OCPBUGS-233: pkg/cvo/updatepayload: Set 'readOnlyRootFilesystem: false' #824

openshift-cherrypick-robot · 2022-08-18T03:24:45Z

This is an automated cherry-pick of #811

/assign wking

This blocks us from being associated with SecurityContextConstraints that set 'readOnlyRootFilesystem: true', because from [1]: > The set of SCCs that admission uses to authorize a pod are > determined by the user identity and groups that the user belongs > to. Additionally, if the pod specifies a service account, the set of > allowable SCCs includes any constraints accessible to the service > account. > > Admission uses the following approach to create the final security > context for the pod: > > 1. Retrieve all SCCs available for use. > 2. Generate field values for security context settings that were not > specified on the request. > 3. Validate the final settings against the available constraints. If we leave readOnlyRootFilesystem implicit, we may get associated with a SCC that set 'readOnlyRootFilesystem: true', and the version-* actions will fail like [2]: $ oc -n openshift-cluster-version get pods NAME READY STATUS RESTARTS AGE cluster-version-operator-6b5c8ff5c8-4bmxx 1/1 Running 0 33m version-4.10.20-smvt9-6vqwc 0/1 Error 0 10s $ oc -n openshift-cluster-version logs version-4.10.20-smvt9-6vqwc oc logs version-4.10.20-smvt9-6vqwc mv: cannot remove '/manifests/0000_00_cluster-version-operator_00_namespace.yaml': Read-only file system mv: cannot remove '/manifests/0000_00_cluster-version-operator_01_adminack_configmap.yaml': Read-only file system ... For a similar change in another repository, see [3]. Also likely relevant, 4.10 both grew pod-security.kubernetes.io/* annotations [4] and cleared the openshift.io/run-level annotation [5]. $ git --no-pager log --oneline -3 origin/release-4.10 -- install/0000_00_cluster-version-operator_00_namespace.yaml 539e944 (origin/pr/623) Fix run-level label to empty string. f58dd1c (origin/pr/686) install: Add description annotations to manifests 6e5e23e (origin/pr/668) podsecurity: enforce privileged for openshift-cluster-version namespace None of those were in 4.9: $ git --no-pager log --oneline -1 origin/release-4.9 -- install/0000_00_cluster-version-operator_00_namespace.yaml 7009736 (origin/pr/543) Add management workload annotations And all of them landed in 4.10 via master (so they're in 4.10 before it GAed, and in 4.11 and later too): $ git --no-pager log --oneline -4 origin/master -- install/0000_00_cluster-version-operator_00_namespace.yaml 539e944 (origin/pr/623) Fix run-level label to empty string. [1]: https://docs.openshift.com/container-platform/4.10/authentication/managing-security-context-constraints.html#admission_configuring-internal-oauth [2]: https://bugzilla.redhat.com/show_bug.cgi?id=2110590#c0 [3]: openshift/cluster-openshift-apiserver-operator#437 [4]: openshift#668 [5]: openshift#623

openshift-ci · 2022-08-18T03:24:56Z

@openshift-cherrypick-robot: An error was encountered cloning bug for cherrypick for bug 2114602 on the Bugzilla server at https://bugzilla.redhat.com. No known errors were detected, please see the full error message for details.

Full error message.


response code 401 not 200

Please contact an administrator to resolve this issue, then request a bug refresh with /bugzilla refresh.

Details

In response to this:

[release-4.10] Bug 2114602: pkg/cvo/updatepayload: Set 'readOnlyRootFilesystem: false'

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2022-08-18T03:28:44Z

@openshift-cherrypick-robot: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

Details

In response to this:

OCPBUGS-233: pkg/cvo/updatepayload: Set 'readOnlyRootFilesystem: false'

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2022-08-18T03:28:46Z

@openshift-cherrypick-robot: This pull request references [Jira Issue OCPBUGS-233](https://issues.redhat.com//browse/OCPBUGS-233), which is invalid:

expected dependent Jira Issue OCPBUGS-232 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENTRELEASE), but it is New instead
expected dependent Jira Issue OCPBUGS-232 to target a version in 4.11.0, but it targets "4.11.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

This is an automated cherry-pick of #811

/assign wking

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking

Clean pick.

/lgtm

openshift-ci · 2022-08-18T03:29:53Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: openshift-cherrypick-robot, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

wking · 2022-08-18T03:29:54Z

/jira refresh

openshift-ci-robot · 2022-08-18T03:29:57Z

@wking: This pull request references [Jira Issue OCPBUGS-233](https://issues.redhat.com//browse/OCPBUGS-233), which is invalid:

expected dependent Jira Issue OCPBUGS-232 to target a version in 4.11.0, but it targets "4.11.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking · 2022-08-18T03:31:19Z

Huh. I expected:

expected dependent Jira Issue OCPBUGS-232 to target a version in 4.11.0, but it targets "4.11.z" instead

to have been fixed by openshift/release#31412.

….z bugs Avoid [1]: ... expected dependent Jira Issue OCPBUGS-232 to target a version in 4.11.0, but it targets "4.11.z" instead... Now that 4.11 is GA, 4.10.z backports can carry back both changes that landed pre-GA (4.11.0) and post-GA (4.11.z). Follows up on 8276887 (jira-lifecycle-plugin: update target version for 4.11 (openshift#31412), 2022-08-17). [1]: openshift/cluster-version-operator#824 (comment)

shellyyang1989 · 2022-08-18T08:29:39Z

/label qe-approved

….z bugs (#31442) Avoid [1]: ... expected dependent Jira Issue OCPBUGS-232 to target a version in 4.11.0, but it targets "4.11.z" instead... Now that 4.11 is GA, 4.10.z backports can carry back both changes that landed pre-GA (4.11.0) and post-GA (4.11.z). Follows up on 8276887 (jira-lifecycle-plugin: update target version for 4.11 (#31412), 2022-08-17). [1]: openshift/cluster-version-operator#824 (comment)

wking · 2022-08-18T15:28:14Z

openshift/release#31442 landed:

/jira refresh

openshift-ci-robot · 2022-08-18T15:28:17Z

@wking: This pull request references [Jira Issue OCPBUGS-233](https://issues.redhat.com//browse/OCPBUGS-233), which is invalid:

expected dependent Jira Issue OCPBUGS-232 to target a version in 4.11.0, but it targets "4.11.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

openshift/release#31442 landed:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking · 2022-08-18T16:08:03Z

openshift/release#31462 landed:

/jira refresh

openshift-ci-robot · 2022-08-18T16:08:06Z

@wking: This pull request references [Jira Issue OCPBUGS-233](https://issues.redhat.com//browse/OCPBUGS-233), which is invalid:

expected dependent Jira Issue OCPBUGS-232 to target a version in 4.11.0, but it targets "4.11.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

openshift/release#31462 landed:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking · 2022-08-18T16:27:23Z

Maybe it took some time to roll out, and now it will work?

/jira refresh

openshift-ci-robot · 2022-08-18T16:27:25Z

@wking: This pull request references [Jira Issue OCPBUGS-233](https://issues.redhat.com//browse/OCPBUGS-233), which is invalid:

expected dependent Jira Issue OCPBUGS-232 to target a version in 4.11.0, but it targets "4.11.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Maybe it took some time to roll out, and now it will work?

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking · 2022-08-18T20:36:34Z

For unclear reasons, the ConfigMap hadn't synced. But I hear it has now:

/jira refresh

openshift-ci-robot · 2022-08-18T20:36:39Z

@wking: This pull request references [Jira Issue OCPBUGS-233](https://issues.redhat.com//browse/OCPBUGS-233), which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.10.z) matches configured target version for branch (4.10.z)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST)
dependent bug Jira Issue OCPBUGS-232 is in the state Verified (Done), which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENTRELEASE))
dependent Jira Issue OCPBUGS-232 targets the "4.11.z" version, which is one of the valid target versions: 4.11.0, 4.11.z
bug has dependents

Requesting review from QA contact:
/cc @shellyyang1989

Details

In response to this:

For unclear reasons, the ConfigMap hadn't synced. But I hear it has now:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

LalatenduMohanty · 2022-08-18T20:58:06Z

/label backport-risk-assessed

jiajliu · 2022-08-19T00:11:37Z

/label cherry-pick-approved

openshift-ci-robot · 2022-08-19T00:19:29Z

/retest-required

Remaining retests: 2 against base HEAD 288bd4d and 8 for PR HEAD 608c60f in total

openshift-ci-robot · 2022-08-19T03:14:48Z

/retest-required

Remaining retests: 2 against base HEAD 7c95b4d and 7 for PR HEAD 608c60f in total

wking · 2022-08-19T05:10:46Z

pods should successfully create sandboxes by not timing out is orthogonal.

/override ci/prow/e2e-agnostic-upgrade

openshift-ci · 2022-08-19T05:11:40Z

@wking: Overrode contexts on behalf of wking: ci/prow/e2e-agnostic-upgrade

Details

In response to this:

pods should successfully create sandboxes by not timing out is orthogonal.

/override ci/prow/e2e-agnostic-upgrade

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking · 2022-08-19T05:41:17Z

pods should successfully create sandboxes by not timing out is still orthogonal:

/override ci/prow/e2e-agnostic-upgrade

openshift-ci · 2022-08-19T05:41:54Z

@wking: Overrode contexts on behalf of wking: ci/prow/e2e-agnostic-upgrade

Details

In response to this:

pods should successfully create sandboxes by not timing out is still orthogonal:

/override ci/prow/e2e-agnostic-upgrade

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2022-08-19T07:02:22Z

@openshift-cherrypick-robot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-agnostic-upgrade	`608c60f`	link	true	`/test e2e-agnostic-upgrade`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2022-08-19T07:05:32Z

@openshift-cherrypick-robot: All pull requests linked via external trackers have merged:

openshift/cluster-version-operator#824

[Jira Issue OCPBUGS-233](https://issues.redhat.com//browse/OCPBUGS-233) has been moved to the MODIFIED state.

Details

In response to this:

This is an automated cherry-pick of #811

/assign wking

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

As this scc is based on scc privileged, when it is used by a serviceaccount, it runs as root but since readOnlyRootFilesystem: true, it prevents access to files/folders owned by user root. readOnlyRootFilesystem: true in this scc has caused problems during the upgrades on openshift, because, the version job pod created by CVO, sometimes uses this scc and is unable to remove folders/files owned by user root. List of related issues:- https://access.redhat.com/solutions/5911951 https://access.redhat.com/solutions/6985485 https://issues.redhat.com/browse/OTA-680 openshift/cluster-version-operator#824

openshift-cherrypick-robot mentioned this pull request Aug 18, 2022

Bug 2114602: pkg/cvo/updatepayload: Set 'readOnlyRootFilesystem: false' #811

Merged

openshift-ci bot assigned wking Aug 18, 2022

openshift-ci bot requested review from vrutkovs and wking August 18, 2022 03:25

wking changed the title ~~[release-4.10] Bug 2114602: pkg/cvo/updatepayload: Set 'readOnlyRootFilesystem: false'~~ OCPBUGS-233: pkg/cvo/updatepayload: Set 'readOnlyRootFilesystem: false' Aug 18, 2022

openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 18, 2022

wking approved these changes Aug 18, 2022

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 18, 2022

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 18, 2022

wking mentioned this pull request Aug 18, 2022

core-services/jira-lifecycle-plugin: Allow 4.11.z dependents for 4.10.z bugs openshift/release#31442

Merged

openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Aug 18, 2022

openshift-ci bot requested a review from shellyyang1989 August 18, 2022 20:36

openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Aug 18, 2022

openshift-ci bot added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Aug 19, 2022

openshift-merge-robot merged commit 16f373c into openshift:release-4.10 Aug 19, 2022

This was referenced Aug 3, 2023

Update collector-scc.yaml imdmahajankanika/stackrox#1

Merged

fix(helm): Set 'readOnlyRootFilesystem: false' stackrox/stackrox#7262

Closed

OCPBUGS-233: pkg/cvo/updatepayload: Set 'readOnlyRootFilesystem: false' #824

OCPBUGS-233: pkg/cvo/updatepayload: Set 'readOnlyRootFilesystem: false' #824

Uh oh!

Conversation

openshift-cherrypick-robot commented Aug 18, 2022

Uh oh!

openshift-ci bot commented Aug 18, 2022

Uh oh!

openshift-ci bot commented Aug 18, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Aug 18, 2022 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wking left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Aug 18, 2022

Uh oh!

wking commented Aug 18, 2022

Uh oh!

openshift-ci-robot commented Aug 18, 2022 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wking commented Aug 18, 2022

Uh oh!

shellyyang1989 commented Aug 18, 2022

Uh oh!

wking commented Aug 18, 2022

Uh oh!

openshift-ci-robot commented Aug 18, 2022 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wking commented Aug 18, 2022

Uh oh!

openshift-ci-robot commented Aug 18, 2022 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wking commented Aug 18, 2022

Uh oh!

openshift-ci-robot commented Aug 18, 2022 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wking commented Aug 18, 2022

Uh oh!

openshift-ci-robot commented Aug 18, 2022 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LalatenduMohanty commented Aug 18, 2022

Uh oh!

jiajliu commented Aug 19, 2022

Uh oh!

openshift-ci-robot commented Aug 19, 2022

Uh oh!

openshift-ci-robot commented Aug 19, 2022

Uh oh!

wking commented Aug 19, 2022

Uh oh!

openshift-ci bot commented Aug 19, 2022

Uh oh!

wking commented Aug 19, 2022

Uh oh!

openshift-ci bot commented Aug 19, 2022

Uh oh!

openshift-ci bot commented Aug 19, 2022

Uh oh!

openshift-ci-robot commented Aug 19, 2022 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

openshift-ci bot commented Aug 18, 2022 •

edited

Loading

openshift-ci-robot commented Aug 18, 2022 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 18, 2022 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 18, 2022 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 18, 2022 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 18, 2022 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 18, 2022 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 19, 2022 •

edited by openshift-ci bot

Loading