Configure the default local seccomp profile according to the runtime

bundle/manifests/security-profiles-operator.clusterserviceversion.yaml

@@ -434,6 +434,10 @@ spec:
                   valueFrom:
                     fieldRef:
                       fieldPath: metadata.namespace
+                - name: NODE_NAME
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: spec.nodeName
                 image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
                 imagePullPolicy: Always
                 name: security-profiles-operator

cmd/security-profiles-operator/main.go

@@ -190,6 +190,14 @@ func main() {
 			Action: func(ctx *cli.Context) error {
 				return runNonRootEnabler(ctx, info)
 			},
+			Flags: []cli.Flag{
+				&cli.StringFlag{
+					Name:    "runtime",
+					Aliases: []string{"r"},
+					Value:   "",
+					Usage:   "the container runtime in the cluster (values: cri-o, containerd, docker)",
+				},
+			},
 		},
 		&cli.Command{
 			Before:  initialize,
@@ -484,10 +492,11 @@ func runLogEnricher(_ *cli.Context, info *version.Info) error {
 	return e.Run()
 }
 
-func runNonRootEnabler(_ *cli.Context, info *version.Info) error {
+func runNonRootEnabler(ctx *cli.Context, info *version.Info) error {
 	const component = "non-root-enabler"
 	printInfo(component, info)
-	return nonrootenabler.New().Run(ctrl.Log.WithName(component))
+	runtime := ctx.String("runtime")
+	return nonrootenabler.New().Run(ctrl.Log.WithName(component), runtime)
 }
 
 func runWebhook(ctx *cli.Context, info *version.Info) error {

deploy/kustomize-deployment/manager_deployment.yaml

@@ -42,6 +42,10 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
       tolerations:
         - key: "node-role.kubernetes.io/master"
           operator: "Exists"

deploy/namespace-operator.yaml

@@ -2963,6 +2963,10 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator

deploy/openshift-dev.yaml

@@ -2961,6 +2961,10 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
         image: image-registry.openshift-image-registry.svc:5000/openshift/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator

deploy/operator.yaml

@@ -2961,6 +2961,10 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator

deploy/webhook-operator.yaml

@@ -2961,6 +2961,10 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator

internal/pkg/manager/spod/bindata/spod.go

@@ -45,7 +45,7 @@ var (
 	metricsCertPath                 = "/var/run/secrets/metrics"
 	metricsServerCert               = "metrics-server-cert"
 	openshiftCertAnnotation         = "service.beta.openshift.io/serving-cert-secret-name"
-	localSeccompProfilePath         = "security-profiles-operator.json"
+	localSeccompProfilePath         = LocalSeccompProfilePath
 )
 
 const (
@@ -64,6 +64,7 @@ const (
 	ContainerIDMetrics                         = 4
 	DefaultHostProcPath                        = "/proc"
 	MetricsContainerName                       = "metrics"
+	LocalSeccompProfilePath                    = "security-profiles-operator.json"
 )
 
 var DefaultSPOD = &spodv1alpha1.SecurityProfilesOperatorDaemon{

internal/pkg/manager/spod/setup.go

@@ -27,13 +27,15 @@ import (
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
 	spodv1alpha1 "sigs.k8s.io/security-profiles-operator/api/spod/v1alpha1"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/daemon/metrics"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/manager/spod/bindata"
+	"sigs.k8s.io/security-profiles-operator/internal/pkg/util"
 )
 
 // CtxKey type for spod context keys.
@@ -49,10 +51,12 @@ const (
 // daemonTunables defines the parameters to tune/modify for the
 // Security-Profiles-Operator-Daemon.
 type daemonTunables struct {
-	selinuxdImage    string
-	rbacProxyImage   string
-	logEnricherImage string
-	watchNamespace   string
+	selinuxdImage           string
+	rbacProxyImage          string
+	logEnricherImage        string
+	watchNamespace          string
+	seccompLocalhostProfile string
+	containerRuntime        string
 }
 
 // Setup adds a controller that reconciles the SPOd DaemonSet.
@@ -64,8 +68,9 @@ func (r *ReconcileSPOd) Setup(
 	r.client = mgr.GetClient()
 	r.log = ctrl.Log.WithName(r.Name())
 	r.record = mgr.GetEventRecorderFor(r.Name())
+	r.clientReader = mgr.GetAPIReader()
 
-	dt, err := getTunables()
+	dt, err := r.getTunables(ctx)
 	if err != nil {
 		return fmt.Errorf("get tunables: %w", err)
 	}
@@ -114,7 +119,7 @@ func isStaticWebhook(ctx context.Context) bool {
 	return false
 }
 
-func getTunables() (*daemonTunables, error) {
+func (r *ReconcileSPOd) getTunables(ctx context.Context) (*daemonTunables, error) {
 	dt := &daemonTunables{}
 	dt.watchNamespace = os.Getenv(config.RestrictNamespaceEnvKey)
 
@@ -129,6 +134,19 @@ func getTunables() (*daemonTunables, error) {
 		return dt, errors.New("invalid rbac proxy image")
 	}
 	dt.rbacProxyImage = rbacProxyImage
+
+	node := &corev1.Node{}
+	nodeName := os.Getenv(config.NodeNameEnvKey)
+	if nodeName != "" {
+		objectKey := client.ObjectKey{Name: nodeName}
+		err := r.clientReader.Get(ctx, objectKey, node)
+		if err != nil {
+			return dt, fmt.Errorf("getting cluster node object: %w", err)
+		}
+	}
+	dt.seccompLocalhostProfile = util.GetSeccompLocalhostProfilePath(node)
+	dt.containerRuntime = util.GetContainerRuntime(node)
+
 	return dt, nil
 }
 
@@ -143,6 +161,12 @@ func getEffectiveSPOd(dt *daemonTunables) *appsv1.DaemonSet {
 			Value: dt.watchNamespace,
 		})
 	}
+	if dt.seccompLocalhostProfile != "" {
+		daemon.SecurityContext.SeccompProfile.LocalhostProfile = &dt.seccompLocalhostProfile
+	}
+
+	nonRootEnabler := &refSPOd.Spec.Template.Spec.InitContainers[0]
+	nonRootEnabler.Args = append(nonRootEnabler.Args, "--runtime="+dt.containerRuntime)
 
 	selinuxd := &refSPOd.Spec.Template.Spec.Containers[1]
 	selinuxd.Image = dt.selinuxdImage

internal/pkg/manager/spod/spod_controller.go

@@ -64,7 +64,10 @@ var _ reconcile.Reconciler = &ReconcileSPOd{}
 type ReconcileSPOd struct {
 	// This client, initialized using mgr.Client() above, is a split client
 	// that reads objects from the cache and writes to the apiserver
-	client         client.Client
+	client client.Client
+	// clientReader reads object directly from api-server, this is useful when
+	// the cache is not ready (e.g. when listing the cluster nodes).
+	clientReader   client.Reader
 	scheme         *runtime.Scheme
 	baseSPOd       *appsv1.DaemonSet
 	record         record.EventRecorder
@@ -116,6 +119,9 @@ func (r *ReconcileSPOd) Healthz(*http.Request) error {
 // OpenShift (This is ignored in other distros):
 // +kubebuilder:rbac:groups=security.openshift.io,namespace="security-profiles-operator",resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups=config.openshift.io,resources=clusteroperators,verbs=get;list;watch
+//
+// Needed to detect which runtime is active
+// +kubebuilder:rbac:groups="",resources=nodes,verbs=get;list;get
 
 // Reconcile reads that state of the cluster for a SPOD object and makes changes based on the state read
 // and what is in the `ConfigMap.Spec`.

internal/pkg/nonrootenabler/nonrootenabler.go

@@ -19,6 +19,7 @@ package nonrootenabler
 import (
 	"fmt"
 	"os"
+	"path"
 
 	"github.com/go-logr/logr"
 	"sigs.k8s.io/release-utils/util"
@@ -43,7 +44,7 @@ func (n *NonRootEnabler) SetImpl(i impl) {
 }
 
 // Run executes the NonRootEnabler and returns an error if anything fails.
-func (n *NonRootEnabler) Run(logger logr.Logger) error {
+func (n *NonRootEnabler) Run(logger logr.Logger, runtime string) error {
 	const dirPermissions os.FileMode = 0o744
 
 	logger.Info("Ensuring seccomp root path: " + config.KubeletSeccompRootPath)
@@ -88,9 +89,13 @@ func (n *NonRootEnabler) Run(logger logr.Logger) error {
 		return fmt.Errorf("change operator root permissions: %w", err)
 	}
 
-	logger.Info("Copying profiles into root path")
+	kubeletSeccompRootPath := config.KubeletSeccompRootPath
+	if runtime == "cri-o" {
+		kubeletSeccompRootPath = path.Join(kubeletSeccompRootPath, "localhost")
+	}
+	logger.Info("Copying profiles into root path: " + kubeletSeccompRootPath)
 	if err := n.impl.CopyDirContentsLocal(
-		"/opt/spo-profiles", config.KubeletSeccompRootPath,
+		"/opt/spo-profiles", kubeletSeccompRootPath,
 	); err != nil {
 		return fmt.Errorf("copy local security profiles: %w", err)
 	}
@@ -111,8 +116,8 @@ type impl interface {
 
 type defaultImpl struct{}
 
-func (*defaultImpl) MkdirAll(path string, perm os.FileMode) error {
-	return os.MkdirAll(path, perm)
+func (*defaultImpl) MkdirAll(dirPath string, perm os.FileMode) error {
+	return os.MkdirAll(dirPath, perm)
 }
 
 func (*defaultImpl) Chmod(name string, perm os.FileMode) error {

internal/pkg/nonrootenabler/nonrootenabler_test.go

@@ -89,7 +89,7 @@ func TestRun(t *testing.T) {
 		tc.prepare(mock)
 		sut.SetImpl(mock)
 
-		err := sut.Run(logr.Discard())
+		err := sut.Run(logr.Discard(), "")
 		if tc.shouldError {
 			require.NotNil(t, err)
 		} else {

internal/pkg/util/kubernetes.go

@@ -0,0 +1,53 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"path"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+
+	"sigs.k8s.io/security-profiles-operator/internal/pkg/manager/spod/bindata"
+)
+
+// GetSeccompLocalhostProfilePath returns the path of local seccomp profile
+// according to the runtime.
+func GetSeccompLocalhostProfilePath(node *corev1.Node) string {
+	containerRuntime := GetContainerRuntime(node)
+	// cri-o expects the local seccomp profile to be prefixed with 'localhost'
+	// see for more details:
+	// https://github.com/cri-o/cri-o/blob/1e6fd9c520d03d47835d1d4c3209e0f77c38f542/internal/config/seccomp/seccomp.go#L240
+	if containerRuntime == "cri-o" {
+		return path.Join("localhost", bindata.LocalSeccompProfilePath)
+	}
+	return bindata.LocalSeccompProfilePath
+}
+
+// GetContainerRuntime parses the container runtime from a node object.
+func GetContainerRuntime(node *corev1.Node) string {
+	if node == nil {
+		return ""
+	}
+	containerRuntimeVersion := node.Status.NodeInfo.ContainerRuntimeVersion
+	parts := strings.Split(containerRuntimeVersion, ":")
+	containerRuntime := ""
+	if len(parts) > 0 {
+		containerRuntime = parts[0]
+	}
+	return containerRuntime
+}