[go: nahoru, domu]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenShift PodSecurity is restricted #67

Open
c3d opened this issue Aug 26, 2022 · 5 comments
Open

OpenShift PodSecurity is restricted #67

c3d opened this issue Aug 26, 2022 · 5 comments

Comments

@c3d
Copy link
Member
c3d commented Aug 26, 2022

Describe the bug
The recently introduced PodSecurity restrictions prevent the install instructions from working on recent builds of OpenShift.

To Reproduce
Steps to reproduce the behavior:

  1. Create an OpenShift cluster with a version that has the new PodSecurity policy in place (I see this with Server Version: 4.11.0-0.nightly-2022-06-23-044003 and Kubernetes Version: v1.24.0+284d62a)
  2. Run the command: oc apply -f https://raw.githubusercontent.com/confidential-containers/operator/main/deploy/deploy.yaml
  3. Check output for warnings

Describe the results you expected
As indicated in the documentation, this should deploy the operator successfully

Describe the results you received:
There is a warning message:

W0826 09:23:44.489489 3713080 warnings.go:70] would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "kube-rbac-proxy", "manager" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or containers "kube-rbac-proxy", "manager" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

The steps after that in the install documentation do not work:

% oc apply   -f https://raw.githubusercontent.com/confidential-containers/operator/main/config/samples/ccruntime.yaml                                                                                                                                                                      
ccruntime.confidentialcontainers.org/ccruntime-sample created
% oc get pods
NAME                                             READY   STATUS    RESTARTS   AGE
cc-operator-controller-manager-dc4846d94-2g9sf   2/2     Running   0          10m
# oc get runtimeclass
No resources found

Note the lack of any daemon-install in the above, and the resulting lack of a RuntimeClass

Additional context

Nothing really obvious in the logs indicating that the operator is even aware there was a problem:
manager.log
@bpradipt
Copy link
Member

@c3d can you add the following labels to the namespace and retry

openshift.io/cluster-monitoring=true
pod-security.kubernetes.io/enforce=privileged
pod-security.kubernetes.io/audit=privileged
pod-security.kubernetes.io/warn=privileged

@c3d
Copy link
Member Author
c3d commented Aug 26, 2022

@bpradipt As discussed on Slack, this does not really help. Furthermore, as you pointed out, since there is no support for CRIO, this is a dead end. Leaving this issue open for now, since we'll need to revisit at some point, but it's still too early.

@ariel-adam
Copy link
Member

@c3d is this issue still relevant or can be closed?
If it's still relevant to what release do you think we should map it to (mid-November, end-December, mid-February etc...)?

@c3d
Copy link
Member Author
c3d commented Oct 11, 2022

@ariel-adam It's a bit too early to attack this kind of problem, but at some point we will need to tackle it. Either we close it now, but figure out a way to remember that we need to address it, or we keep it open and it says in our way for a long time. Which one do you prefer?

@ariel-adam
Copy link
Member

I think in this case we map it to the CoCo releases project without a specific drop so it will be part of our backlog.
If we see that it's backlog log for a long time (a year for example) that would be a good signal to close it :-)

@veluruchaithanya veluruchaithanya mentioned this issue Aug 16, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
CoCo Releases
Status: No status
Milestone
No milestone
Development

No branches or pull requests
3 participants
@c3d @bpradipt @ariel-adam