Skip to content

CCM namespace should be labelled as privileged #202

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
JoelSpeed merged 1 commit into from
Sep 6, 2022
Merged

CCM namespace should be labelled as privileged #202

JoelSpeed merged 1 commit into from
Sep 6, 2022

Conversation

@JoelSpeed
Copy link
Contributor

@JoelSpeed JoelSpeed commented Sep 5, 2022

All techpreview jobs are currently failing because of the new pod security admission policy checks. This should resolve the issue for now

ns/openshift-cloud-controller-manager replicaset/gcp-cloud-controller-manager-79c85fb79b - reason/FailedCreate (combined from similar events): Error creating: pods "gcp-cloud-controller-manager-79c85fb79b-kln2f" is forbidden: violates PodSecurity "restricted:latest": host namespaces (hostNetwork=true), hostPort (container "cloud-controller-manager" uses hostPort 10258), allowPrivilegeEscalation != false (container "cloud-controller-manager" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "cloud-controller-manager" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volume "host-etc-kube" uses restricted volume type "hostPath"), runAsNonRoot != true (pod or container "cloud-controller-manager" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "cloud-controller-manager" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")}

@openshift-ci openshift-ci bot requested review from elmiko and lobziik September 5, 2022 10:50
@JoelSpeed JoelSpeed mentioned this pull request Sep 5, 2022
Merged
@lobziik
Copy link
Contributor

lobziik commented Sep 5, 2022

/approve

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 5, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lobziik

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 5, 2022
@mdbooth
Copy link
Contributor

mdbooth commented Sep 5, 2022

/lgtm

I just tested this on OpenStack. It allows CCM to start and nodes become ready.

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 5, 2022
@mdbooth
Copy link
Contributor

mdbooth commented Sep 5, 2022

Incidentally, OpenStack uses CCM by default so our CI is currently completely on fire. If we could merge this quickly I'd be very grateful.

@JoelSpeed
Copy link
Contributor Author

JoelSpeed commented Sep 5, 2022

@mdbooth Did you review the openstack failures here?

Error creating: pods "csi-nodeplugin-nfsplugin-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[0].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount] for DaemonSet.apps/v1/csi-nodeplugin-nfsplugin -n openshift-manila-csi-driver happened 6 times
Error creating: pods "openstack-manila-csi-nodeplugin-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[2]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[0].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.containers[1].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[1].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount] for DaemonSet.apps/v1/openstack-manila-csi-nodeplugin -n openshift-manila-csi-driver happened 6 times

Looks like you'll need to fix the storage as well as the CCM, will get this merged soon but would like to see at least some of the CI pass/run

@mdbooth
Copy link
Contributor

mdbooth commented Sep 5, 2022

@mdbooth Did you review the openstack failures here?

Error creating: pods "csi-nodeplugin-nfsplugin-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[0].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount] for DaemonSet.apps/v1/csi-nodeplugin-nfsplugin -n openshift-manila-csi-driver happened 6 times
Error creating: pods "openstack-manila-csi-nodeplugin-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[2]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[0].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.containers[1].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[1].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount] for DaemonSet.apps/v1/openstack-manila-csi-nodeplugin -n openshift-manila-csi-driver happened 6 times

Looks like you'll need to fix the storage as well as the CCM, will get this merged soon but would like to see at least some of the CI pass/run

Yes I did, and they're confusing because that namespace already has the correct labels. Lets handle that separately as that's a much smaller fire.

@mdbooth
Copy link
Contributor

mdbooth commented Sep 5, 2022

@mdbooth Did you review the openstack failures here?

Error creating: pods "csi-nodeplugin-nfsplugin-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[0].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount] for DaemonSet.apps/v1/csi-nodeplugin-nfsplugin -n openshift-manila-csi-driver happened 6 times
Error creating: pods "openstack-manila-csi-nodeplugin-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[2]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[0].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, spec.containers[1].securityContext.privileged: Invalid value: true: Privileged containers are not allowed, spec.containers[1].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount] for DaemonSet.apps/v1/openstack-manila-csi-nodeplugin -n openshift-manila-csi-driver happened 6 times

Looks like you'll need to fix the storage as well as the CCM, will get this merged soon but would like to see at least some of the CI pass/run

Yes I did, and they're confusing because that namespace already has the correct labels. Lets handle that separately as that's a much smaller fire.

Also, I just created a cluster using this PR. Although I see this error in the logs in my cluster, the pods deploy shortly thereafter 🤔 I wonder if there's a race between the namespace and deployment creation? They certainly seem to be created in order.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Sep 5, 2022

/retest-required

Remaining retests: 0 against base HEAD 0f34d35 and 2 for PR HEAD 0d7e4d5 in total

@mdbooth
Copy link
Contributor

mdbooth commented Sep 6, 2022

/retest-required

@MaysaMacedo MaysaMacedo mentioned this pull request Sep 6, 2022
Merged
@JoelSpeed
Copy link
Contributor Author

JoelSpeed commented Sep 6, 2022

/retest

@timflannagan timflannagan mentioned this pull request Sep 6, 2022
Merged
@JoelSpeed JoelSpeed merged commit 0c8f48d into openshift:master Sep 6, 2022
@JoelSpeed JoelSpeed deleted the ccm-privilege branch September 6, 2022 15:39
@deads2k
Copy link
Contributor

deads2k commented Sep 6, 2022

appears to do no harm (some passes) and this has a good chance of unwedging us. m erging

@mdbooth mdbooth mentioned this pull request Sep 6, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@elmiko elmiko Awaiting requested review from elmiko

@lobziik lobziik Awaiting requested review from lobziik

Assignees

@mdbooth mdbooth

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@JoelSpeed @lobziik @mdbooth @openshift-ci-robot @deads2k