Net 4414 remove anyuid openshift requirement

.changelog/3813.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+control-plane: Remove anyuid Security Context Constraints (SCC) requirement in OpenShift.
+```

acceptance/framework/consul/helm_cluster.go

@@ -526,7 +526,6 @@ func (h *HelmCluster) SetupConsulClient(t *testing.T, secure bool, release ...st
 					require.NoError(r, err)
 				}
 			})
-
 		}
 	}
 
@@ -678,47 +677,40 @@ func configureNamespace(t *testing.T, client kubernetes.Interface, cfg *config.T
 }
 
 // configureSCCs creates RoleBindings that bind the default service account to cluster roles
-// allowing access to the anyuid and privileged Security Context Constraints on OpenShift.
+// allowing access to the privileged Security Context Constraints on OpenShift.
 func configureSCCs(t *testing.T, client kubernetes.Interface, cfg *config.TestConfig, namespace string) {
-	const anyuidClusterRole = "system:openshift:scc:anyuid"
 	const privilegedClusterRole = "system:openshift:scc:privileged"
-	anyuidRoleBinding := "anyuid-test"
 	privilegedRoleBinding := "privileged-test"
 
 	// A role binding to allow default service account in the installation namespace access to the SCCs.
-	{
-		for clusterRoleName, roleBindingName := range map[string]string{anyuidClusterRole: anyuidRoleBinding, privilegedClusterRole: privilegedRoleBinding} {
-			// Check if this cluster role binding already exists.
-			_, err := client.RbacV1().RoleBindings(namespace).Get(context.Background(), roleBindingName, metav1.GetOptions{})
-
-			if errors.IsNotFound(err) {
-				roleBinding := &rbacv1.RoleBinding{
-					ObjectMeta: metav1.ObjectMeta{
-						Name: roleBindingName,
-					},
-					Subjects: []rbacv1.Subject{
-						{
-							Kind:      rbacv1.ServiceAccountKind,
-							Name:      "default",
-							Namespace: namespace,
-						},
-					},
-					RoleRef: rbacv1.RoleRef{
-						Kind: "ClusterRole",
-						Name: clusterRoleName,
-					},
-				}
-
-				_, err = client.RbacV1().RoleBindings(namespace).Create(context.Background(), roleBinding, metav1.CreateOptions{})
-				require.NoError(t, err)
-			} else {
-				require.NoError(t, err)
-			}
+	// Check if this cluster role binding already exists.
+	_, err := client.RbacV1().RoleBindings(namespace).Get(context.Background(), privilegedRoleBinding, metav1.GetOptions{})
+
+	if errors.IsNotFound(err) {
+		roleBinding := &rbacv1.RoleBinding{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: privilegedRoleBinding,
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      rbacv1.ServiceAccountKind,
+					Name:      "default",
+					Namespace: namespace,
+				},
+			},
+			RoleRef: rbacv1.RoleRef{
+				Kind: "ClusterRole",
+				Name: privilegedClusterRole,
+			},
 		}
+
+		_, err = client.RbacV1().RoleBindings(namespace).Create(context.Background(), roleBinding, metav1.CreateOptions{})
+		require.NoError(t, err)
+	} else {
+		require.NoError(t, err)
 	}
 
 	helpers.Cleanup(t, cfg.NoCleanupOnFailure, cfg.NoCleanup, func() {
-		_ = client.RbacV1().RoleBindings(namespace).Delete(context.Background(), anyuidRoleBinding, metav1.DeleteOptions{})
 		_ = client.RbacV1().RoleBindings(namespace).Delete(context.Background(), privilegedRoleBinding, metav1.DeleteOptions{})
 	})
 }

acceptance/tests/api-gateway/api_gateway_kitchen_sink_test.go

@@ -142,6 +142,10 @@ func TestAPIGateway_KitchenSink(t *testing.T) {
 		checkStatusCondition(r, gateway.Status.Conditions, trueCondition("ConsulAccepted", "Accepted"))
 		require.Len(r, gateway.Status.Listeners, 2)
 
+		// http route checks
+		err = k8sClient.Get(context.Background(), types.NamespacedName{Name: "http-route", Namespace: "default"}, &httpRoute)
+		require.NoError(r, err)
+
 		require.EqualValues(r, int32(1), gateway.Status.Listeners[0].AttachedRoutes)
 		checkStatusCondition(r, gateway.Status.Listeners[0].Conditions, trueCondition("Accepted", "Accepted"))
 		checkStatusCondition(r, gateway.Status.Listeners[0].Conditions, falseCondition("Conflicted", "NoConflicts"))
@@ -152,10 +156,6 @@ func TestAPIGateway_KitchenSink(t *testing.T) {
 		// now we know we have an address, set it so we can use it
 		gatewayAddress = gateway.Status.Addresses[0].Value
 
-		// http route checks
-		err = k8sClient.Get(context.Background(), types.NamespacedName{Name: "http-route", Namespace: "default"}, &httpRoute)
-		require.NoError(r, err)
-
 		// check our finalizers
 		require.Len(r, httpRoute.Finalizers, 1)
 		require.EqualValues(r, gatewayFinalizer, httpRoute.Finalizers[0])

acceptance/tests/fixtures/bases/multiport-app/kustomization.yaml

@@ -7,5 +7,4 @@ resources:
   - secret.yaml
   - serviceaccount.yaml
   - psp-rolebinding.yaml
-  - anyuid-scc-rolebinding.yaml
-  - privileged-scc-rolebinding.yaml
+  - privileged-scc-rolebinding.yaml

acceptance/tests/fixtures/bases/static-client/kustomization.yaml

@@ -6,5 +6,4 @@ resources:
   - service.yaml
   - serviceaccount.yaml
   - psp-rolebinding.yaml
-  - anyuid-scc-rolebinding.yaml
-  - privileged-scc-rolebinding.yaml
+  - privileged-scc-rolebinding.yaml

acceptance/tests/fixtures/bases/static-server-https/kustomization.yaml

@@ -7,5 +7,4 @@ resources:
   - service.yaml
   - serviceaccount.yaml
   - psp-rolebinding.yaml
-  - anyuid-scc-rolebinding.yaml
-  - privileged-scc-rolebinding.yaml
+  - privileged-scc-rolebinding.yaml

acceptance/tests/fixtures/bases/static-server-tcp/kustomization.yaml

@@ -7,5 +7,4 @@ resources:
   - serviceaccount.yaml
   - servicedefaults.yaml
   - psp-rolebinding.yaml
-  - anyuid-scc-rolebinding.yaml
-  - privileged-scc-rolebinding.yaml
+  - privileged-scc-rolebinding.yaml

acceptance/tests/fixtures/bases/static-server/kustomization.yaml

@@ -6,5 +6,4 @@ resources:
   - service.yaml
   - serviceaccount.yaml
   - psp-rolebinding.yaml
-  - anyuid-scc-rolebinding.yaml
-  - privileged-scc-rolebinding.yaml
+  - privileged-scc-rolebinding.yaml

acceptance/tests/fixtures/bases/v2-multiport-app/kustomization.yaml

@@ -7,5 +7,4 @@ resources:
   - secret.yaml
   - serviceaccount.yaml
   - psp-rolebinding.yaml
-  - anyuid-scc-rolebinding.yaml
-  - privileged-scc-rolebinding.yaml
+  - privileged-scc-rolebinding.yaml

control-plane/api-gateway/gatekeeper/deployment.go

@@ -88,7 +88,7 @@ func (g *Gatekeeper) deleteDeployment(ctx context.Context, gwName types.Namespac
 }
 
 func (g *Gatekeeper) deployment(gateway gwv1beta1.Gateway, gcc v1alpha1.GatewayClassConfig, config common.HelmConfig, currentReplicas *int32) (*appsv1.Deployment, error) {
-	initContainer, err := initContainer(config, gateway.Name, gateway.Namespace)
+	initContainer, err := g.initContainer(config, gateway.Name, gateway.Namespace)
 	if err != nil {
 		return nil, err
 	}

control-plane/api-gateway/gatekeeper/init.go

@@ -10,7 +10,6 @@ import (
 	"text/template"
 
 	corev1 "k8s.io/api/core/v1"
-
 	"k8s.io/utils/pointer"
 
 	"github.com/hashicorp/consul-k8s/control-plane/api-gateway/common"
@@ -35,7 +34,7 @@ type initContainerCommandData struct {
 
 // containerInit returns the init container spec for connect-init that polls for the service and the connect proxy service to be registered
 // so that it can save the proxy service id to the shared volume and boostrap Envoy with the proxy-id.
-func initContainer(config common.HelmConfig, name, namespace string) (corev1.Container, error) {
+func (g Gatekeeper) initContainer(config common.HelmConfig, name, namespace string) (corev1.Container, error) {
 	data := initContainerCommandData{
 		AuthMethod:         config.AuthMethod,
 		LogLevel:           config.LogLevel,
@@ -175,9 +174,30 @@ func initContainer(config common.HelmConfig, name, namespace string) (corev1.Con
 		container.Resources = *config.InitContainerResources
 	}
 
+	// TODO: Melisa we will need this if we match the style of what the webhook does
+	//ns := &corev1.Namespace{}
+	// // TODO: contexts
+	//err := g.Client.Get(context.Background(), client.ObjectKey{
+	//	Name: namespace,
+	//}, ns)
+	//if err != nil {
+	//	g.Log.Error(err, "error fetching namespace metadata for deployment")
+	//	return nil, fmt.Errorf("error getting namespace metadata for deployment: %s", err)
+	//}
+
+	uid := pointer.Int64(initContainersUserAndGroupID)
+	groupID := pointer.Int64(initContainersUserAndGroupID)
+
+	// In Openshift we let Openshift set the UID and GID
+	// TODO: Melisa will probably clean this up to match what webhook does
+	if config.EnableOpenShift {
+		uid = nil
+		groupID = nil
+	}
+
 	container.SecurityContext = &corev1.SecurityContext{
-		RunAsUser:    pointer.Int64(initContainersUserAndGroupID),
-		RunAsGroup:   pointer.Int64(initContainersUserAndGroupID),
+		RunAsUser:    uid,
+		RunAsGroup:   groupID,
 		RunAsNonRoot: pointer.Bool(true),
 		Privileged:   pointer.Bool(false),
 		Capabilities: &corev1.Capabilities{