github/open-cluster-management
1
0
Fork 0
mirror of https://github.com/open-cluster-management-io/ocm.git synced 2026-08-23 22:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

run as non-root

Browse Source 
Signed-off-by: Zhiwei Yin <zyin@redhat.com>
This commit is contained in:
Zhiwei Yin
2021-04-19 21:19:07 +08:00
parent 6fe5197ead
commit 9c4a96ba84
12 changed files with 101 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+4
View File
@@ -5,5 +5,9 @@ ENV GO_PACKAGE github.com/open-cluster-management/registration-operator
RUN make build --warn-undefined-variables
FROM registry.access.redhat.com/ubi8/ubi-minimal:latest
ENV USER_UID=10001
COPY --from=builder /go/src/github.com/open-cluster-management/registration-operator/registration-operator /
RUN microdnf update && microdnf clean all
USER ${USER_UID}
deploy/cluster-manager/config/operator/operator.yaml
+7
View File
@@ -43,6 +43,13 @@ spec:
args:
- "/registration-operator"
- "hub"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
livenessProbe:
httpGet:
path: /healthz
deploy/cluster-manager/olm-catalog/cluster-manager/manifests/cluster-manager.clusterserviceversion.yaml
+7
View File
@@ -258,6 +258,13 @@ spec:
requests:
cpu: 100m
memory: 128Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
serviceAccountName: cluster-manager
strategy: deployment
installModes:
manifests/cluster-manager/cluster-manager-registration-deployment.yaml
+7
View File
@@ -43,6 +43,13 @@ spec:
args:
- "/registration"
- "controller"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
livenessProbe:
httpGet:
path: /healthz
manifests/cluster-manager/cluster-manager-registration-webhook-deployment.yaml
+7
View File
@@ -46,6 +46,13 @@ spec:
- "--secure-port=6443"
- "--tls-cert-file=/serving-cert/tls.crt"
- "--tls-private-key-file=/serving-cert/tls.key"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
livenessProbe:
httpGet:
path: /healthz
manifests/cluster-manager/cluster-manager-work-webhook-deployment.yaml
+7
View File
@@ -46,6 +46,13 @@ spec:
- "--secure-port=6443"
- "--tls-cert-file=/serving-cert/tls.crt"
- "--tls-private-key-file=/serving-cert/tls.key"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
livenessProbe:
httpGet:
path: /healthz
manifests/klusterlet/klusterlet-registration-deployment.yaml
+7
View File
@@ -49,6 +49,13 @@ spec:
{{if .ExternalServerURL}}
- "--spoke-external-server-urls={{ .ExternalServerURL }}"
{{end}}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
volumeMounts:
- name: bootstrap-secret
mountPath: "/spoke/bootstrap"
manifests/klusterlet/klusterlet-work-deployment.yaml
+7
View File
@@ -45,6 +45,13 @@ spec:
- "agent"
- "--spoke-cluster-name={{ .ClusterName }}"
- "--hub-kubeconfig=/spoke/hub-kubeconfig/kubeconfig"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
volumeMounts:
- name: hub-kubeconfig-secret
mountPath: "/spoke/hub-kubeconfig"
pkg/operators/clustermanager/bindata/bindata.go
+21
View File
@@ -1419,6 +1419,13 @@ spec:
args:
- "/registration"
- "controller"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
livenessProbe:
httpGet:
path: /healthz
@@ -1655,6 +1662,13 @@ spec:
- "--secure-port=6443"
- "--tls-cert-file=/serving-cert/tls.crt"
- "--tls-private-key-file=/serving-cert/tls.key"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
livenessProbe:
httpGet:
path: /healthz
@@ -1971,6 +1985,13 @@ spec:
- "--secure-port=6443"
- "--tls-cert-file=/serving-cert/tls.crt"
- "--tls-private-key-file=/serving-cert/tls.key"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
livenessProbe:
httpGet:
path: /healthz
pkg/operators/klusterlet/bindata/bindata.go
+14
View File
@@ -575,6 +575,13 @@ spec:
{{if .ExternalServerURL}}
- "--spoke-external-server-urls={{ .ExternalServerURL }}"
{{end}}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
volumeMounts:
- name: bootstrap-secret
mountPath: "/spoke/bootstrap"
@@ -869,6 +876,13 @@ spec:
- "agent"
- "--spoke-cluster-name={{ .ClusterName }}"
- "--hub-kubeconfig=/spoke/hub-kubeconfig/kubeconfig"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
volumeMounts:
- name: hub-kubeconfig-secret
mountPath: "/spoke/hub-kubeconfig"
test/e2e/common.go
+12 -28
View File
@@ -6,6 +6,7 @@ import (
"fmt"
"io"
"os"
"strings"
"time"
"k8s.io/klog/v2"
@@ -408,39 +409,22 @@ func (t *Tester) CheckKlusterletOperatorReady() error {
return err
}
func (t *Tester) GetClusterNameFromKlusterlet(klusterletName string) (string, error) {
if klusterletName == "" {
return "", fmt.Errorf("the klusterlet name should not be null")
}
klusterlet, err := t.OperatorClient.OperatorV1().Klusterlets().Get(context.TODO(),
klusterletName, metav1.GetOptions{})
// GetRandomClusterName gets the clusterName generated by registration randomly.
// the cluster name is the random name if it has not prefix "e2e-".
// TODO: get random cluster name from event
func (t *Tester) GetRandomClusterName() (string, error) {
managedClusterList, err := t.ClusterClient.ClusterV1().ManagedClusters().List(context.TODO(), metav1.ListOptions{})
if err != nil {
return "", err
}
clusterName := klusterlet.Spec.ClusterName
if clusterName != "" {
return clusterName, nil
for _, managedCluster := range managedClusterList.Items {
clusterName := managedCluster.Name
if !strings.HasPrefix(clusterName, "e2e-") {
return clusterName, nil
}
}
klusterletNamespace := klusterlet.Spec.Namespace
if klusterletNamespace == "" {
klusterletNamespace = helpers.KlusterletDefaultNamespace
}
hubKubeconfigSecret, err := t.KubeClient.CoreV1().Secrets(klusterletNamespace).Get(context.TODO(),
"hub-kubeconfig-secret", metav1.GetOptions{})
if err != nil {
return "", err
}
clusterNameByte, ok := hubKubeconfigSecret.Data["cluster-name"]
if !ok {
return "", fmt.Errorf("there is no cluster-name in secret, %+v", hubKubeconfigSecret)
}
return string(clusterNameByte), nil
return "", fmt.Errorf("there is no managedCluster with the random name")
}
// TODO: only output the details of created resources during e2e
test/e2e/klusterlet_test.go
+1 -5
View File
@@ -61,11 +61,7 @@ var _ = Describe("Create klusterlet CR", func() {
By("waiting for the managed cluster to be created")
Eventually(func() error {
clusterName, err = t.GetClusterNameFromKlusterlet(klusterletName)
if err != nil {
return err
}
_, err = t.GetCreatedManagedCluster(clusterName)
clusterName, err = t.GetRandomClusterName()
return err
}, t.EventuallyTimeout*5, t.EventuallyInterval*5).Should(Succeed())