Add feature flag `set-security-context-read-only-root-filesystem` to set readOnlyRootFilesystem for containers #8186

kristofferchr · 2024-08-07T07:31:35Z

Solves: #8183

Changes

Add a flag to enable setting the readOnlyRootFilesystem field in the securityContext for containers used in pipelinerun, taskrun and affinity assistants

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
pre-commit Passed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

New feature flag `set-security-context-read-only-root-filesystem` in ConfigMap `feature-flags`. The new feature sets readOnlyRootFilesystem in securityContext for taskrun and affinity assistant containers.

tekton-robot · 2024-08-07T07:31:45Z

Hi @kristofferchr. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

kristofferchr · 2024-08-07T08:44:50Z

/kind feature

kristofferchr · 2024-08-07T10:35:36Z

/test pull-tekton-pipeline-go-coverage-df

tekton-robot · 2024-08-07T10:35:51Z

@kristofferchr: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

/test pull-tekton-pipeline-go-coverage-df

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2024-08-07T10:49:10Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.1%	94.4%	-0.7
pkg/pod/SecurityContext.go	Do not exist	85.7%
pkg/pod/pod.go	93.9%	94.2%	0.3
pkg/pod/script.go	99.0%	99.0%	-0.0
pkg/pod/workingdir_init.go	95.0%	94.1%	-0.9
pkg/reconciler/pipelinerun/affinity_assistant.go	96.9%	97.0%	0.1

tekton-robot · 2024-08-07T11:08:20Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.1%	94.4%	-0.7
pkg/pod/pod.go	93.9%	94.2%	0.3
pkg/pod/script.go	99.0%	99.0%	-0.0
pkg/pod/security_context_config.go	Do not exist	85.7%
pkg/pod/workingdir_init.go	95.0%	94.1%	-0.9
pkg/reconciler/pipelinerun/affinity_assistant.go	96.9%	97.0%	0.1

tekton-robot · 2025-02-06T12:16:06Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.1%	94.4%	-0.7
pkg/pod/pod.go	93.0%	93.3%	0.3
pkg/pod/script.go	99.1%	99.1%	-0.0
pkg/pod/security_context_config.go	Do not exist	85.7%
pkg/pod/workingdir_init.go	95.0%	94.1%	-0.9

kristofferchr · 2025-02-06T13:05:41Z

/retest

tekton-robot · 2025-02-06T13:05:56Z

@kristofferchr: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2025-02-06T13:51:13Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.1%	94.4%	-0.7
pkg/pod/pod.go	93.0%	93.3%	0.3
pkg/pod/script.go	99.1%	99.1%	-0.0
pkg/pod/security_context_config.go	Do not exist	85.7%
pkg/pod/workingdir_init.go	95.0%	94.1%	-0.9

tekton-robot · 2025-02-06T14:00:22Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.1%	94.4%	-0.7
pkg/pod/pod.go	93.0%	93.3%	0.3
pkg/pod/script.go	99.1%	99.1%	-0.0
pkg/pod/security_context_config.go	Do not exist	85.7%
pkg/pod/workingdir_init.go	95.0%	94.1%	-0.9

tekton-robot · 2025-02-07T08:10:10Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.1%	94.4%	-0.7
pkg/pod/pod.go	93.0%	93.3%	0.3
pkg/pod/script.go	99.1%	99.1%	-0.0
pkg/pod/security_context_config.go	Do not exist	85.7%
pkg/pod/workingdir_init.go	95.0%	94.1%	-0.9

tekton-robot · 2025-02-07T10:13:17Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.1%	94.4%	-0.7
pkg/pod/pod.go	93.0%	93.3%	0.3
pkg/pod/script.go	99.1%	99.1%	-0.0
pkg/pod/security_context_config.go	Do not exist	100.0%
pkg/pod/workingdir_init.go	95.0%	94.1%	-0.9

Prior to this change it was not possible to set readOnlyRootFilesystem for tekton pipeline containers. This change allows users to set readOnlyRootFilesystem in container securityContext for all containers. Aligns tekton with industry best practices for kuberenetes security, such as Azure Kubernetes Services deployment safeguards.

tekton-robot · 2025-02-07T11:06:34Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.1%	95.2%	0.1
pkg/pod/pod.go	93.0%	93.3%	0.3
pkg/pod/script.go	99.1%	99.1%	-0.0
pkg/pod/security_context_config.go	Do not exist	100.0%
pkg/pod/workingdir_init.go	95.0%	94.1%	-0.9

kristofferchr · 2025-02-18T21:08:32Z

Is this ok-to-test @vdemeester ?

vdemeester · 2025-02-24T13:23:55Z

@kristofferchr yes, it is ok, and test rans.. But you will probably need to rebase or commit/amend/push to force the new workflow to run (we moved some of them 🙏🏼 )

tekton-robot · 2025-02-24T13:24:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

afrittoli · 2025-02-24T13:55:27Z

/ok-to-test

afrittoli

Thank you for this!
/lgtm

afrittoli · 2025-02-24T13:59:29Z

...is/config/testdata/feature-flags-invalid-set_security_context_read_only_root_filesystem.yaml

@@ -0,0 +1,21 @@
+# Copyright 2021 The Tekton Authors


NIT: this is a new file, so the data should be 2025

afrittoli · 2025-02-24T14:00:50Z

pkg/pod/security_context_config.go

@@ -0,0 +1,67 @@
+/*
+Copyright 2024 The Tekton Authors


afrittoli · 2025-02-24T14:09:01Z

docs/additional-configs.md

+- `set-security-context-read-only-root-filesystem`: Set this flag to `true` to enable `readOnlyRootFilesystem` in the
+  security context for containers injected by Tekton. This makes the root filesystem of the container read-only,
+  enhancing security. Note that this requires `set-security-context` to be enabled. By default, this flag is set
+  to `false`. Note: This feature does not work in windows as it is not supported there, [Comparison with linux](https://kubernetes.io/docs/concepts/windows/intro/#compatibility-linux-similarities). 


tekton-robot requested review from abayer and vdemeester August 7, 2024 07:31

tekton-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Aug 7, 2024

tekton-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesnt merit a release note. labels Aug 7, 2024

kristofferchr changed the title ~~Enable read only root filesystem~~ Add feature flag set-security-context-read-only-root-filesystem to add readOnlyRootFilesystem to containers Aug 7, 2024

kristofferchr changed the title ~~Add feature flag set-security-context-read-only-root-filesystem to add readOnlyRootFilesystem to containers~~ Add feature flag set-security-context-read-only-root-filesystem to set readOnlyRootFilesystem to containers Aug 7, 2024

kristofferchr changed the title ~~Add feature flag set-security-context-read-only-root-filesystem to set readOnlyRootFilesystem to containers~~ Add feature flag set-security-context-read-only-root-filesystem to set readOnlyRootFilesystem for containers Aug 7, 2024

kristofferchr force-pushed the enable-read-only-root-filesystem branch from acd8516 to f0fecb9 Compare August 7, 2024 10:54

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 22, 2024

kristofferchr force-pushed the enable-read-only-root-filesystem branch from f0fecb9 to 46cb332 Compare February 6, 2025 12:04

tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 6, 2025

kristofferchr force-pushed the enable-read-only-root-filesystem branch from 46cb332 to 68f73c6 Compare February 6, 2025 13:39

tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Feb 6, 2025

kristofferchr force-pushed the enable-read-only-root-filesystem branch from 68f73c6 to 1c3c312 Compare February 6, 2025 13:46

kristofferchr marked this pull request as ready for review February 6, 2025 14:29

tekton-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 6, 2025

tekton-robot requested review from afrittoli and dibyom February 6, 2025 14:30

kristofferchr force-pushed the enable-read-only-root-filesystem branch from 1c3c312 to 1bbd67c Compare February 7, 2025 07:57

kristofferchr force-pushed the enable-read-only-root-filesystem branch from 1bbd67c to 5516ec0 Compare February 7, 2025 10:00

tekton-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Feb 7, 2025

kristofferchr force-pushed the enable-read-only-root-filesystem branch from 5516ec0 to 1fe2500 Compare February 7, 2025 10:52

vdemeester approved these changes Feb 24, 2025

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 24, 2025

afrittoli closed this Feb 24, 2025

afrittoli reopened this Feb 24, 2025

tekton-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 24, 2025

afrittoli reviewed Feb 24, 2025

View reviewed changes

tekton-robot assigned afrittoli Feb 24, 2025

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Feb 24, 2025

tekton-robot merged commit a44d224 into tektoncd:main Feb 24, 2025
29 checks passed

kristofferchr deleted the enable-read-only-root-filesystem branch February 25, 2025 13:05

Add feature flag set-security-context-read-only-root-filesystem to set readOnlyRootFilesystem for containers #8186

Add feature flag set-security-context-read-only-root-filesystem to set readOnlyRootFilesystem for containers #8186

Uh oh!

Conversation

kristofferchr commented Aug 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

Uh oh!

tekton-robot commented Aug 7, 2024

Uh oh!

kristofferchr commented Aug 7, 2024

Uh oh!

kristofferchr commented Aug 7, 2024

Uh oh!

tekton-robot commented Aug 7, 2024

Uh oh!

tekton-robot commented Aug 7, 2024

Uh oh!

tekton-robot commented Aug 7, 2024

Uh oh!

tekton-robot commented Feb 6, 2025

Uh oh!

kristofferchr commented Feb 6, 2025

Uh oh!

tekton-robot commented Feb 6, 2025

Uh oh!

tekton-robot commented Feb 6, 2025

Uh oh!

tekton-robot commented Feb 6, 2025

Uh oh!

tekton-robot commented Feb 7, 2025

Uh oh!

tekton-robot commented Feb 7, 2025

Uh oh!

tekton-robot commented Feb 7, 2025

Uh oh!

kristofferchr commented Feb 18, 2025

Uh oh!

vdemeester commented Feb 24, 2025

Uh oh!

tekton-robot commented Feb 24, 2025

Uh oh!

afrittoli commented Feb 24, 2025

Uh oh!

afrittoli left a comment

Choose a reason for hiding this comment

Uh oh!

afrittoli Feb 24, 2025

Choose a reason for hiding this comment

Uh oh!

afrittoli Feb 24, 2025

Choose a reason for hiding this comment

Uh oh!

afrittoli Feb 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Add feature flag `set-security-context-read-only-root-filesystem` to set readOnlyRootFilesystem for containers #8186

Add feature flag `set-security-context-read-only-root-filesystem` to set readOnlyRootFilesystem for containers #8186

kristofferchr commented Aug 7, 2024 •

edited

Loading