Skip to content

Commit a32578b

Browse files
ansdansd
committed
Drop all capabilities and add the required ones
1 parent a650146 commit a32578b

File tree

3 files changed

+56
-58
lines changed

3 files changed

+56
-58
lines changed

‎internal/resource/statefulset.go‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -497,11 +497,8 @@ func (builder *StatefulSetBuilder) podTemplateSpec(annotations, labels map[strin
497497
SecurityContext: &corev1.SecurityContext{
498498
RunAsUser: pointer.Int64Ptr(0),
499499
Capabilities: &corev1.Capabilities{
500-
Drop: []corev1.Capability{
501-
// Remove default capabilities allowed by Docker except for CHOWN and FOWNER
502-
"SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FSETID",
503-
"KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP",
504-
},
500+
Drop: []corev1.Capability{"ALL"},
501+
Add: []corev1.Capability{"CHOWN", "FOWNER"},
505502
},
506503
},
507504
Command: []string{
@@ -626,8 +623,8 @@ func (builder *StatefulSetBuilder) podTemplateSpec(annotations, labels map[strin
626623
Exec: &corev1.ExecAction{
627624
Command: []string{"/bin/bash", "-c",
628625
fmt.Sprintf("if [ ! -z \"$(cat /etc/pod-info/%s)\" ]; then exit 0; fi;", DeletionMarker) +
629-
fmt.Sprintf(" rabbitmq-upgrade await_online_quorum_plus_one -t %d;"+
630-
" rabbitmq-upgrade await_online_synchronized_mirror -t %d", defaultGracePeriodTimeoutSeconds, defaultGracePeriodTimeoutSeconds),
626+
fmt.Sprintf(" rabbitmq-upgrade await_online_quorum_plus_one -t %d;"+
627+
" rabbitmq-upgrade await_online_synchronized_mirror -t %d", defaultGracePeriodTimeoutSeconds, defaultGracePeriodTimeoutSeconds),
631628
},
632629
},
633630
},

‎internal/resource/statefulset_test.go‎

Lines changed: 51 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
. "github.com/onsi/ginkgo"
1414
. "github.com/onsi/ginkgo/extensions/table"
1515
. "github.com/onsi/gomega"
16+
. "github.com/onsi/gomega/gstruct"
1617
rabbitmqv1beta1 "github.com/rabbitmq/cluster-operator/api/v1beta1"
1718
"github.com/rabbitmq/cluster-operator/internal/resource"
1819
appsv1 "k8s.io/api/apps/v1"
@@ -943,56 +944,56 @@ var _ = Describe("StatefulSet", func() {
943944
initContainers := statefulSet.Spec.Template.Spec.InitContainers
944945
Expect(initContainers).To(HaveLen(1))
945946

946-
container := extractContainer(initContainers, "copy-config")
947-
Expect(container.Command).To(ConsistOf(
948-
"sh", "-c", "cp /tmp/rabbitmq/rabbitmq.conf /etc/rabbitmq/rabbitmq.conf "+
949-
"&& chown 999:999 /etc/rabbitmq/rabbitmq.conf "+
950-
"&& echo '' >> /etc/rabbitmq/rabbitmq.conf ; "+
951-
"cp /tmp/rabbitmq/advanced.config /etc/rabbitmq/advanced.config "+
952-
"&& chown 999:999 /etc/rabbitmq/advanced.config ; "+
953-
"cp /tmp/rabbitmq/rabbitmq-env.conf /etc/rabbitmq/rabbitmq-env.conf "+
954-
"&& chown 999:999 /etc/rabbitmq/rabbitmq-env.conf ; "+
955-
"cp /tmp/erlang-cookie-secret/.erlang.cookie /var/lib/rabbitmq/.erlang.cookie "+
956-
"&& chown 999:999 /var/lib/rabbitmq/.erlang.cookie "+
957-
"&& chmod 600 /var/lib/rabbitmq/.erlang.cookie ; "+
958-
"cp /tmp/rabbitmq-plugins/enabled_plugins /etc/rabbitmq/enabled_plugins "+
959-
"&& chown 999:999 /etc/rabbitmq/enabled_plugins ; "+
960-
"chgrp 999 /var/lib/rabbitmq/mnesia/",
961-
))
962-
963-
Expect(container.VolumeMounts).To(ConsistOf(
964-
corev1.VolumeMount{
965-
Name: "server-conf",
966-
MountPath: "/tmp/rabbitmq/",
967-
},
968-
corev1.VolumeMount{
969-
Name: "plugins-conf",
970-
MountPath: "/tmp/rabbitmq-plugins/",
971-
},
972-
973-
corev1.VolumeMount{
974-
Name: "rabbitmq-etc",
975-
MountPath: "/etc/rabbitmq/",
976-
},
977-
corev1.VolumeMount{
978-
Name: "rabbitmq-erlang-cookie",
979-
MountPath: "/var/lib/rabbitmq/",
980-
},
981-
corev1.VolumeMount{
982-
Name: "erlang-cookie-secret",
983-
MountPath: "/tmp/erlang-cookie-secret/",
984-
},
985-
corev1.VolumeMount{
986-
Name: "persistence",
987-
MountPath: "/var/lib/rabbitmq/mnesia/",
988-
},
989-
))
990-
991-
Expect(container.Image).To(Equal("rabbitmq-image-from-cr"))
992-
Expect(container.SecurityContext.RunAsUser).To(Equal(pointer.Int64Ptr(0)))
993-
Expect(container.SecurityContext.Capabilities.Drop).To(ConsistOf([]corev1.Capability{
994-
"SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FSETID",
995-
"KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP",
947+
initContainer := extractContainer(initContainers, "copy-config")
948+
Expect(initContainer).To(MatchFields(IgnoreExtras, Fields{
949+
"Image": Equal("rabbitmq-image-from-cr"),
950+
"SecurityContext": PointTo(MatchFields(IgnoreExtras, Fields{
951+
"Capabilities": PointTo(MatchAllFields(Fields{
952+
"Drop": ConsistOf([]corev1.Capability{"ALL"}),
953+
"Add": ConsistOf([]corev1.Capability{"CHOWN", "FOWNER"}),
954+
})),
955+
})),
956+
"Command": ConsistOf(
957+
"sh", "-c", "cp /tmp/rabbitmq/rabbitmq.conf /etc/rabbitmq/rabbitmq.conf "+
958+
"&& chown 999:999 /etc/rabbitmq/rabbitmq.conf "+
959+
"&& echo '' >> /etc/rabbitmq/rabbitmq.conf ; "+
960+
"cp /tmp/rabbitmq/advanced.config /etc/rabbitmq/advanced.config "+
961+
"&& chown 999:999 /etc/rabbitmq/advanced.config ; "+
962+
"cp /tmp/rabbitmq/rabbitmq-env.conf /etc/rabbitmq/rabbitmq-env.conf "+
963+
"&& chown 999:999 /etc/rabbitmq/rabbitmq-env.conf ; "+
964+
"cp /tmp/erlang-cookie-secret/.erlang.cookie /var/lib/rabbitmq/.erlang.cookie "+
965+
"&& chown 999:999 /var/lib/rabbitmq/.erlang.cookie "+
966+
"&& chmod 600 /var/lib/rabbitmq/.erlang.cookie ; "+
967+
"cp /tmp/rabbitmq-plugins/enabled_plugins /etc/rabbitmq/enabled_plugins "+
968+
"&& chown 999:999 /etc/rabbitmq/enabled_plugins ; "+
969+
"chgrp 999 /var/lib/rabbitmq/mnesia/",
970+
),
971+
"VolumeMounts": ConsistOf(
972+
corev1.VolumeMount{
973+
Name: "server-conf",
974+
MountPath: "/tmp/rabbitmq/",
975+
},
976+
corev1.VolumeMount{
977+
Name: "plugins-conf",
978+
MountPath: "/tmp/rabbitmq-plugins/",
979+
},
980+
corev1.VolumeMount{
981+
Name: "rabbitmq-etc",
982+
MountPath: "/etc/rabbitmq/",
983+
},
984+
corev1.VolumeMount{
985+
Name: "rabbitmq-erlang-cookie",
986+
MountPath: "/var/lib/rabbitmq/",
987+
},
988+
corev1.VolumeMount{
989+
Name: "erlang-cookie-secret",
990+
MountPath: "/tmp/erlang-cookie-secret/",
991+
},
992+
corev1.VolumeMount{
993+
Name: "persistence",
994+
MountPath: "/var/lib/rabbitmq/mnesia/",
995+
},
996+
),
996997
}))
997998
})
998999

‎system_tests/system_tests.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2424
)
2525

26-
const statefulSetSuffix = "server"
26+
const statefulSetSuffix = "server"
2727

2828
var _ = Describe("Operator", func() {
2929
var (

0 commit comments

Comments
 (0)