Skip to content

Commit 317d046

Browse files
camilamacedo86camilamacedo86
authored
fix: run and upgrade bundle subcommands to they work well with vendors (#5973)
1 parent fd89378 commit 317d046

File tree

3 files changed

+60
-13
lines changed

3 files changed

+60
-13
lines changed

‎changelog/fragments/fix-run-upgrade-bundle.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# entries is a list of entries to include in
2+
# release notes and/or the migration guide
3+
entries:
4+
- description: >
5+
Fix operator-sdk run bundle and upgrade bundle subCommands to allow they to work against Kubernetes versions < 1.19
6+
and vendors like Openshift
7+
kind: "bugfix"
8+
breaking: false

‎internal/olm/operator/registry/fbcindex/fbc_registry_pod.go‎

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -209,12 +209,32 @@ func (f *FBCRegistryPod) podForBundleRegistry(cs *v1alpha1.CatalogSource) (*core
209209
Namespace: f.cfg.Namespace,
210210
},
211211
Spec: corev1.PodSpec{
212-
SecurityContext: &corev1.PodSecurityContext{
213-
RunAsNonRoot: pointer.Bool(true),
214-
SeccompProfile: &corev1.SeccompProfile{
215-
Type: corev1.SeccompProfileTypeRuntimeDefault,
216-
},
217-
},
212+
// DO NOT set RunAsUser and RunAsNonRoot, we must leave this empty to allow
213+
// those that want to use this command against Openshift vendor do not face issues.
214+
//
215+
// Why not set RunAsUser?
216+
// RunAsUser cannot be set because in OpenShift each namespace has a valid range like
217+
// [1000680000, 1000689999]. Therefore, values like 1001 will not work. Also, in OCP each namespace
218+
// has a valid range allocate. Therefore, by leaving it empty the OCP will adopt RunAsUser strategy
219+
// of MustRunAsRange. The PSA will look for the openshift.io/sa.scc.uid-range annotation
220+
// in the namespace to populate RunAsUser fields when the pod be admitted. Note that
221+
// is NOT possible to know a valid value that could be accepeted beforehand.
222+
//
223+
// Why not set RunAsNonRoot?
224+
// If we set RunAsNonRoot = true and the image informed does not define the UserID
225+
// (i.e. in the Dockerfile we have not `USER 11211:11211 `) then, the Pod will fail to run with the
226+
// error `"container has runAsNonRoot and image will run as root …` in ANY Kubernetes cluster.
227+
// (vanilla or OCP). Therefore, by leaving it empty this field will be set by OCP if/when the Pod be
228+
// qualified for restricted-v2 SCC policy.
229+
230+
// TODO: remove when OpenShift 4.10 and Kubernetes 1.19 be no longer supported
231+
// Why not set SeccompProfile?
232+
// This option can only work in OCP versions >= 4.11 and Kubernetes versions >= 19.
233+
//SecurityContext: &corev1.PodSecurityContext{
234+
// SeccompProfile: &corev1.SeccompProfile{
235+
// Type: corev1.SeccompProfileTypeRuntimeDefault,
236+
// },
237+
//},
218238
Volumes: []corev1.Volume{
219239
{
220240
Name: k8sutil.TrimDNS1123Label(cm.Name + "-volume"),

‎internal/olm/operator/registry/index/registry_pod.go‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -218,13 +218,32 @@ func (rp *SQLiteRegistryPod) podForBundleRegistry() (*corev1.Pod, error) {
218218
Namespace: rp.cfg.Namespace,
219219
},
220220
Spec: corev1.PodSpec{
221-
SecurityContext: &corev1.PodSecurityContext{
222-
RunAsNonRoot: pointer.Bool(false),
223-
RunAsUser: pointer.Int64(0),
224-
SeccompProfile: &corev1.SeccompProfile{
225-
Type: corev1.SeccompProfileTypeRuntimeDefault,
226-
},
227-
},
221+
// DO NOT set RunAsUser and RunAsNonRoot, we must leave this empty to allow
222+
// those that want to use this command against Openshift vendor do not face issues.
223+
//
224+
// Why not set RunAsUser?
225+
// RunAsUser cannot be set because in OpenShift each namespace has a valid range like
226+
// [1000680000, 1000689999]. Therefore, values like 1001 will not work. Also, in OCP each namespace
227+
// has a valid range allocate. Therefore, by leaving it empty the OCP will adopt RunAsUser strategy
228+
// of MustRunAsRange. The PSA will look for the openshift.io/sa.scc.uid-range annotation
229+
// in the namespace to populate RunAsUser fields when the pod be admitted. Note that
230+
// is NOT possible to know a valid value that could be accepeted beforehand.
231+
//
232+
// Why not set RunAsNonRoot?
233+
// If we set RunAsNonRoot = true and the image informed does not define the UserID
234+
// (i.e. in the Dockerfile we have not `USER 11211:11211 `) then, the Pod will fail to run with the
235+
// error `"container has runAsNonRoot and image will run as root …` in ANY Kubernetes cluster.
236+
// (vanilla or OCP). Therefore, by leaving it empty this field will be set by OCP if/when the Pod be
237+
// qualified for restricted-v2 SCC policy.
238+
//
239+
// TODO: remove when OpenShift 4.10 and Kubernetes 1.19 be no longer supported
240+
// Why not set SeccompProfile?
241+
// This option can only work in OCP versions >= 4.11 and Kubernetes versions >= 19.
242+
//SecurityContext: &corev1.PodSecurityContext{
243+
// SeccompProfile: &corev1.SeccompProfile{
244+
// Type: corev1.SeccompProfileTypeRuntimeDefault,
245+
// },
246+
//},
228247
Containers: []corev1.Container{
229248
{
230249
Name: defaultContainerName,

0 commit comments

Comments
 (0)