AUTH-482: set required-scc for openshift workloads #1031
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@liouk: This pull request references AUTH-482 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
liouk
force-pushed
the
required-scc
branch
2 times, most recently
from
ded775d
to
ca00203
Compare
|
/retest |
liouk
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
/assign @rfredette |
| @@ -9,6 +9,7 @@ spec: | |||
| metadata: | |||
| annotations: | |||
| target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' | |||
| openshift.io/required-scc: hostnetwork | |||
There was a problem hiding this comment.
The deployment may use "hostnetwork" or "restricted", depending on the ingresscontroller configuration (specifically IngressController.spec.endpointPublishingStrategy.type). So I think we will need desiredRouterDeployment in pkg/operator/controller/ingress/deployment.go to set this annotation at run-time —right?
By the way, this PR reminds me of some related PRs, #743 and #981, which updated the security context based on previous customer cases where we observed that the wrong SCC could be selected.
There was a problem hiding this comment.
Thanks for the pointer @Miciah 🙂 I've pushed a change that addresses this.
There was a problem hiding this comment.
@Miciah as far as I can see, the router SA only has access to the hostnetwork SCC, and as a result it can't use restricted (which is why the tests fail).
Am I missing something in my changes about the ingress controller configuration for the deployment?
There was a problem hiding this comment.
You're right, it seems that we missed this change from the OCP 4.11 release notes:
The
restrictedSCC is no longer available to users of new clusters, unless the access is explicitly granted. In clusters originally installed in OpenShift Container Platform 4.10 or earlier, all authenticated users can use therestrictedSCC when upgrading to OpenShift Container Platform 4.11 and later.
And observations of CI artifacts confirm this:
- periodic-ci-openshift-release-master-ci-4.10-upgrade-from-stable-4.9-e2e-aws-ovn-upgrade has
openshift.io/scc: restricted. - periodic-ci-openshift-release-master-ci-4.10-e2e-aws-serial has
openshift.io/scc: restricted. - periodic-ci-openshift-release-master-ci-4.11-upgrade-from-stable-4.10-e2e-aws-ovn-upgrade has
openshift.io/scc: restricted. - periodic-ci-openshift-release-master-ci-4.11-e2e-aws-serial has
openshift.io/scc: hostnetwork. - periodic-ci-openshift-release-master-ci-4.12-upgrade-from-stable-4.11-e2e-aws-ovn-upgrade has
openshift.io/scc: hostnetwork. - periodic-ci-openshift-release-master-ci-4.12-e2e-aws-sdn-serial has
openshift.io/scc: hostnetwork.
The intention is definitely that we use "restricted" when we don't need "hostnetwork". I've filed OCPBUGS-34418 and posted #1064 to address this oversight. Thanks for pointing it out!
There was a problem hiding this comment.
Glad this helped :) I'll wait for #1064 to merge and then rebase this and try again 👍
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest failures seem to be infra/connectivity related |
|
/retest-required |
|
@liouk: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Workloads affected:
openshift-ingress/router-defaultdeploymentopenshift-ingress-canary/ingress-canarydaemonsetopenshift-ingress-operator/ingress-operatordeployment