Psa downstream #349
Merged
Psa downstream #349
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
openshift-ci
bot
added
the
approved
* (psa) make workloads compatible with psa:restricted profile With the introduction of [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces), the reccomeneded best practice is to enforce the Restricted policy of admission (see [1] for more details). This PR *) Lables the olm namespace as `enforce:restricted` *) Labels the operators namespace as `enforce:baseline` (to allow existing CSV deployments without securityContext set to deploy in the namespace, which won't be possible with `enforce:resticted`) *) updates the securityContext of olm workload pods(olm-operator, catalog-operator, and CatalogSource registry pods) to adhere to the `Restricted` policy. *) updates the bundle unpacking job to create a pod that adheres to the `Restricted` policy, so that bundles can be unpacked in the `Restricted` namespace. Signed-off-by: Anik Bhattacharjee <anikbhattacharya93@gmail.com> * (flaky text fix): GC CSV with wrong namespace annotation The test was modifying the `olm.operatornamespace` to an incorrect value, and checking to make sure that the CSV was garbage collected as a result. However, the olm-controller was copying a fresh copy back into the namespace, so whenever the test was able to get a yes reply to the question "is the CSV gone", in the brief window before it was copied back again, the test was passing. This commit fixes that by making sure that if find a CSV that we expected to be garbage collected, it passes if it determines that the CSV is a fresh copy, and not the one modified before. Signed-off-by: Anik Bhattacharjee <anikbhattacharya93@gmail.com> Upstream-commit: 67177c0c822fbe7d554669262c6b4f54bebad17f Upstream-repository: operator-lifecycle-manager
anik120
force-pushed
the
psa-downstream
branch
2 times, most recently
from
5344ff4
to
d6db602
Compare
timflannagan
approved these changes
Aug 9, 2022
Closed
|
/test e2e-gcp-olm |
|
Looks like b2b test case failures. /hold |
openshift-ci
bot
added
the
do-not-merge/hold
|
That's strange, looks like the test |
|
Found the problem, garbage collection is working "too well" in gcp compared to kind/aws, highlighting an error in logic. Fix posted in operator-framework/operator-lifecycle-manager#2837, once that merges will pull that commit in this PR |
anik120
force-pushed
the
psa-downstream
branch
from
d6db602
to
8eb5768
Compare
smh. /retest |
This PR: * introduces a chart value that decides if the --set-workload-user-id flag to true or false for the catalog-operator container * introduces chart values to fill in the psa enforce level/version for the namespaces Closes #2827 Signed-off-by: Anik Bhattacharjee <anikbhattacharya93@gmail.com> Upstream-commit: f982e2fbeecfcb917665ed760363326e313b2967 Upstream-repository: operator-lifecycle-manager
In the test `Operator Group cleanup csvs with bad namespace annotation`, the polling logic that updates a copied csv with a bad annotation was checking to see if the update was successful. However, once the copied csv is given a bad annotation, the CSV is GC'd, and if the collection happens immediately, the polling logic fails. This fix removes the logic that attempts to check the updated CSV, and instead relies on the updateErr being nil to assert that the update was successful. Signed-off-by: Anik Bhattacharjee <anikbhattacharya93@gmail.com> Signed-off-by: Anik Bhattacharjee <anikbhattacharya93@gmail.com> Upstream-commit: e08415d1228d095d0238dcf7264d3b70464e805b Upstream-repository: operator-lifecycle-manager
anik120
force-pushed
the
psa-downstream
branch
from
8eb5768
to
462a0c8
Compare
|
/test unit-olm |
|
/test e2e-gcp-olm |
|
c'mon man |
|
@anik120: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
@timflannagan would you do the honors please 🥲 |
timflannagan
approved these changes
Aug 11, 2022
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: anik120, timflannagan The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
anik120
added a commit
to anik120/operator-marketplace
that referenced
this pull request
Aug 16, 2022
This PR removes the PSA baseline enforcement for workloads in the openshift-marketplace namespace, so that the default restricted profile can be enforced by default like other openshift-* namespaces. This is possible due to the changes in openshift/operator-framework-olm#349
5 tasks
openshift-bot
pushed a commit
to openshift-bot/operator-framework-olm
that referenced
this pull request
Sep 13, 2024
* `functionalities` param is no longer exist. It was used to enable file fixes to ignore common lines from coverage. This feature is now seems to be on by default. * Adding `disable_search` because we do not need for the codecov action to search for coverage files: we explicitly provide files. Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> Upstream-repository: api Upstream-commit: ce8a923541376d7e7907af90f6c91ff3abafd2f5
openshift-bot
pushed a commit
to openshift-bot/operator-framework-olm
that referenced
this pull request
Sep 21, 2024
* `functionalities` param is no longer exist. It was used to enable file fixes to ignore common lines from coverage. This feature is now seems to be on by default. * Adding `disable_search` because we do not need for the codecov action to search for coverage files: we explicitly provide files. Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> Upstream-repository: api Upstream-commit: ce8a923541376d7e7907af90f6c91ff3abafd2f5
openshift-bot
pushed a commit
to openshift-bot/operator-framework-olm
that referenced
this pull request
Sep 25, 2024
* `functionalities` param is no longer exist. It was used to enable file fixes to ignore common lines from coverage. This feature is now seems to be on by default. * Adding `disable_search` because we do not need for the codecov action to search for coverage files: we explicitly provide files. Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> Upstream-repository: api Upstream-commit: ce8a923541376d7e7907af90f6c91ff3abafd2f5
openshift-bot
pushed a commit
to openshift-bot/operator-framework-olm
that referenced
this pull request
Sep 26, 2024
* `functionalities` param is no longer exist. It was used to enable file fixes to ignore common lines from coverage. This feature is now seems to be on by default. * Adding `disable_search` because we do not need for the codecov action to search for coverage files: we explicitly provide files. Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> Upstream-repository: api Upstream-commit: ce8a923541376d7e7907af90f6c91ff3abafd2f5
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Namespace currently look like:
Notice the
baselineprofile enforced inopenshift-operatorsnamespace, to allow exsiting CSVs to install ☝🏽.Workloads all working seamlessly with the right securityContext configs:
Test to make sure installing operator in the
openshift-operatornamespace works as expected:openshift-operatorsnamespace)