noqe: Update magic catalog for psa changes (#2842)

staging/operator-lifecycle-manager/pkg/controller/operators/olm/downstream_csv_labeler.go

@@ -0,0 +1,61 @@
+package olm
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/operator-framework/api/pkg/operators/v1alpha1"
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient"
+	"github.com/sirupsen/logrus"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const labelSyncerLabelKey = ""
+
+func NewCSVLabelSyncerLabeler(client operatorclient.ClientInterface, logger *logrus.Logger) *CSVLabelSyncerLabeler {
+	return &CSVLabelSyncerLabeler{
+		client: client,
+		logger: logger,
+	}
+}
+
+type CSVLabelSyncerLabeler struct {
+	client operatorclient.ClientInterface
+	logger *logrus.Logger
+}
+
+func (c *CSVLabelSyncerLabeler) OnAddOrUpdate(csv *v1alpha1.ClusterServiceVersion) error {
+	// ignore copied csvs
+	if csv.IsCopied() {
+		return nil
+	}
+
+	// ignore csv updates
+	if csv.Status.LastTransitionTime != nil {
+		return nil
+	}
+
+	namespace, err := c.client.KubernetesInterface().CoreV1().Namespaces().Get(context.Background(), csv.GetNamespace(), metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("error getting csv namespace (%s) for label sync'er labeling", csv.GetNamespace())
+	}
+
+	// add label sync'er label if it does not exist
+	if _, ok := namespace.Labels[labelSyncerLabelKey]; !ok {
+		nsCopy := namespace.DeepCopy()
+		nsCopy.Labels[labelSyncerLabelKey] = "true"
+		if _, err := c.client.KubernetesInterface().CoreV1().Namespaces().Update(context.Background(), namespace, metav1.UpdateOptions{}); err != nil {
+			return fmt.Errorf("error updating csv namespace (%s) with label sync'er label", nsCopy.GetNamespace())
+		}
+
+		if c.logger != nil {
+			c.logger.Printf("[CSV LABEL] applied %s=true label to namespace %s", labelSyncerLabelKey, nsCopy.GetNamespace())
+		}
+	}
+
+	return nil
+}
+
+func (c *CSVLabelSyncerLabeler) OnDelete(_ *v1alpha1.ClusterServiceVersion) error {
+	return nil
+}

staging/operator-lifecycle-manager/test/e2e/magic_catalog.go

@@ -11,6 +11,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/pointer"
 	k8scontrollerclient "sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -259,15 +260,18 @@ func (c *MagicCatalog) makeCatalogSourcePod() *corev1.Pod {
 		volumeMountName string = "fbc-catalog"
 	)
 
-	readOnlyRootFilesystem := false
-
 	return &corev1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      c.podName,
 			Namespace: c.namespace,
 			Labels:    c.makeCatalogSourcePodLabels(),
 		},
 		Spec: corev1.PodSpec{
+			SecurityContext: &corev1.PodSecurityContext{
+				SeccompProfile: &corev1.SeccompProfile{
+					Type: corev1.SeccompProfileTypeRuntimeDefault,
+				},
+			},
 			Containers: []corev1.Container{
 				{
 					Name:    "catalog",
@@ -304,7 +308,13 @@ func (c *MagicCatalog) makeCatalogSourcePod() *corev1.Pod {
 						},
 					},
 					SecurityContext: &corev1.SecurityContext{
-						ReadOnlyRootFilesystem: &readOnlyRootFilesystem,
+						ReadOnlyRootFilesystem:   pointer.Bool(false),
+						AllowPrivilegeEscalation: pointer.Bool(false),
+						Capabilities: &corev1.Capabilities{
+							Drop: []corev1.Capability{"ALL"},
+						},
+						RunAsNonRoot: pointer.Bool(true),
+						RunAsUser:    pointer.Int64(1001),
 					},
 					ImagePullPolicy:          corev1.PullAlways,
 					TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,

staging/operator-lifecycle-manager/test/e2e/skopeo.go

@@ -6,6 +6,7 @@ import (
 	"os/exec"
 
 	"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient"
+	"k8s.io/utils/pointer"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -81,11 +82,25 @@ func createSkopeoPod(client operatorclient.ClientInterface, args []string, names
 			Labels:    map[string]string{"name": skopeo},
 		},
 		Spec: corev1.PodSpec{
+			SecurityContext: &corev1.PodSecurityContext{
+				SeccompProfile: &corev1.SeccompProfile{
+					Type: corev1.SeccompProfileTypeRuntimeDefault,
+				},
+			},
 			Containers: []corev1.Container{
 				{
 					Name:  skopeo,
 					Image: skopeoImage,
 					Args:  args,
+					SecurityContext: &corev1.SecurityContext{
+						ReadOnlyRootFilesystem:   pointer.Bool(false),
+						AllowPrivilegeEscalation: pointer.Bool(false),
+						Capabilities: &corev1.Capabilities{
+							Drop: []corev1.Capability{"ALL"},
+						},
+						RunAsNonRoot: pointer.Bool(true),
+						RunAsUser:    pointer.Int64(1001),
+					},
 				},
 			},
 			RestartPolicy: corev1.RestartPolicyNever,