Add policy to check for scratch images running privileged

[hbrueckner]

The policy for scratch container images includes the check for RunAsNonRoot and does not consider the privileged setting in the container project. This PR is about to introduce a scratch container image policy to consider running privileged containers.

This PR arises from discussions on the RH support case 03250672 which triggered issue #766.

Testing the latest preflight (main branch) with issue #766 corrected, solved the parsing problem but introduced the RunAsNonRoot check again as part of the scratch policy. In preflight v1.4.0, the check has been skipped based on the project setting. This behavior might have been introduced by PR #776 which correctly detects scratch images.

Signed-off-by: Hendrik Brueckner brueckner@linux.ibm.com

[openshift-ci]

Hi @hbrueckner. Thanks for your PR.

I'm waiting for a redhat-openshift-ecosystem member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dcibot]

• FAILURE https://www.distributed-ci.io/jobs/367dbd04-253f-451c-994c-47a75722b71e/jobStates
  from Add policy to check for scratch images running privileged #779

[komish]

/ok-to-test

Thanks @hbrueckner! I'll start tests here for now, I have a few nits I'll throw into a review soon.

[acornett21]

I don't think we have ever supported this use case, we'll check with the business to see if we should support it going forward.

[dcibot]

• SUCCESS https://www.distributed-ci.io/jobs/263cc459-3e7a-459c-b2fd-9b37e59c0648/jobStates
  from Add policy to check for scratch images running privileged #779

[dcibot]

• SUCCESS https://www.distributed-ci.io/jobs/cad70e65-9b0e-41e7-8a95-a8f2a96dc390/jobStates
  from Add policy to check for scratch images running privileged #779

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hbrueckner
Once this PR has been reviewed and has the lgtm label, please assign skattoju for approval by writing /assign @skattoju in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dcibot]

• SUCCESS https://www.distributed-ci.io/jobs/a57473e1-9f0c-4f25-b8c0-eb9366f7ed22/jobStates
  from Add policy to check for scratch images running privileged #779

[acornett21]

/ok-to-test

[dcibot]

• FAILURE https://www.distributed-ci.io/jobs/4298bdeb-861f-474a-a025-95f851724aad/jobStates
  from Add policy to check for scratch images running privileged #779

[acornett21]

/ok-to-test

[dcibot]

• SUCCESS https://www.distributed-ci.io/jobs/7fc6d563-8cc3-4f7e-878a-d7248384e88e/jobStates
  from Add policy to check for scratch images running privileged #779

[openshift-merge-robot]

@hbrueckner: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[komish]

We very much appreciate the contributions here, but we've not heard any confirmation from the Certification policy makers that this combination needs to be handled within Preflight. For now, we'll mark this closed. If the policy stance changes, we'll revisit then.

[hbrueckner]

This PR could help to solve RH support ticket #03678508

cc: @jfrancin

[hbrueckner]

/reopen

Rebased my branch to latest main: https://github.com/hbrueckner/openshift-preflight/tree/pr-scratch-privileged

[openshift-ci]

@hbrueckner: Failed to re-open PR: state cannot be changed. The pr-scratch-privileged branch was force-pushed or recreated.

In response to this:

/reopen

Rebased my branch to latest main: https://github.com/hbrueckner/openshift-preflight/tree/pr-scratch-privileged

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jfrancin]

I'd absolutely like to see this moved forward. Preflight needs to properly handle the situation where a container is privileged but is also 'scratch'.