Pod security updates #135
Pod security updates #135
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: slintes The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
In order to comply with the restricted profile, the pod needs to have runAsNonRoot: true, and all containers need to have allowPrivilegeEscalation:false and drop all caps. Also the Dockerfile should set a USER. On k8s we would also need to set seccompProfile.type: RuntimeDefault. That would break deployment on OCP 4.10 though. So leave it empty, which is fine also on OCP 4.11+ Signed-off-by: Marc Sluiter <msluiter@redhat.com>
Can and should be used for community releases! Signed-off-by: Marc Sluiter <msluiter@redhat.com>
|
/hold check logs for warnings, old example:
Seems at least in the past there was a warning for missing seccompProfile. Check if it's still there, and if so what to do about it (setting it would break OCP <= 4.10). My understanding is that it's ok. |
|
/lgtm |
|
Can't find anything in the logs complaining about missing seccomProfile 🤷🏼♂️ So hopefully we are lucky and can use this for all OCP versions :) /hold cancel |
|
trying to wake up tide /hold |
|
/hold cancel |
|
/skip |
|
/check-required-labels |
|
/test ? |
|
@slintes: The following commands are available to trigger required jobs:
Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/test test |
|
/hold cancel |
|
/check-required-labels |
In order to comply with the restricted PSA profile, the pod needs to have
runAsNonRoot: true, and all containers need to haveallowPrivilegeEscalation:falseand drop all caps. Also the Dockerfile shouldset a USER.
On k8s we would also need to set seccompProfile.type: RuntimeDefault.
That would break deployment on OCP 4.10 though. So leave it empty by default,
which is fine also on OCP 4.11+.
For community (k8s) releases, there is a new make target
bundle-k8s,which adds the seccompProfile to the deployment.
Releated docs:
https://kubernetes.io/docs/concepts/security/pod-security-standards/
https://kubernetes.io/docs/concepts/security/pod-security-admission/
https://master.sdk.operatorframework.io/docs/best-practices/pod-security-standards/
ECOPROJECT-811