Skip to content

Commit 7797cdf

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #256 from lpiwowar/readOnlyRootFilesystem
Run test pods with readOnlyRootFileSystem: true
2 parents 93395c4 + 046eae0 commit 7797cdf

16 files changed

+153
-52
lines changed

‎api/bases/test.openstack.org_ansibletests.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -146,11 +146,11 @@ spec:
146146
default: false
147147
description: |-
148148
Use with caution! This parameter specifies whether test-operator should spawn test
149-
pods with allowedPrivilegedEscalation: true and the default capabilities on
150-
top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
151-
This parameter is deemed insecure but it is needed for certain test-operator
152-
functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
153-
of tobiko tests).
149+
pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
150+
default capabilities on top of capabilities that are usually needed by the test
151+
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
152+
certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
153+
CR, or certain set of tobiko tests).
154154
type: boolean
155155
storageClass:
156156
default: local-storage

‎api/bases/test.openstack.org_horizontests.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -159,11 +159,11 @@ spec:
159159
default: false
160160
description: |-
161161
Use with caution! This parameter specifies whether test-operator should spawn test
162-
pods with allowedPrivilegedEscalation: true and the default capabilities on
163-
top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
164-
This parameter is deemed insecure but it is needed for certain test-operator
165-
functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
166-
of tobiko tests).
162+
pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
163+
default capabilities on top of capabilities that are usually needed by the test
164+
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
165+
certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
166+
CR, or certain set of tobiko tests).
167167
type: boolean
168168
projectName:
169169
default: horizontest

‎api/bases/test.openstack.org_tempests.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -153,11 +153,11 @@ spec:
153153
default: false
154154
description: |-
155155
Use with caution! This parameter specifies whether test-operator should spawn test
156-
pods with allowedPrivilegedEscalation: true and the default capabilities on
157-
top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
158-
This parameter is deemed insecure but it is needed for certain test-operator
159-
functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
160-
of tobiko tests).
156+
pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
157+
default capabilities on top of capabilities that are usually needed by the test
158+
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
159+
certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
160+
CR, or certain set of tobiko tests).
161161
type: boolean
162162
storageClass:
163163
default: local-storage

‎api/bases/test.openstack.org_tobikoes.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -143,11 +143,11 @@ spec:
143143
default: false
144144
description: |-
145145
Use with caution! This parameter specifies whether test-operator should spawn test
146-
pods with allowedPrivilegedEscalation: true and the default capabilities on
147-
top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
148-
This parameter is deemed insecure but it is needed for certain test-operator
149-
functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
150-
of tobiko tests).
146+
pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
147+
default capabilities on top of capabilities that are usually needed by the test
148+
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
149+
certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
150+
CR, or certain set of tobiko tests).
151151
type: boolean
152152
publicKey:
153153
default: ""

‎api/v1beta1/common.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,11 @@ type CommonOptions struct {
4646
// +kubebuilder:default=false
4747
// +optional
4848
// Use with caution! This parameter specifies whether test-operator should spawn test
49-
// pods with allowedPrivilegedEscalation: true and the default capabilities on
50-
// top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
51-
// This parameter is deemed insecure but it is needed for certain test-operator
52-
// functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
53-
// of tobiko tests).
49+
// pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
50+
// default capabilities on top of capabilities that are usually needed by the test
51+
// pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
52+
// certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
53+
// CR, or certain set of tobiko tests).
5454
Privileged bool `json:"privileged"`
5555

5656
// +operator-sdk:csv:customresourcedefinitions:type=spec

‎api/v1beta1/common_webhook.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ const (
1212
const (
1313
// WarnPrivilegedModeOn
1414
WarnPrivilegedModeOn = "%s.Spec.Privileged is set to true. This means that test pods " +
15-
"are spawned with allowPrivilegedEscalation: true and default " +
16-
"capabilities on top of those required by the test operator " +
15+
"are spawned with allowPrivilegedEscalation: true, readOnlyRootFilesystem: false " +
16+
"and default capabilities on top of those required by the test operator " +
1717
"(NET_ADMIN, NET_RAW)."
1818

1919
// WarnPrivilegedModeOff

‎config/crd/bases/test.openstack.org_ansibletests.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -146,11 +146,11 @@ spec:
146146
default: false
147147
description: |-
148148
Use with caution! This parameter specifies whether test-operator should spawn test
149-
pods with allowedPrivilegedEscalation: true and the default capabilities on
150-
top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
151-
This parameter is deemed insecure but it is needed for certain test-operator
152-
functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
153-
of tobiko tests).
149+
pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
150+
default capabilities on top of capabilities that are usually needed by the test
151+
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
152+
certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
153+
CR, or certain set of tobiko tests).
154154
type: boolean
155155
storageClass:
156156
default: local-storage

‎config/crd/bases/test.openstack.org_horizontests.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -159,11 +159,11 @@ spec:
159159
default: false
160160
description: |-
161161
Use with caution! This parameter specifies whether test-operator should spawn test
162-
pods with allowedPrivilegedEscalation: true and the default capabilities on
163-
top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
164-
This parameter is deemed insecure but it is needed for certain test-operator
165-
functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
166-
of tobiko tests).
162+
pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
163+
default capabilities on top of capabilities that are usually needed by the test
164+
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
165+
certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
166+
CR, or certain set of tobiko tests).
167167
type: boolean
168168
projectName:
169169
default: horizontest

‎config/crd/bases/test.openstack.org_tempests.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -153,11 +153,11 @@ spec:
153153
default: false
154154
description: |-
155155
Use with caution! This parameter specifies whether test-operator should spawn test
156-
pods with allowedPrivilegedEscalation: true and the default capabilities on
157-
top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
158-
This parameter is deemed insecure but it is needed for certain test-operator
159-
functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
160-
of tobiko tests).
156+
pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
157+
default capabilities on top of capabilities that are usually needed by the test
158+
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
159+
certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
160+
CR, or certain set of tobiko tests).
161161
type: boolean
162162
storageClass:
163163
default: local-storage

‎config/crd/bases/test.openstack.org_tobikoes.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -143,11 +143,11 @@ spec:
143143
default: false
144144
description: |-
145145
Use with caution! This parameter specifies whether test-operator should spawn test
146-
pods with allowedPrivilegedEscalation: true and the default capabilities on
147-
top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
148-
This parameter is deemed insecure but it is needed for certain test-operator
149-
functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
150-
of tobiko tests).
146+
pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
147+
default capabilities on top of capabilities that are usually needed by the test
148+
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
149+
certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest
150+
CR, or certain set of tobiko tests).
151151
type: boolean
152152
publicKey:
153153
default: ""

‎config/samples/test_v1beta1_tempest.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ spec:
3131
# Privileged
3232
# ----------
3333
# Use with caution! This parameter specifies whether test-operator should spawn test
34-
# pods with allowedPrivilegedEscalation: true and the default capabilities on
35-
# top of capabilities that are usually needed by the test pods (NET_ADMIN, NET_RAW).
36-
# This parameter is deemed insecure but it is needed for certain test-operator
37-
# functionalities to work properly (e.g.: extraRPMs in Tempest CR, or certain set
38-
# tobiko tests).
34+
# pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false and the
35+
# default capabilities on top of capabilities that are usually needed by the test
36+
# pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is needed for
37+
# certain test-operator functionalities to work properly (e.g.: extraRPMs in Tempest CR,
38+
# or certain set tobiko tests).
3939
#
4040
# privileged: false
4141
tempestRun:

‎pkg/ansibletest/volumes.go

+23
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package ansibletest
22

33
import (
44
testv1beta1 "github.com/openstack-k8s-operators/test-operator/api/v1beta1"
5+
util "github.com/openstack-k8s-operators/test-operator/pkg/util"
56
corev1 "k8s.io/api/core/v1"
67
)
78

@@ -50,6 +51,18 @@ func GetVolumes(
5051
},
5152
},
5253
},
54+
{
55+
Name: util.TestOperatorEphemeralVolumeNameWorkdir,
56+
VolumeSource: corev1.VolumeSource{
57+
EmptyDir: &corev1.EmptyDirVolumeSource{},
58+
},
59+
},
60+
{
61+
Name: util.TestOperatorEphemeralVolumeNameTmp,
62+
VolumeSource: corev1.VolumeSource{
63+
EmptyDir: &corev1.EmptyDirVolumeSource{},
64+
},
65+
},
5366
}
5467

5568
if mountCerts {
@@ -129,6 +142,16 @@ func GetVolumes(
129142
// GetVolumeMounts -
130143
func GetVolumeMounts(mountCerts bool, instance *testv1beta1.AnsibleTest, externalWorkflowCounter int) []corev1.VolumeMount {
131144
volumeMounts := []corev1.VolumeMount{
145+
{
146+
Name: util.TestOperatorEphemeralVolumeNameWorkdir,
147+
MountPath: "/var/lib/ansible",
148+
ReadOnly: false,
149+
},
150+
{
151+
Name: util.TestOperatorEphemeralVolumeNameTmp,
152+
MountPath: "/tmp",
153+
ReadOnly: false,
154+
},
132155
{
133156
Name: "test-operator-logs",
134157
MountPath: "/var/lib/AnsibleTests/external_files",

‎pkg/horizontest/volumes.go

+22
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,18 @@ func GetVolumes(
6161
},
6262
},
6363
},
64+
{
65+
Name: util.TestOperatorEphemeralVolumeNameWorkdir,
66+
VolumeSource: corev1.VolumeSource{
67+
EmptyDir: &corev1.EmptyDirVolumeSource{},
68+
},
69+
},
70+
{
71+
Name: util.TestOperatorEphemeralVolumeNameTmp,
72+
VolumeSource: corev1.VolumeSource{
73+
EmptyDir: &corev1.EmptyDirVolumeSource{},
74+
},
75+
},
6476
}
6577

6678
if mountCerts {
@@ -117,6 +129,16 @@ func GetVolumes(
117129
// GetVolumeMounts -
118130
func GetVolumeMounts(mountCerts bool, mountKeys bool, mountKubeconfig bool, instance *testv1beta1.HorizonTest) []corev1.VolumeMount {
119131
volumeMounts := []corev1.VolumeMount{
132+
{
133+
Name: util.TestOperatorEphemeralVolumeNameWorkdir,
134+
MountPath: "/var/lib/horizontest",
135+
ReadOnly: false,
136+
},
137+
{
138+
Name: util.TestOperatorEphemeralVolumeNameTmp,
139+
MountPath: "/tmp",
140+
ReadOnly: false,
141+
},
120142
{
121143
Name: "test-operator-logs",
122144
MountPath: "/var/lib/horizontest/external_files",

‎pkg/tempest/volumes.go

+23
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package tempest
22

33
import (
44
testv1beta1 "github.com/openstack-k8s-operators/test-operator/api/v1beta1"
5+
util "github.com/openstack-k8s-operators/test-operator/pkg/util"
56
corev1 "k8s.io/api/core/v1"
67
)
78

@@ -61,6 +62,18 @@ func GetVolumes(
6162
},
6263
},
6364
},
65+
{
66+
Name: util.TestOperatorEphemeralVolumeNameWorkdir,
67+
VolumeSource: corev1.VolumeSource{
68+
EmptyDir: &corev1.EmptyDirVolumeSource{},
69+
},
70+
},
71+
{
72+
Name: util.TestOperatorEphemeralVolumeNameTmp,
73+
VolumeSource: corev1.VolumeSource{
74+
EmptyDir: &corev1.EmptyDirVolumeSource{},
75+
},
76+
},
6477
}
6578

6679
if mountCerts {
@@ -119,6 +132,16 @@ func GetVolumes(
119132
// GetVolumeMounts -
120133
func GetVolumeMounts(mountCerts bool, mountSSHKey bool, instance *testv1beta1.Tempest) []corev1.VolumeMount {
121134
volumeMounts := []corev1.VolumeMount{
135+
{
136+
Name: util.TestOperatorEphemeralVolumeNameWorkdir,
137+
MountPath: "/var/lib/tempest",
138+
ReadOnly: false,
139+
},
140+
{
141+
Name: util.TestOperatorEphemeralVolumeNameTmp,
142+
MountPath: "/tmp",
143+
ReadOnly: false,
144+
},
122145
{
123146
Name: "config-data",
124147
MountPath: "/etc/test_operator",

‎pkg/tobiko/volumes.go

+22
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,18 @@ func GetVolumes(
6363
},
6464
},
6565
},
66+
{
67+
Name: util.TestOperatorEphemeralVolumeNameWorkdir,
68+
VolumeSource: corev1.VolumeSource{
69+
EmptyDir: &corev1.EmptyDirVolumeSource{},
70+
},
71+
},
72+
{
73+
Name: util.TestOperatorEphemeralVolumeNameTmp,
74+
VolumeSource: corev1.VolumeSource{
75+
EmptyDir: &corev1.EmptyDirVolumeSource{},
76+
},
77+
},
6678
}
6779

6880
if mountCerts {
@@ -150,6 +162,16 @@ func GetVolumes(
150162
// GetVolumeMounts -
151163
func GetVolumeMounts(mountCerts bool, mountKeys bool, mountKubeconfig bool, instance *testv1beta1.Tobiko) []corev1.VolumeMount {
152164
volumeMounts := []corev1.VolumeMount{
165+
{
166+
Name: util.TestOperatorEphemeralVolumeNameWorkdir,
167+
MountPath: "/var/lib/tobiko",
168+
ReadOnly: false,
169+
},
170+
{
171+
Name: util.TestOperatorEphemeralVolumeNameTmp,
172+
MountPath: "/tmp",
173+
ReadOnly: false,
174+
},
153175
{
154176
Name: "test-operator-logs",
155177
MountPath: "/var/lib/tobiko/external_files",

‎pkg/util/common.go

+11
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@ const (
99
// modified clouds.yaml obtained from openstack-config ConfigMap. The modified
1010
// CM is needed by some test frameworks (e.g., HorizonTest and Tobiko)
1111
TestOperatorCloudsConfigMapName = "test-operator-clouds-config"
12+
13+
// TestOperatorEphemeralVolumeNameWorkdir
14+
TestOperatorEphemeralVolumeNameWorkdir = "test-operator-ephemeral-workdir"
15+
16+
// TestOperatorEphemeralVolumeNameTmp
17+
TestOperatorEphemeralVolumeNameTmp = "test-operator-ephemeral-temporary"
1218
)
1319

1420
func GetSecurityContext(
@@ -22,6 +28,7 @@ func GetSecurityContext(
2228
securityContext := corev1.SecurityContext{
2329
RunAsUser: &runAsUser,
2430
RunAsGroup: &runAsUser,
31+
ReadOnlyRootFilesystem: &trueVar,
2532
AllowPrivilegeEscalation: &falseVar,
2633
Capabilities: &corev1.Capabilities{},
2734
SeccompProfile: &corev1.SeccompProfile{
@@ -33,6 +40,10 @@ func GetSecurityContext(
3340
// We need to run pods with AllowPrivilegedEscalation: true to remove
3441
// nosuid from the pod (in order to be able to run sudo)
3542
securityContext.AllowPrivilegeEscalation = &trueVar
43+
44+
// We need to run pods with ReadOnlyRootFileSystem: false when installing
45+
// additional tests using extraRPMs parameter in Tempest CR
46+
securityContext.ReadOnlyRootFilesystem = &falseVar
3647
securityContext.Capabilities.Add = addCapabilities
3748
}
3849

0 commit comments

Comments
 (0)