From 9c4a96ba845e6192676b4fbece33fd39f8d7e520 Mon Sep 17 00:00:00 2001 From: Zhiwei Yin Date: Mon, 19 Apr 2021 19:07:51 +0800 Subject: [PATCH] run as non-root Signed-off-by: Zhiwei Yin --- Dockerfile | 4 ++ .../config/operator/operator.yaml | 7 ++++ ...cluster-manager.clusterserviceversion.yaml | 7 ++++ ...uster-manager-registration-deployment.yaml | 7 ++++ ...nager-registration-webhook-deployment.yaml | 7 ++++ ...uster-manager-work-webhook-deployment.yaml | 7 ++++ .../klusterlet-registration-deployment.yaml | 7 ++++ .../klusterlet-work-deployment.yaml | 7 ++++ .../clustermanager/bindata/bindata.go | 21 ++++++++++ pkg/operators/klusterlet/bindata/bindata.go | 14 +++++++ test/e2e/common.go | 40 ++++++------------- test/e2e/klusterlet_test.go | 6 +-- 12 files changed, 101 insertions(+), 33 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6bb285de4..83fde1252 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,5 +5,9 @@ ENV GO_PACKAGE github.com/open-cluster-management/registration-operator RUN make build --warn-undefined-variables FROM registry.access.redhat.com/ubi8/ubi-minimal:latest +ENV USER_UID=10001 + COPY --from=builder /go/src/github.com/open-cluster-management/registration-operator/registration-operator / RUN microdnf update && microdnf clean all + +USER ${USER_UID} diff --git a/deploy/cluster-manager/config/operator/operator.yaml b/deploy/cluster-manager/config/operator/operator.yaml index db501bea2..679e45e7f 100644 --- a/deploy/cluster-manager/config/operator/operator.yaml +++ b/deploy/cluster-manager/config/operator/operator.yaml @@ -43,6 +43,13 @@ spec: args: - "/registration-operator" - "hub" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true livenessProbe: httpGet: path: /healthz diff --git a/deploy/cluster-manager/olm-catalog/cluster-manager/manifests/cluster-manager.clusterserviceversion.yaml b/deploy/cluster-manager/olm-catalog/cluster-manager/manifests/cluster-manager.clusterserviceversion.yaml index ff9447829..7fee19833 100644 --- a/deploy/cluster-manager/olm-catalog/cluster-manager/manifests/cluster-manager.clusterserviceversion.yaml +++ b/deploy/cluster-manager/olm-catalog/cluster-manager/manifests/cluster-manager.clusterserviceversion.yaml @@ -258,6 +258,13 @@ spec: requests: cpu: 100m memory: 128Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true serviceAccountName: cluster-manager strategy: deployment installModes: diff --git a/manifests/cluster-manager/cluster-manager-registration-deployment.yaml b/manifests/cluster-manager/cluster-manager-registration-deployment.yaml index b80fa4d19..e65250e37 100644 --- a/manifests/cluster-manager/cluster-manager-registration-deployment.yaml +++ b/manifests/cluster-manager/cluster-manager-registration-deployment.yaml @@ -43,6 +43,13 @@ spec: args: - "/registration" - "controller" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true livenessProbe: httpGet: path: /healthz diff --git a/manifests/cluster-manager/cluster-manager-registration-webhook-deployment.yaml b/manifests/cluster-manager/cluster-manager-registration-webhook-deployment.yaml index 42ed2a798..6ea871e42 100644 --- a/manifests/cluster-manager/cluster-manager-registration-webhook-deployment.yaml +++ b/manifests/cluster-manager/cluster-manager-registration-webhook-deployment.yaml @@ -46,6 +46,13 @@ spec: - "--secure-port=6443" - "--tls-cert-file=/serving-cert/tls.crt" - "--tls-private-key-file=/serving-cert/tls.key" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true livenessProbe: httpGet: path: /healthz diff --git a/manifests/cluster-manager/cluster-manager-work-webhook-deployment.yaml b/manifests/cluster-manager/cluster-manager-work-webhook-deployment.yaml index 9b64a638c..dcbf56c6c 100644 --- a/manifests/cluster-manager/cluster-manager-work-webhook-deployment.yaml +++ b/manifests/cluster-manager/cluster-manager-work-webhook-deployment.yaml @@ -46,6 +46,13 @@ spec: - "--secure-port=6443" - "--tls-cert-file=/serving-cert/tls.crt" - "--tls-private-key-file=/serving-cert/tls.key" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true livenessProbe: httpGet: path: /healthz diff --git a/manifests/klusterlet/klusterlet-registration-deployment.yaml b/manifests/klusterlet/klusterlet-registration-deployment.yaml index fb5ea49e4..44ecf80ed 100644 --- a/manifests/klusterlet/klusterlet-registration-deployment.yaml +++ b/manifests/klusterlet/klusterlet-registration-deployment.yaml @@ -49,6 +49,13 @@ spec: {{if .ExternalServerURL}} - "--spoke-external-server-urls={{ .ExternalServerURL }}" {{end}} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true volumeMounts: - name: bootstrap-secret mountPath: "/spoke/bootstrap" diff --git a/manifests/klusterlet/klusterlet-work-deployment.yaml b/manifests/klusterlet/klusterlet-work-deployment.yaml index 40f016123..3bc8304be 100644 --- a/manifests/klusterlet/klusterlet-work-deployment.yaml +++ b/manifests/klusterlet/klusterlet-work-deployment.yaml @@ -45,6 +45,13 @@ spec: - "agent" - "--spoke-cluster-name={{ .ClusterName }}" - "--hub-kubeconfig=/spoke/hub-kubeconfig/kubeconfig" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true volumeMounts: - name: hub-kubeconfig-secret mountPath: "/spoke/hub-kubeconfig" diff --git a/pkg/operators/clustermanager/bindata/bindata.go b/pkg/operators/clustermanager/bindata/bindata.go index 892d46e75..bd6e0c7ce 100644 --- a/pkg/operators/clustermanager/bindata/bindata.go +++ b/pkg/operators/clustermanager/bindata/bindata.go @@ -1419,6 +1419,13 @@ spec: args: - "/registration" - "controller" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true livenessProbe: httpGet: path: /healthz @@ -1655,6 +1662,13 @@ spec: - "--secure-port=6443" - "--tls-cert-file=/serving-cert/tls.crt" - "--tls-private-key-file=/serving-cert/tls.key" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true livenessProbe: httpGet: path: /healthz @@ -1971,6 +1985,13 @@ spec: - "--secure-port=6443" - "--tls-cert-file=/serving-cert/tls.crt" - "--tls-private-key-file=/serving-cert/tls.key" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true livenessProbe: httpGet: path: /healthz diff --git a/pkg/operators/klusterlet/bindata/bindata.go b/pkg/operators/klusterlet/bindata/bindata.go index 29018ba57..34aa5a037 100644 --- a/pkg/operators/klusterlet/bindata/bindata.go +++ b/pkg/operators/klusterlet/bindata/bindata.go @@ -575,6 +575,13 @@ spec: {{if .ExternalServerURL}} - "--spoke-external-server-urls={{ .ExternalServerURL }}" {{end}} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true volumeMounts: - name: bootstrap-secret mountPath: "/spoke/bootstrap" @@ -869,6 +876,13 @@ spec: - "agent" - "--spoke-cluster-name={{ .ClusterName }}" - "--hub-kubeconfig=/spoke/hub-kubeconfig/kubeconfig" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsNonRoot: true volumeMounts: - name: hub-kubeconfig-secret mountPath: "/spoke/hub-kubeconfig" diff --git a/test/e2e/common.go b/test/e2e/common.go index 2ec1b1f72..4ed5a9638 100644 --- a/test/e2e/common.go +++ b/test/e2e/common.go @@ -6,6 +6,7 @@ import ( "fmt" "io" "os" + "strings" "time" "k8s.io/klog/v2" @@ -408,39 +409,22 @@ func (t *Tester) CheckKlusterletOperatorReady() error { return err } -func (t *Tester) GetClusterNameFromKlusterlet(klusterletName string) (string, error) { - if klusterletName == "" { - return "", fmt.Errorf("the klusterlet name should not be null") - } - - klusterlet, err := t.OperatorClient.OperatorV1().Klusterlets().Get(context.TODO(), - klusterletName, metav1.GetOptions{}) +// GetRandomClusterName gets the clusterName generated by registration randomly. +// the cluster name is the random name if it has not prefix "e2e-". +// TODO: get random cluster name from event +func (t *Tester) GetRandomClusterName() (string, error) { + managedClusterList, err := t.ClusterClient.ClusterV1().ManagedClusters().List(context.TODO(), metav1.ListOptions{}) if err != nil { return "", err } - clusterName := klusterlet.Spec.ClusterName - if clusterName != "" { - return clusterName, nil + for _, managedCluster := range managedClusterList.Items { + clusterName := managedCluster.Name + if !strings.HasPrefix(clusterName, "e2e-") { + return clusterName, nil + } } - - klusterletNamespace := klusterlet.Spec.Namespace - if klusterletNamespace == "" { - klusterletNamespace = helpers.KlusterletDefaultNamespace - } - - hubKubeconfigSecret, err := t.KubeClient.CoreV1().Secrets(klusterletNamespace).Get(context.TODO(), - "hub-kubeconfig-secret", metav1.GetOptions{}) - if err != nil { - return "", err - } - - clusterNameByte, ok := hubKubeconfigSecret.Data["cluster-name"] - if !ok { - return "", fmt.Errorf("there is no cluster-name in secret, %+v", hubKubeconfigSecret) - } - - return string(clusterNameByte), nil + return "", fmt.Errorf("there is no managedCluster with the random name") } // TODO: only output the details of created resources during e2e diff --git a/test/e2e/klusterlet_test.go b/test/e2e/klusterlet_test.go index 096e80b2d..47432371e 100644 --- a/test/e2e/klusterlet_test.go +++ b/test/e2e/klusterlet_test.go @@ -61,11 +61,7 @@ var _ = Describe("Create klusterlet CR", func() { By("waiting for the managed cluster to be created") Eventually(func() error { - clusterName, err = t.GetClusterNameFromKlusterlet(klusterletName) - if err != nil { - return err - } - _, err = t.GetCreatedManagedCluster(clusterName) + clusterName, err = t.GetRandomClusterName() return err }, t.EventuallyTimeout*5, t.EventuallyInterval*5).Should(Succeed())