Skip to content

fix: Goose pod security context #2172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lpiwowar wants to merge 1 commit into
base: main
Choose a base branch
from
+23 −17
Open

fix: Goose pod security context #2172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ require (
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20261010081703-9c4377961aa3
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20261010081703-9c4377961aa3
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20261010081703-9c4377961aa3
github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20261010081703-9c4377961aa3
github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20261013151427-9b94821abb9f
github.com/openstack-k8s-operators/manila-operator/api v0.6.1-0.20261009185949-45a01e060edc
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260927135032-f0eb46b149d8
github.com/openstack-k8s-operators/neutron-operator/api v0.6.1-0.20261010070417-2d01164c96e3
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,8 +188,8 @@ github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.202610100
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20261010081703-9c4377961aa3/go.mod h1:zPIkK2aNVGCxyf8Yg2iAaiCH3Wu2G/kjft+CAVs1cgQ=
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20261010081703-9c4377961aa3 h1:MdMKJX/i1N4v8AA3Fb2EcysrBmGEoXJE5QdMltE0s2E=
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20261010081703-9c4377961aa3/go.mod h1:enei+rhzWgyEqqcrh/1V42M9exsotXPnmsj48g1nqD0=
github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20261010081703-9c4377961aa3 h1:WKWVyxCkEtqHND8TTEiJsl8R8fcDNXZS7zDzmHgFQFQ=
github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20261010081703-9c4377961aa3/go.mod h1:jmVVRfwuFQ3fHLIOAkUrtLgOwEL6j45POzS3PBJuwyM=
github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20261013151427-9b94821abb9f h1:S7PrjI50BUnpU8MWYQdFC5j8KGUqengL+AqovnCzC5U=
github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20261013151427-9b94821abb9f/go.mod h1:jmVVRfwuFQ3fHLIOAkUrtLgOwEL6j45POzS3PBJuwyM=
github.com/openstack-k8s-operators/manila-operator/api v0.6.1-0.20261009185949-45a01e060edc h1:m+T2nPcN3RkV8rnrwLaZzeEu3kTjffOja97IoA4g/F4=
github.com/openstack-k8s-operators/manila-operator/api v0.6.1-0.20261009185949-45a01e060edc/go.mod h1:4ii2iCFBbSd3Ns3OxwmtxLg0Vm/zX+ZGKUDuBRoJ+Xg=
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260927135032-f0eb46b149d8 h1:83bv+O9Xoiio4bUrjno/Z1QgfWF/BnF3TPY25gChU4k=
Expand Down
23 changes: 9 additions & 14 deletions internal/openstackassistant/funcs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,9 @@ import (
"unicode"

env "github.com/openstack-k8s-operators/lib-common/modules/common/env"
"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
"github.com/openstack-k8s-operators/lib-common/modules/users"
assistantv1 "github.com/openstack-k8s-operators/openstack-operator/api/assistant/v1beta1"

corev1 "k8s.io/api/core/v1"
Expand Down Expand Up @@ -143,23 +145,16 @@ func AssistantPodSpecWithCABundle(
podSpec := corev1.PodSpec{
TerminationGracePeriodSeconds: ptr.To[int64](0),
ServiceAccountName: instance.RbacResourceName(),
SecurityContext: pod.RestrictivePodSecurityContext(users.OpenStackAssistantUID, users.OpenStackAssistantGID),
Volumes: volumes,
Containers: []corev1.Container{
{
Name: "assistant",
Image: instance.Spec.ContainerImage,
SecurityContext: &corev1.SecurityContext{
RunAsNonRoot: ptr.To(true),
AllowPrivilegeEscalation: ptr.To(false),
Capabilities: &corev1.Capabilities{
Drop: []corev1.Capability{
"ALL",
},
},
},
Env: containerEnvs,
VolumeMounts: volumeMounts,
Resources: instance.Spec.Resources,
Name: "assistant",
Image: instance.Spec.ContainerImage,
SecurityContext: pod.RestrictiveSecurityContext(users.OpenStackAssistantUID, users.OpenStackAssistantGID),
Env: containerEnvs,
VolumeMounts: volumeMounts,
Resources: instance.Spec.Resources,
},
},
}
Expand Down
11 changes: 11 additions & 0 deletions internal/openstackassistant/funcs_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,12 @@ import (

"github.com/onsi/gomega"
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
"github.com/openstack-k8s-operators/lib-common/modules/users"

assistantv1 "github.com/openstack-k8s-operators/openstack-operator/api/assistant/v1beta1"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/ptr"
)

func newTestInstance() *assistantv1.OpenStackAssistant {
Expand Down Expand Up @@ -111,8 +113,17 @@ func TestAssistantPodSpec_SecurityContext(t *testing.T) {
instance := newTestInstance()

spec := AssistantPodSpec(instance, "hash", nil)
podSC := spec.SecurityContext
sc := spec.Containers[0].SecurityContext

g.Expect(podSC.RunAsUser).To(gomega.Equal(ptr.To(users.OpenStackAssistantUID)))
g.Expect(podSC.RunAsGroup).To(gomega.Equal(ptr.To(users.OpenStackAssistantGID)))
g.Expect(podSC.FSGroup).To(gomega.Equal(ptr.To(users.OpenStackAssistantGID)))
g.Expect(podSC.SeccompProfile).To(gomega.Equal(&corev1.SeccompProfile{
Type: corev1.SeccompProfileTypeRuntimeDefault,
}))
g.Expect(sc.RunAsUser).To(gomega.Equal(ptr.To(users.OpenStackAssistantUID)))
g.Expect(sc.RunAsGroup).To(gomega.Equal(ptr.To(users.OpenStackAssistantGID)))
g.Expect(*sc.RunAsNonRoot).To(gomega.BeTrue())
g.Expect(*sc.AllowPrivilegeEscalation).To(gomega.BeFalse())
g.Expect(sc.Capabilities.Drop).To(gomega.ContainElement(corev1.Capability("ALL")))
Expand Down
Loading