Add PSA Flag to Scorecard (#6187)

* add pod security flag to scorecard cli

Signed-off-by: Ish Shah <[email protected]>

* plumbing for cli

Signed-off-by: Ish Shah <[email protected]>

* struct packing

Signed-off-by: Ish Shah <[email protected]>

* change flag to string

Signed-off-by: Ish Shah <[email protected]>

* errors

Signed-off-by: Ish Shah <[email protected]>

* Updated

According to review comments

* removed Unused code

removed unused function code getLegacyPodDefinition()

* sanity errors

sanity errors fix

Signed-off-by: Ish Shah <[email protected]>
Co-authored-by: Laxmikant Bhaskar Pandhare <[email protected]>

Author: Ish Shah

internal/cmd/operator-sdk/scorecard/cmd.go

@@ -52,6 +52,7 @@ type scorecardCmd struct {
 	storageImage   string
 	untarImage     string
 	testOutput     string
+	podSecurity    string
 }
 
 func NewCmd() *cobra.Command {
@@ -80,6 +81,7 @@ If the argument holds an image tag, it must be present remotely.`,
 	scorecardCmd.Flags().StringVarP(&c.namespace, "namespace", "n", "", "namespace to run the test images in")
 	scorecardCmd.Flags().StringVarP(&c.outputFormat, "output", "o", "text",
 		"Output format for results. Valid values: text, json, xunit")
+	scorecardCmd.Flags().StringVar(&c.podSecurity, "pod-security", "legacy", "option to run scorecard with legacy pod security context")
 	scorecardCmd.Flags().StringVarP(&c.serviceAccount, "service-account", "s", "default",
 		"Service account to use for tests")
 	scorecardCmd.Flags().BoolVarP(&c.list, "list", "L", false,
@@ -187,8 +189,16 @@ func (c *scorecardCmd) run() (err error) {
 		log.Fatal(err)
 	}
 
+	podSecFlag := true
+	if c.podSecurity == "restricted" {
+		podSecFlag = true
+	} else if c.podSecurity == "legacy" {
+		podSecFlag = false
+	}
+
 	o := scorecard.Scorecard{
 		SkipCleanup: c.skipCleanup,
+		PodSecurity: podSecFlag,
 	}
 
 	configPath := c.config

internal/scorecard/scorecard.go

@@ -33,7 +33,7 @@ import (
 
 type TestRunner interface {
 	Initialize(context.Context) error
-	RunTest(context.Context, v1alpha3.TestConfiguration) (*v1alpha3.TestStatus, error)
+	RunTest(context.Context, v1alpha3.TestConfiguration, bool) (*v1alpha3.TestStatus, error)
 	Cleanup(context.Context) error
 }
 
@@ -42,6 +42,7 @@ type Scorecard struct {
 	Selector    labels.Selector
 	TestRunner  TestRunner
 	SkipCleanup bool
+	PodSecurity bool
 }
 
 type PodTestRunner struct {
@@ -56,6 +57,7 @@ type PodTestRunner struct {
 	UntarImage     string
 
 	configMapName string
+	PodSecurity   bool
 }
 
 type FakeTestRunner struct {
@@ -141,7 +143,7 @@ func (o Scorecard) runStageSequential(ctx context.Context, tests []v1alpha3.Test
 }
 
 func (o Scorecard) runTest(ctx context.Context, test v1alpha3.TestConfiguration) v1alpha3.Test {
-	result, err := o.TestRunner.RunTest(ctx, test)
+	result, err := o.TestRunner.RunTest(ctx, test, o.PodSecurity)
 	if err != nil {
 		result = convertErrorToStatus(err, "")
 	}
@@ -217,10 +219,19 @@ func (r PodTestRunner) Cleanup(ctx context.Context) (err error) {
 }
 
 // RunTest executes a single test
-func (r PodTestRunner) RunTest(ctx context.Context, test v1alpha3.TestConfiguration) (*v1alpha3.TestStatus, error) {
+func (r PodTestRunner) RunTest(ctx context.Context, test v1alpha3.TestConfiguration, podSec bool) (*v1alpha3.TestStatus, error) {
 
 	// Create a Pod to run the test
 	podDef := getPodDefinition(r.configMapName, test, r)
+	if podSec {
+		secCtx := v1.PodSecurityContext{}
+		secCtx.RunAsNonRoot = &podSec
+		secCtx.SeccompProfile = &v1.SeccompProfile{
+			Type: v1.SeccompProfileTypeRuntimeDefault,
+		}
+
+		podDef.Spec.SecurityContext = &secCtx
+	}
 
 	if test.Storage.Spec.MountPath.Path != "" {
 		addStorageToPod(podDef, test.Storage.Spec.MountPath.Path, r.StorageImage)
@@ -248,7 +259,7 @@ func (r PodTestRunner) RunTest(ctx context.Context, test v1alpha3.TestConfigurat
 }
 
 // RunTest executes a single test
-func (r FakeTestRunner) RunTest(ctx context.Context, test v1alpha3.TestConfiguration) (result *v1alpha3.TestStatus, err error) {
+func (r FakeTestRunner) RunTest(ctx context.Context, test v1alpha3.TestConfiguration, podSec bool) (result *v1alpha3.TestStatus, err error) {
 	select {
 	case <-time.After(r.Sleep):
 		return r.TestStatus, r.Error

website/content/en/docs/cli/operator-sdk_scorecard.md

@@ -24,6 +24,7 @@ operator-sdk scorecard [flags]
   -L, --list                     Option to enable listing which tests are run
   -n, --namespace string         namespace to run the test images in
   -o, --output string            Output format for results. Valid values: text, json, xunit (default "text")
+      --pod-security string      option to run scorecard with legacy pod security context (default "legacy")
   -l, --selector string          label selector to determine which tests are run
   -s, --service-account string   Service account to use for tests (default "default")
   -x, --skip-cleanup             Disable resource cleanup after tests are run