Add OCI baseprofile support

This allows using OCI artifacts as base profiles when the baseProfileName is prefixed with `oci://`. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
kubernetes-sigs · Mar 28, 2023 · ecfc5d1 · ecfc5d1
1 parent 5e356ba
commit ecfc5d1
Show file tree

Hide file tree

Showing 20 changed files with 449 additions and 44 deletions.
diff --git a/api/seccompprofile/v1beta1/seccompprofile_types.go b/api/seccompprofile/v1beta1/seccompprofile_types.go
@@ -40,7 +40,9 @@ const ExtJSON = ".json"
 
 // SeccompProfileSpec defines the desired state of SeccompProfile.
 type SeccompProfileSpec struct {
-	// name of base profile (in the same namespace) what will be unioned into this profile
+	// BaseProfileName is the name of base profile (in the same namespace) that
+	// will be unioned into this profile. Base profiles can be references as
+	// remote OCI artifacts as well when prefixed with `oci://`.
 	BaseProfileName string `json:"baseProfileName,omitempty"`
 
 	// Properties from containers/common/pkg/seccomp.Seccomp type

diff --git a/bundle/manifests/security-profiles-operator-profile_v1_configmap.yaml b/bundle/manifests/security-profiles-operator-profile_v1_configmap.yaml
@@ -3,7 +3,12 @@ data:
   security-profiles-operator.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",
-      "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_AARCH64"],
+      "architectures": [
+        "SCMP_ARCH_X86_64",
+        "SCMP_ARCH_X86",
+        "SCMP_ARCH_X32",
+        "SCMP_ARCH_AARCH64"
+      ],
       "syscalls": [
         {
           "names": [
@@ -28,8 +33,10 @@ data:
             "exit_group",
             "fchown",
             "fcntl",
+            "flock",
             "fstat",
             "fstatfs",
+            "fsync",
             "futex",
             "getcwd",
             "getdents64",
@@ -47,6 +54,7 @@ data:
             "inotify_add_watch",
             "inotify_init1",
             "listen",
+            "lseek",
             "madvise",
             "membarrier",
             "mkdirat",
@@ -61,13 +69,18 @@ data:
             "pipe2",
             "prctl",
             "pread64",
+            "prlimit64",
             "read",
+            "readlink",
             "readlinkat",
+            "renameat",
+            "rseq",
             "rt_sigaction",
             "rt_sigprocmask",
             "rt_sigreturn",
             "sched_getaffinity",
             "sched_yield",
+            "seccomp",
             "set_robust_list",
             "set_tid_address",
             "setgid",

diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_seccompprofiles.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_seccompprofiles.yaml
@@ -77,8 +77,10 @@ spec:
                   type: string
                 type: array
               baseProfileName:
-                description: name of base profile (in the same namespace) what will
-                  be unioned into this profile
+                description: BaseProfileName is the name of base profile (in the same
+                  namespace) that will be unioned into this profile. Base profiles
+                  can be references as remote OCI artifacts as well when prefixed
+                  with `oci://`.
                 type: string
               defaultAction:
                 description: the default action for seccomp

diff --git a/deploy/base-crds/crds/seccompprofile.yaml b/deploy/base-crds/crds/seccompprofile.yaml
@@ -75,8 +75,10 @@ spec:
                   type: string
                 type: array
               baseProfileName:
-                description: name of base profile (in the same namespace) what will
-                  be unioned into this profile
+                description: BaseProfileName is the name of base profile (in the same
+                  namespace) that will be unioned into this profile. Base profiles
+                  can be references as remote OCI artifacts as well when prefixed
+                  with `oci://`.
                 type: string
               defaultAction:
                 description: the default action for seccomp

diff --git a/deploy/base/profiles/security-profiles-operator.json b/deploy/base/profiles/security-profiles-operator.json
@@ -1,6 +1,11 @@
 {
   "defaultAction": "SCMP_ACT_ERRNO",
-  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_AARCH64"],
+  "architectures": [
+    "SCMP_ARCH_X86_64",
+    "SCMP_ARCH_X86",
+    "SCMP_ARCH_X32",
+    "SCMP_ARCH_AARCH64"
+  ],
   "syscalls": [
     {
       "names": [
@@ -25,8 +30,10 @@
         "exit_group",
         "fchown",
         "fcntl",
+        "flock",
         "fstat",
         "fstatfs",
+        "fsync",
         "futex",
         "getcwd",
         "getdents64",
@@ -44,6 +51,7 @@
         "inotify_add_watch",
         "inotify_init1",
         "listen",
+        "lseek",
         "madvise",
         "membarrier",
         "mkdirat",
@@ -58,13 +66,18 @@
         "pipe2",
         "prctl",
         "pread64",
+        "prlimit64",
         "read",
+        "readlink",
         "readlinkat",
+        "renameat",
+        "rseq",
         "rt_sigaction",
         "rt_sigprocmask",
         "rt_sigreturn",
         "sched_getaffinity",
         "sched_yield",
+        "seccomp",
         "set_robust_list",
         "set_tid_address",
         "setgid",

diff --git a/deploy/helm/crds/crds.yaml b/deploy/helm/crds/crds.yaml
@@ -290,8 +290,10 @@ spec:
                   type: string
                 type: array
               baseProfileName:
-                description: name of base profile (in the same namespace) what will
-                  be unioned into this profile
+                description: BaseProfileName is the name of base profile (in the same
+                  namespace) that will be unioned into this profile. Base profiles
+                  can be references as remote OCI artifacts as well when prefixed
+                  with `oci://`.
                 type: string
               defaultAction:
                 description: the default action for seccomp

diff --git a/deploy/helm/templates/static-resources.yaml b/deploy/helm/templates/static-resources.yaml
@@ -871,7 +871,12 @@ data:
   security-profiles-operator.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",
-      "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_AARCH64"],
+      "architectures": [
+        "SCMP_ARCH_X86_64",
+        "SCMP_ARCH_X86",
+        "SCMP_ARCH_X32",
+        "SCMP_ARCH_AARCH64"
+      ],
       "syscalls": [
         {
           "names": [
@@ -896,8 +901,10 @@ data:
             "exit_group",
             "fchown",
             "fcntl",
+            "flock",
             "fstat",
             "fstatfs",
+            "fsync",
             "futex",
             "getcwd",
             "getdents64",
@@ -915,6 +922,7 @@ data:
             "inotify_add_watch",
             "inotify_init1",
             "listen",
+            "lseek",
             "madvise",
             "membarrier",
             "mkdirat",
@@ -929,13 +937,18 @@ data:
             "pipe2",
             "prctl",
             "pread64",
+            "prlimit64",
             "read",
+            "readlink",
             "readlinkat",
+            "renameat",
+            "rseq",
             "rt_sigaction",
             "rt_sigprocmask",
             "rt_sigreturn",
             "sched_getaffinity",
             "sched_yield",
+            "seccomp",
             "set_robust_list",
             "set_tid_address",
             "setgid",

diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
@@ -290,8 +290,10 @@ spec:
                   type: string
                 type: array
               baseProfileName:
-                description: name of base profile (in the same namespace) what will
-                  be unioned into this profile
+                description: BaseProfileName is the name of base profile (in the same
+                  namespace) that will be unioned into this profile. Base profiles
+                  can be references as remote OCI artifacts as well when prefixed
+                  with `oci://`.
                 type: string
               defaultAction:
                 description: the default action for seccomp
@@ -2825,7 +2827,12 @@ data:
   security-profiles-operator.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",
-      "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_AARCH64"],
+      "architectures": [
+        "SCMP_ARCH_X86_64",
+        "SCMP_ARCH_X86",
+        "SCMP_ARCH_X32",
+        "SCMP_ARCH_AARCH64"
+      ],
       "syscalls": [
         {
           "names": [
@@ -2850,8 +2857,10 @@ data:
             "exit_group",
             "fchown",
             "fcntl",
+            "flock",
             "fstat",
             "fstatfs",
+            "fsync",
             "futex",
             "getcwd",
             "getdents64",
@@ -2869,6 +2878,7 @@ data:
             "inotify_add_watch",
             "inotify_init1",
             "listen",
+            "lseek",
             "madvise",
             "membarrier",
             "mkdirat",
@@ -2883,13 +2893,18 @@ data:
             "pipe2",
             "prctl",
             "pread64",
+            "prlimit64",
             "read",
+            "readlink",
             "readlinkat",
+            "renameat",
+            "rseq",
             "rt_sigaction",
             "rt_sigprocmask",
             "rt_sigreturn",
             "sched_getaffinity",
             "sched_yield",
+            "seccomp",
             "set_robust_list",
             "set_tid_address",
             "setgid",

diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
@@ -466,8 +466,10 @@ spec:
                   type: string
                 type: array
               baseProfileName:
-                description: name of base profile (in the same namespace) what will
-                  be unioned into this profile
+                description: BaseProfileName is the name of base profile (in the same
+                  namespace) that will be unioned into this profile. Base profiles
+                  can be references as remote OCI artifacts as well when prefixed
+                  with `oci://`.
                 type: string
               defaultAction:
                 description: the default action for seccomp
@@ -2807,7 +2809,12 @@ data:
   security-profiles-operator.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",
-      "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_AARCH64"],
+      "architectures": [
+        "SCMP_ARCH_X86_64",
+        "SCMP_ARCH_X86",
+        "SCMP_ARCH_X32",
+        "SCMP_ARCH_AARCH64"
+      ],
       "syscalls": [
         {
           "names": [
@@ -2832,8 +2839,10 @@ data:
             "exit_group",
             "fchown",
             "fcntl",
+            "flock",
             "fstat",
             "fstatfs",
+            "fsync",
             "futex",
             "getcwd",
             "getdents64",
@@ -2851,6 +2860,7 @@ data:
             "inotify_add_watch",
             "inotify_init1",
             "listen",
+            "lseek",
             "madvise",
             "membarrier",
             "mkdirat",
@@ -2865,13 +2875,18 @@ data:
             "pipe2",
             "prctl",
             "pread64",
+            "prlimit64",
             "read",
+            "readlink",
             "readlinkat",
+            "renameat",
+            "rseq",
             "rt_sigaction",
             "rt_sigprocmask",
             "rt_sigreturn",
             "sched_getaffinity",
             "sched_yield",
+            "seccomp",
             "set_robust_list",
             "set_tid_address",
             "setgid",

diff --git a/deploy/openshift-downstream.yaml b/deploy/openshift-downstream.yaml
@@ -290,8 +290,10 @@ spec:
                   type: string
                 type: array
               baseProfileName:
-                description: name of base profile (in the same namespace) what will
-                  be unioned into this profile
+                description: BaseProfileName is the name of base profile (in the same
+                  namespace) that will be unioned into this profile. Base profiles
+                  can be references as remote OCI artifacts as well when prefixed
+                  with `oci://`.
                 type: string
               defaultAction:
                 description: the default action for seccomp
@@ -2838,7 +2840,12 @@ data:
   security-profiles-operator.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",
-      "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_AARCH64"],
+      "architectures": [
+        "SCMP_ARCH_X86_64",
+        "SCMP_ARCH_X86",
+        "SCMP_ARCH_X32",
+        "SCMP_ARCH_AARCH64"
+      ],
       "syscalls": [
         {
           "names": [
@@ -2863,8 +2870,10 @@ data:
             "exit_group",
             "fchown",
             "fcntl",
+            "flock",
             "fstat",
             "fstatfs",
+            "fsync",
             "futex",
             "getcwd",
             "getdents64",
@@ -2882,6 +2891,7 @@ data:
             "inotify_add_watch",
             "inotify_init1",
             "listen",
+            "lseek",
             "madvise",
             "membarrier",
             "mkdirat",
@@ -2896,13 +2906,18 @@ data:
             "pipe2",
             "prctl",
             "pread64",
+            "prlimit64",
             "read",
+            "readlink",
             "readlinkat",
+            "renameat",
+            "rseq",
             "rt_sigaction",
             "rt_sigprocmask",
             "rt_sigreturn",
             "sched_getaffinity",
             "sched_yield",
+            "seccomp",
             "set_robust_list",
             "set_tid_address",
             "setgid",