NO-ISSUE: Enabled readonlyRootFilesystem by default #3614
Conversation
openshift-ci
bot
added
the
needs-ok-to-test
|
Hi @dusk125. Thanks for your PR. I'm waiting for a operator-framework member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/ok-to-test |
openshift-ci
bot
added
ok-to-test
|
/approve |
openshift-ci
bot
added
the
approved
|
@dusk125 - this seems to be failing all our tests... |
|
/lgtm |
|
/lgtm |
| }) | ||
|
|
||
| pod.Spec.Containers[0].SecurityContext.ReadOnlyRootFilesystem = ptr.To(true) |
There was a problem hiding this comment.
Just to confirm, if grpcPodConfig.ExtractContent == nil, then pod.Spec.Containers[0].SecurityContext.ReadOnlyRootFilesystem will be set to false. Is that the expected behavior? Thanks!
There was a problem hiding this comment.
Correct. If we're using extractContent, then we are pulling out the catalog+cache and running it in a catalogsource using an in-cluster opm version.
If we're not using extractContent, then we're "just running an arbitrary pod", which is expected to speak GRPC on port 50051.
There was a problem hiding this comment.
Thanks for the confirmation! I have one more question—if we don’t use extractContent, the command running in the Pod is /bin/opm serve /configs --cache-dir=/tmp/cache, which requires readOnlyRootFilesystem: false. However, I believe mounting /tmp as a volume should also work if we set readOnlyRootFilesystem: true. So, my question is: why not set readOnlyRootFilesystem: true when extractContent is not used? Or am I missing something? Thanks!
|
go version has not changed as a result of this PR, but the go-verdiff assesses any delta between this PR and its destination branch (master). I'll override. /lgtm |
|
/label override-go-verdiff |
|
@grokspawn: The label(s) In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: grokspawn, tmshort The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit 77ae211
into
operator-framework:master
Description of the change:
Enforce readOnlyRootFilesystem: true for enhanced security (and provide brief justification for false exceptions)
Motivation for the change:
Reviewer Checklist