securityContext:
4141
allowPrivilegeEscalation: false
42+
readOnlyRootFilesystem: true
4243
capabilities:
4344
drop: [ "ALL" ]
44-
{{- if or .Values.catalog.tlsSecret .Values.catalog.clientCASecret }}
4545
volumeMounts:
46-
{{- end }}
4746
{{- if .Values.catalog.tlsSecret }}
4847
- name: srv-cert
4948
mountPath: "/srv-cert"
@@ -54,6 +53,8 @@ spec:
5453
mountPath: "/profile-collector-cert"
5554
readOnly: true
5655
{{- end }}
56+
- name: tmpfs
57+
mountPath: /tmp
5758
command:
5859
- /bin/catalog
5960
args:

‎deploy/chart/templates/_packageserver.deployment-spec.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ spec:
3131
- name: packageserver
3232
securityContext:
3333
allowPrivilegeEscalation: false
34+
readOnlyRootFilesystem: true
3435
capabilities:
3536
drop: [ "ALL" ]
3637
command:

‎pkg/controller/bundle/bundle_unpacker.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
154154
},
155155
SecurityContext: &corev1.SecurityContext{
156156
AllowPrivilegeEscalation: ptr.To(bool(false)),
157+
ReadOnlyRootFilesystem: ptr.To(true),
157158
Capabilities: &corev1.Capabilities{
158159
Drop: []corev1.Capability{"ALL"},
159160
},
@@ -180,6 +181,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
180181
},
181182
SecurityContext: &corev1.SecurityContext{
182183
AllowPrivilegeEscalation: ptr.To(bool(false)),
184+
ReadOnlyRootFilesystem: ptr.To(true),
183185
Capabilities: &corev1.Capabilities{
184186
Drop: []corev1.Capability{"ALL"},
185187
},
@@ -209,6 +211,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
209211
},
210212
SecurityContext: &corev1.SecurityContext{
211213
AllowPrivilegeEscalation: ptr.To(bool(false)),
214+
ReadOnlyRootFilesystem: ptr.To(true),
212215
Capabilities: &corev1.Capabilities{
213216
Drop: []corev1.Capability{"ALL"},
214217
},

‎pkg/controller/bundle/bundle_unpacker_test.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -308,6 +308,7 @@ func TestConfigMapUnpacker(t *testing.T) {
308308
},
309309
SecurityContext: &corev1.SecurityContext{
310310
AllowPrivilegeEscalation: ptr.To(bool(false)),
311+
ReadOnlyRootFilesystem: ptr.To(true),
311312
Capabilities: &corev1.Capabilities{
312313
Drop: []corev1.Capability{"ALL"},
313314
},
@@ -334,6 +335,7 @@ func TestConfigMapUnpacker(t *testing.T) {
334335
},
335336
SecurityContext: &corev1.SecurityContext{
336337
AllowPrivilegeEscalation: ptr.To(bool(false)),
338+
ReadOnlyRootFilesystem: ptr.To(true),
337339
Capabilities: &corev1.Capabilities{
338340
Drop: []corev1.Capability{"ALL"},
339341
},
@@ -363,6 +365,7 @@ func TestConfigMapUnpacker(t *testing.T) {
363365
},
364366
SecurityContext: &corev1.SecurityContext{
365367
AllowPrivilegeEscalation: ptr.To(bool(false)),
368+
ReadOnlyRootFilesystem: ptr.To(true),
366369
Capabilities: &corev1.Capabilities{
367370
Drop: []corev1.Capability{"ALL"},
368371
},
@@ -524,6 +527,7 @@ func TestConfigMapUnpacker(t *testing.T) {
524527
},
525528
SecurityContext: &corev1.SecurityContext{
526529
AllowPrivilegeEscalation: ptr.To(bool(false)),
530+
ReadOnlyRootFilesystem: ptr.To(true),
527531
Capabilities: &corev1.Capabilities{
528532
Drop: []corev1.Capability{"ALL"},
529533
},
@@ -550,6 +554,7 @@ func TestConfigMapUnpacker(t *testing.T) {
550554
},
551555
SecurityContext: &corev1.SecurityContext{
552556
AllowPrivilegeEscalation: ptr.To(bool(false)),
557+
ReadOnlyRootFilesystem: ptr.To(true),
553558
Capabilities: &corev1.Capabilities{
554559
Drop: []corev1.Capability{"ALL"},
555560
},
@@ -579,6 +584,7 @@ func TestConfigMapUnpacker(t *testing.T) {
579584
},
580585
SecurityContext: &corev1.SecurityContext{
581586
AllowPrivilegeEscalation: ptr.To(bool(false)),
587+
ReadOnlyRootFilesystem: ptr.To(true),
582588
Capabilities: &corev1.Capabilities{
583589
Drop: []corev1.Capability{"ALL"},
584590
},
@@ -780,6 +786,7 @@ func TestConfigMapUnpacker(t *testing.T) {
780786
},
781787
SecurityContext: &corev1.SecurityContext{
782788
AllowPrivilegeEscalation: ptr.To(bool(false)),
789+
ReadOnlyRootFilesystem: ptr.To(true),
783790
Capabilities: &corev1.Capabilities{
784791
Drop: []corev1.Capability{"ALL"},
785792
},
@@ -806,6 +813,7 @@ func TestConfigMapUnpacker(t *testing.T) {
806813
},
807814
SecurityContext: &corev1.SecurityContext{
808815
AllowPrivilegeEscalation: ptr.To(bool(false)),
816+
ReadOnlyRootFilesystem: ptr.To(true),
809817
Capabilities: &corev1.Capabilities{
810818
Drop: []corev1.Capability{"ALL"},
811819
},
@@ -835,6 +843,7 @@ func TestConfigMapUnpacker(t *testing.T) {
835843
},
836844
SecurityContext: &corev1.SecurityContext{
837845
AllowPrivilegeEscalation: ptr.To(bool(false)),
846+
ReadOnlyRootFilesystem: ptr.To(true),
838847
Capabilities: &corev1.Capabilities{
839848
Drop: []corev1.Capability{"ALL"},
840849
},
@@ -1031,6 +1040,7 @@ func TestConfigMapUnpacker(t *testing.T) {
10311040
},
10321041
SecurityContext: &corev1.SecurityContext{
10331042
AllowPrivilegeEscalation: ptr.To(bool(false)),
1043+
ReadOnlyRootFilesystem: ptr.To(true),
10341044
Capabilities: &corev1.Capabilities{
10351045
Drop: []corev1.Capability{"ALL"},
10361046
},
@@ -1057,6 +1067,7 @@ func TestConfigMapUnpacker(t *testing.T) {
10571067
},
10581068
SecurityContext: &corev1.SecurityContext{
10591069
AllowPrivilegeEscalation: ptr.To(bool(false)),
1070+
ReadOnlyRootFilesystem: ptr.To(true),
10601071
Capabilities: &corev1.Capabilities{
10611072
Drop: []corev1.Capability{"ALL"},
10621073
},
@@ -1086,6 +1097,7 @@ func TestConfigMapUnpacker(t *testing.T) {
10861097
},
10871098
SecurityContext: &corev1.SecurityContext{
10881099
AllowPrivilegeEscalation: ptr.To(bool(false)),
1100+
ReadOnlyRootFilesystem: ptr.To(true),
10891101
Capabilities: &corev1.Capabilities{
10901102
Drop: []corev1.Capability{"ALL"},
10911103
},
@@ -1252,6 +1264,7 @@ func TestConfigMapUnpacker(t *testing.T) {
12521264
},
12531265
SecurityContext: &corev1.SecurityContext{
12541266
AllowPrivilegeEscalation: ptr.To(bool(false)),
1267+
ReadOnlyRootFilesystem: ptr.To(true),
12551268
Capabilities: &corev1.Capabilities{
12561269
Drop: []corev1.Capability{"ALL"},
12571270
},
@@ -1278,6 +1291,7 @@ func TestConfigMapUnpacker(t *testing.T) {
12781291
},
12791292
SecurityContext: &corev1.SecurityContext{
12801293
AllowPrivilegeEscalation: ptr.To(bool(false)),
1294+
ReadOnlyRootFilesystem: ptr.To(true),
12811295
Capabilities: &corev1.Capabilities{
12821296
Drop: []corev1.Capability{"ALL"},
12831297
},
@@ -1307,6 +1321,7 @@ func TestConfigMapUnpacker(t *testing.T) {
13071321
},
13081322
SecurityContext: &corev1.SecurityContext{
13091323
AllowPrivilegeEscalation: ptr.To(bool(false)),
1324+
ReadOnlyRootFilesystem: ptr.To(true),
13101325
Capabilities: &corev1.Capabilities{
13111326
Drop: []corev1.Capability{"ALL"},
13121327
},
@@ -1486,6 +1501,7 @@ func TestConfigMapUnpacker(t *testing.T) {
14861501
},
14871502
SecurityContext: &corev1.SecurityContext{
14881503
AllowPrivilegeEscalation: ptr.To(bool(false)),
1504+
ReadOnlyRootFilesystem: ptr.To(true),
14891505
Capabilities: &corev1.Capabilities{
14901506
Drop: []corev1.Capability{"ALL"},
14911507
},
@@ -1512,6 +1528,7 @@ func TestConfigMapUnpacker(t *testing.T) {
15121528
},
15131529
SecurityContext: &corev1.SecurityContext{
15141530
AllowPrivilegeEscalation: ptr.To(bool(false)),
1531+
ReadOnlyRootFilesystem: ptr.To(true),
15151532
Capabilities: &corev1.Capabilities{
15161533
Drop: []corev1.Capability{"ALL"},
15171534
},
@@ -1541,6 +1558,7 @@ func TestConfigMapUnpacker(t *testing.T) {
15411558
},
15421559
SecurityContext: &corev1.SecurityContext{
15431560
AllowPrivilegeEscalation: ptr.To(bool(false)),
1561+
ReadOnlyRootFilesystem: ptr.To(true),
15441562
Capabilities: &corev1.Capabilities{
15451563
Drop: []corev1.Capability{"ALL"},
15461564
},

‎pkg/controller/registry/reconciler/reconciler.go

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,9 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s
293293
Args: []string{"/bin/copy-content", fmt.Sprintf("%s/copy-content", utilitiesPath)},
294294
VolumeMounts: []corev1.VolumeMount{utilitiesVolumeMount},
295295
TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
296+
SecurityContext: &corev1.SecurityContext{
297+
ReadOnlyRootFilesystem: ptr.To(true),
298+
},
296299
}, corev1.Container{
297300
Name: "extract-content",
298301
Image: img,
@@ -301,8 +304,12 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s
301304
Args: extractArgs,
302305
VolumeMounts: []corev1.VolumeMount{utilitiesVolumeMount, contentVolumeMount},
303306
TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
307+
SecurityContext: &corev1.SecurityContext{
308+
ReadOnlyRootFilesystem: ptr.To(true),
309+
},
304310
})
305311

312+
pod.Spec.Containers[0].SecurityContext.ReadOnlyRootFilesystem = ptr.To(true)
306313
pod.Spec.Containers[0].Image = opmImg
307314
pod.Spec.Containers[0].Command = []string{"/bin/opm"}
308315
pod.Spec.Containers[0].ImagePullPolicy = image.InferImagePullPolicy(opmImg)
@@ -356,6 +363,16 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s
356363
}
357364

358365
func addSecurityContext(pod *corev1.Pod, runAsUser int64) {
366+
pod.Spec.SecurityContext = &corev1.PodSecurityContext{
367+
SeccompProfile: &corev1.SeccompProfile{
368+
Type: corev1.SeccompProfileTypeRuntimeDefault,
369+
},
370+
}
371+
if runAsUser > 0 {
372+
pod.Spec.SecurityContext.RunAsUser = &runAsUser
373+
pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(true)
374+
}
375+
359376
for i := range pod.Spec.InitContainers {
360377
if pod.Spec.InitContainers[i].SecurityContext == nil {
361378
pod.Spec.InitContainers[i].SecurityContext = &corev1.SecurityContext{}
@@ -374,16 +391,6 @@ func addSecurityContext(pod *corev1.Pod, runAsUser int64) {
374391
Drop: []corev1.Capability{"ALL"},
375392
}
376393
}
377-
378-
pod.Spec.SecurityContext = &corev1.PodSecurityContext{
379-
SeccompProfile: &corev1.SeccompProfile{
380-
Type: corev1.SeccompProfileTypeRuntimeDefault,
381-
},
382-
}
383-
if runAsUser > 0 {
384-
pod.Spec.SecurityContext.RunAsUser = &runAsUser
385-
pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(true)
386-
}
387394
}
388395

389396
// getDefaultPodContextConfig returns Restricted if the defaultNamespace has the 'pod-security.kubernetes.io/enforce' label set to 'restricted',

0 commit comments

Comments
 (0)