Skip to content

Commit eae3554

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #211 from lpiwowar/bugfix/privileges
Use the most restrictive service account possible
2 parents 9b081b3 + ca67497 commit eae3554

27 files changed

+390
-209
lines changed

‎api/bases/test.openstack.org_ansibletests.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ spec:
4343
spec:
4444
description: AnsibleTestSpec defines the desired state of AnsibleTest
4545
properties:
46+
SELinuxLevel:
47+
default: ""
48+
description: A SELinuxLevel that should be used for test pods spawned
49+
by the test operator.
50+
type: string
4651
ansibleCollections:
4752
default: ""
4853
description: AnsibleCollections - extra ansible collections to instal
@@ -191,6 +196,10 @@ spec:
191196
description: A parameter that contains a workflow definition.
192197
items:
193198
properties:
199+
SELinuxLevel:
200+
description: A SELinuxLevel that should be used for test pods
201+
spawned by the test operator.
202+
type: string
194203
ansibleCollections:
195204
description: AnsibleCollections - extra ansible collections
196205
to instal in additionn to the ones exist in the requirements.yaml

‎api/bases/test.openstack.org_horizontests.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ spec:
4343
spec:
4444
description: HorizonTestSpec defines the desired state of HorizonTest
4545
properties:
46+
SELinuxLevel:
47+
default: ""
48+
description: A SELinuxLevel that should be used for test pods spawned
49+
by the test operator.
50+
type: string
4651
adminPassword:
4752
default: admin
4853
description: AdminPassword is the password for the OpenStack admin

‎api/bases/test.openstack.org_tempests.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ spec:
4646
see TempestconfRunSpec.
4747
properties:
4848
SELinuxLevel:
49-
default: s0:c478,c978
50-
description: A SELinuxLevel that is used for all the tempest test
51-
pods.
49+
default: ""
50+
description: A SELinuxLevel that should be used for test pods spawned
51+
by the test operator.
5252
type: string
5353
SSHKeySecretName:
5454
default: ""
@@ -490,6 +490,10 @@ spec:
490490
For specific configuration of tempest see TempestRunSpec and for
491491
discover-tempest-config see TempestconfRunSpec.
492492
properties:
493+
SELinuxLevel:
494+
description: A SELinuxLevel that should be used for test pods
495+
spawned by the test operator.
496+
type: string
493497
SSHKeySecretName:
494498
description: SSHKeySecretName is the name of the k8s secret
495499
that contains an ssh key. The key is mounted to ~/.ssh/id_ecdsa

‎api/bases/test.openstack.org_tobikoes.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ spec:
4343
spec:
4444
description: TobikoSpec defines the desired state of Tobiko
4545
properties:
46+
SELinuxLevel:
47+
default: ""
48+
description: A SELinuxLevel that should be used for test pods spawned
49+
by the test operator.
50+
type: string
4651
backoffLimit:
4752
default: 0
4853
description: BackoffLimit allows to define the maximum number of retried
@@ -202,6 +207,10 @@ spec:
202207
description: A parameter that contains a workflow definition.
203208
items:
204209
properties:
210+
SELinuxLevel:
211+
description: A SELinuxLevel that should be used for test pods
212+
spawned by the test operator.
213+
type: string
205214
backoffLimit:
206215
default: 0
207216
description: BackoffLimit allows to define the maximum number

‎api/v1beta1/ansibletest_webhook.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,10 @@ func (r *AnsibleTest) ValidateCreate() (admission.Warnings, error) {
6767
allWarnings = append(allWarnings, fmt.Sprintf(WarnPrivilegedModeOn, "AnsibleTest"))
6868
}
6969

70+
if r.Spec.Privileged && len(r.Spec.Workflow) > 0 && len(r.Spec.SELinuxLevel) == 0 {
71+
allWarnings = append(allWarnings, fmt.Sprintf(WarnSELinuxLevel, r.Kind))
72+
}
73+
7074
return allWarnings, nil
7175
}
7276

‎api/v1beta1/common.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ type CommonOptions struct {
5959
// StorageClass used to create any test-operator related PVCs.
6060
StorageClass string `json:"storageClass"`
6161

62+
// +operator-sdk:csv:customresourcedefinitions:type=spec
63+
// +kubebuilder:validation:Optional
64+
// +kubebuilder:default:=""
65+
// +operator-sdk:csv:customresourcedefinitions:type=spec
66+
// A SELinuxLevel that should be used for test pods spawned by the test
67+
// operator.
68+
SELinuxLevel string `json:"SELinuxLevel"`
69+
6270
// +operator-sdk:csv:customresourcedefinitions:type=spec
6371
// +kubebuilder:validation:Optional
6472
// +kubebuilder:default:=""
@@ -136,6 +144,13 @@ type WorkflowCommonParameters struct {
136144
// StorageClass used to create any test-operator related PVCs.
137145
StorageClass *string `json:"storageClass"`
138146

147+
// +operator-sdk:csv:customresourcedefinitions:type=spec
148+
// +kubebuilder:validation:Optional
149+
// +optional
150+
// A SELinuxLevel that should be used for test pods spawned by the test
151+
// operator.
152+
SELinuxLevel *string `json:"SELinuxLevel,omitempty"`
153+
139154
// +operator-sdk:csv:customresourcedefinitions:type=spec
140155
// +kubebuilder:validation:Optional
141156
// +kubebuilder:default:=""

‎api/v1beta1/common_webhook.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,10 @@ const (
2121
"set of tests might fail, as this configuration may be " +
2222
"required for the tests to run successfully. Before enabling" +
2323
"this parameter, consult documentation of the %[1]s CR."
24+
25+
// WarnSELinuxLevel
26+
WarnSELinuxLevel = "%[1]s.Spec.Workflow is used and %[1]s.Spec.Privileged is " +
27+
"set to true. Please, consider setting %[1]s.Spec.SELinuxLevel. This " +
28+
"ensures that the copying of the logs to the PV is completed without any " +
29+
"complications."
2430
)

‎api/v1beta1/tempest_types.go

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -368,14 +368,8 @@ type TempestconfRunSpec struct {
368368
// TempestSpec - configuration of execution of tempest. For specific configuration
369369
// of tempest see TempestRunSpec and for discover-tempest-config see TempestconfRunSpec.
370370
type TempestSpec struct {
371-
CommonOptions `json:",inline"`
372-
CommonOpenstackConfig `json:",inline"`
373-
374-
// +kubebuilder:validation:Optional
375-
// +operator-sdk:csv:customresourcedefinitions:type=spec
376-
// +kubebuilder:default:="s0:c478,c978"
377-
// A SELinuxLevel that is used for all the tempest test pods.
378-
SELinuxLevel string `json:"SELinuxLevel"`
371+
CommonOptions `json:",inline"`
372+
CommonOpenstackConfig `json:",inline"`
379373

380374
// +kubebuilder:validation:Optional
381375
// +operator-sdk:csv:customresourcedefinitions:type=spec

‎api/v1beta1/tempest_webhook.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,10 @@ func (r *Tempest) ValidateCreate() (admission.Warnings, error) {
112112
allWarnings = append(allWarnings, fmt.Sprintf(WarnPrivilegedModeOn, "Tempest"))
113113
}
114114

115+
if r.Spec.Privileged && len(r.Spec.Workflow) > 0 && len(r.Spec.SELinuxLevel) == 0 {
116+
allWarnings = append(allWarnings, fmt.Sprintf(WarnSELinuxLevel, r.Kind))
117+
}
118+
115119
if len(allErrs) > 0 {
116120
return allWarnings, apierrors.NewInvalid(
117121
schema.GroupKind{

‎api/v1beta1/tobiko_webhook.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,10 @@ func (r *Tobiko) ValidateCreate() (admission.Warnings, error) {
8989
}, r.GetName(), allErrs)
9090
}
9191

92+
if r.Spec.Privileged && len(r.Spec.Workflow) > 0 && len(r.Spec.SELinuxLevel) == 0 {
93+
allWarnings = append(allWarnings, fmt.Sprintf(WarnSELinuxLevel, r.Kind))
94+
}
95+
9296
return allWarnings, nil
9397
}
9498

‎api/v1beta1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/test.openstack.org_ansibletests.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ spec:
4343
spec:
4444
description: AnsibleTestSpec defines the desired state of AnsibleTest
4545
properties:
46+
SELinuxLevel:
47+
default: ""
48+
description: A SELinuxLevel that should be used for test pods spawned
49+
by the test operator.
50+
type: string
4651
ansibleCollections:
4752
default: ""
4853
description: AnsibleCollections - extra ansible collections to instal
@@ -191,6 +196,10 @@ spec:
191196
description: A parameter that contains a workflow definition.
192197
items:
193198
properties:
199+
SELinuxLevel:
200+
description: A SELinuxLevel that should be used for test pods
201+
spawned by the test operator.
202+
type: string
194203
ansibleCollections:
195204
description: AnsibleCollections - extra ansible collections
196205
to instal in additionn to the ones exist in the requirements.yaml

‎config/crd/bases/test.openstack.org_horizontests.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ spec:
4343
spec:
4444
description: HorizonTestSpec defines the desired state of HorizonTest
4545
properties:
46+
SELinuxLevel:
47+
default: ""
48+
description: A SELinuxLevel that should be used for test pods spawned
49+
by the test operator.
50+
type: string
4651
adminPassword:
4752
default: admin
4853
description: AdminPassword is the password for the OpenStack admin

‎config/crd/bases/test.openstack.org_tempests.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ spec:
4646
see TempestconfRunSpec.
4747
properties:
4848
SELinuxLevel:
49-
default: s0:c478,c978
50-
description: A SELinuxLevel that is used for all the tempest test
51-
pods.
49+
default: ""
50+
description: A SELinuxLevel that should be used for test pods spawned
51+
by the test operator.
5252
type: string
5353
SSHKeySecretName:
5454
default: ""
@@ -490,6 +490,10 @@ spec:
490490
For specific configuration of tempest see TempestRunSpec and for
491491
discover-tempest-config see TempestconfRunSpec.
492492
properties:
493+
SELinuxLevel:
494+
description: A SELinuxLevel that should be used for test pods
495+
spawned by the test operator.
496+
type: string
493497
SSHKeySecretName:
494498
description: SSHKeySecretName is the name of the k8s secret
495499
that contains an ssh key. The key is mounted to ~/.ssh/id_ecdsa

‎config/crd/bases/test.openstack.org_tobikoes.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ spec:
4343
spec:
4444
description: TobikoSpec defines the desired state of Tobiko
4545
properties:
46+
SELinuxLevel:
47+
default: ""
48+
description: A SELinuxLevel that should be used for test pods spawned
49+
by the test operator.
50+
type: string
4651
backoffLimit:
4752
default: 0
4853
description: BackoffLimit allows to define the maximum number of retried
@@ -202,6 +207,10 @@ spec:
202207
description: A parameter that contains a workflow definition.
203208
items:
204209
properties:
210+
SELinuxLevel:
211+
description: A SELinuxLevel that should be used for test pods
212+
spawned by the test operator.
213+
type: string
205214
backoffLimit:
206215
default: 0
207216
description: BackoffLimit allows to define the maximum number

0 commit comments

Comments
 (0)