Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding) #291

natiiix · 2020-12-08T10:22:58Z

This enhancements gathers anyuid and privileged SCCs, and the corresponding ClusterRoleBindings from clusters running a SAP payload.

Sample archive

~~config/sap_namespaces.json~~ (removed because it's no longer necessary)
config/securitycontextconstraint/
config/clusterrolebinding/

Documentation

docs/gathered-data.md - "SAPConfig" section

Unit Tests

pkg/gather/clusterconfig/sap_config_test.go

Privacy

Yes. There are no sensitive data in the newly collected information.

Changelog

No.

References

Jira Task: https://issues.redhat.com/browse/CCXDEV-3485

openshift-ci-robot · 2020-12-08T10:23:17Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci-robot · 2021-01-20T14:15:32Z

@natiiix: This pull request references Bugzilla bug 1918351, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.7.0) matches configured target release for branch (4.7.0)
bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2021-01-20T14:16:27Z

@natiiix: This pull request references Bugzilla bug 1918351, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.7.0) matches configured target release for branch (4.7.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2021-01-20T14:20:32Z

@natiiix: This pull request references Bugzilla bug 1918351, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.7.0) matches configured target release for branch (4.7.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

natiiix · 2021-01-21T11:51:59Z

/retest

tremes · 2021-01-22T07:15:39Z

pkg/gather/clusterconfig/sap_config.go

+
+	sapNamespaces := map[string]struct{}{}
+	for _, item := range datahubsList.Items {
+		sapNamespaces[item.GetNamespace()] = struct{}{}


That looks a little unnecessary. Can't we have just a list/array of sapNamespaces names?

Oh yeah, the reason behind this is historical. Now we no longer really care about the particular namespace, in which the resource exists, so we don't really need to collected this information at all. Originally, there was a loop iterating over the namespaces a looking for SCCs/CRBs that match them. It would be a problem to use a list if there were multiple datahubs resources in the namespace (not sure if that's even possible at all). I'll change this one to just a boolean value for simplicity. We don't need the actual namespaces anywhere in the code or in the archive. Wdyt?

tremes · 2021-01-22T07:17:32Z

pkg/gather/clusterconfig/sap_config.go

+
+func gatherSAPConfig(ctx context.Context, dynamicClient dynamic.Interface, coreClient corev1client.CoreV1Interface, securityClient securityv1client.SecurityV1Interface, authClient authclient.AuthorizationV1Interface) ([]record.Record, []error) {
+	sccFilter := map[string]struct{}{"anyuid": {}, "privileged": {}}
+	crbFilter := map[string]struct{}{"system:openshift:scc:anyuid": {}, "system:openshift:scc:privileged": {}}


Do we need maps for these? Wouldn't be array of string sufficient?

You're right. It would work fine, but this syntax ensures that each resource is collected at most once. Originally, there was a name field check when iterating over a list of returned results instead of using Get, which checked if the name existed as a key in this map (which is actually the canonical Go syntax for a set) because it's faster and shorter than iterating over a list. I can change it if you want, but I think this should be fairly clear to anyone aware of this somewhat unusual syntax for sets).

tremes · 2021-01-22T07:29:21Z

docs/insights-archive-sample/config/securitycontextconstraint/privileged.json

@@ -0,0 +1 @@
+{"metadata":{"name":"privileged","selfLink":"/apis/security.openshift.io/v1/securitycontextconstraints/privileged","uid":"8c98d901-ea31-4ad8-8616-f2d2185af2f7","resourceVersion":"40739187","generation":2,"creationTimestamp":"2020-10-29T14:27:37Z","annotations":{"include.release.openshift.io/self-managed-high-availability":"true","kubernetes.io/description":"privileged allows access to all privileged and host features and the ability to run as any user, any group, any fsGroup, and with any SELinux context.  WARNING: this is the most relaxed SCC and should be used only for cluster administration. Grant with caution.","release.openshift.io/create-only":"true"},"managedFields":[{"manager":"cluster-version-operator","operation":"Update","apiVersion":"security.openshift.io/v1","time":"2020-10-29T14:27:37Z","fieldsType":"FieldsV1","fieldsV1":{"f:allowHostDirVolumePlugin":{},"f:allowHostIPC":{},"f:allowHostNetwork":{},"f:allowHostPID":{},"f:allowHostPorts":{},"f:allowPrivilegeEscalation":{},"f:allowPrivilegedContainer":{},"f:allowedCapabilities":{},"f:allowedUnsafeSysctls":{},"f:defaultAddCapabilities":{},"f:fsGroup":{".":{},"f:type":{}},"f:groups":{},"f:metadata":{"f:annotations":{".":{},"f:include.release.openshift.io/self-managed-high-availability":{},"f:kubernetes.io/description":{},"f:release.openshift.io/create-only":{}}},"f:priority":{},"f:readOnlyRootFilesystem":{},"f:requiredDropCapabilities":{},"f:runAsUser":{".":{},"f:type":{}},"f:seLinuxContext":{".":{},"f:type":{}},"f:seccompProfiles":{},"f:supplementalGroups":{".":{},"f:type":{}},"f:volumes":{}}},{"manager":"kubectl-edit","operation":"Update","apiVersion":"security.openshift.io/v1","time":"2020-11-26T12:53:56Z","fieldsType":"FieldsV1","fieldsV1":{"f:users":{}}}]},"priority":null,"allowPrivilegedContainer":true,"defaultAddCapabilities":null,"requiredDropCapabilities":null,"allowedCapabilities":["*"],"allowHostDirVolumePlugin":true,"volumes":["*"],"allowHostNetwork":true,"allowHostPorts":true,"allowHostPID":true,"allowHostIPC":true,"allowPrivilegeEscalation":true,"seLinuxContext":{"type":"RunAsAny"},"runAsUser":{"type":"RunAsAny"},"supplementalGroups":{"type":"RunAsAny"},"fsGroup":{"type":"RunAsAny"},"readOnlyRootFilesystem":false,"users":["system:admin","system:serviceaccount:openshift-infra:build-controller","system:serviceaccount:sdi:mlf-deployment-api"],"groups":["system:cluster-admins","system:nodes","system:masters"],"seccompProfiles":["*"],"allowedUnsafeSysctls":["*"]}


This is little bit weird. All these resources are gathered without their kind and apiVersion. It's probably not an issue, but it's not very consistent (given the format of all our resources)

That's a very good catch, but we're not doing that anywhere intentionally. It just seems that this client doesn't return those fields when using the Get method for some strange reason.

openshift-ci-robot · 2021-01-25T09:28:36Z

@natiiix: This pull request references Bugzilla bug 1918351, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.7.0) matches configured target release for branch (4.7.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tremes · 2021-01-25T11:34:59Z

Unfortunately we don't have the option to verify this directly (because we don't have any cluster with SAP installed). I only checked that nothing is added when the SAP is not installed. We verified this approach in remote RH cluster with SAP installed (by sharing IO image including this change).
/lgtm

openshift-ci-robot · 2021-01-25T11:35:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: natiiix, tremes

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [natiiix,tremes]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-01-25T13:10:02Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-01-25T14:27:59Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-01-25T14:54:00Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot · 2021-01-25T15:46:59Z

@natiiix: All pull requests linked via external trackers have merged:

openshift/insights-operator#291

Bugzilla bug 1918351 has been moved to the MODIFIED state.

In response to this:

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 8, 2020

openshift-ci-robot requested review from Serhii1011010 and tremes December 8, 2020 10:23

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 8, 2020

openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 16, 2020

natiiix force-pushed the gather-sap-scc-crb branch from 5ff62a4 to b08e7d8 Compare December 16, 2020 14:20

openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 16, 2020

natiiix force-pushed the gather-sap-scc-crb branch from b08e7d8 to 4c6bd5a Compare December 17, 2020 10:19

natiiix force-pushed the gather-sap-scc-crb branch 2 times, most recently from 6a02a2e to 6759c8c Compare January 20, 2021 13:52

natiiix changed the title ~~WIP: Gather SAP configuration (SCC & ClusterRoleBinding)~~ Gather SAP configuration (SCC & ClusterRoleBinding) Jan 20, 2021

natiiix force-pushed the gather-sap-scc-crb branch from 6759c8c to e58d26b Compare January 20, 2021 14:04

natiiix changed the title ~~Gather SAP configuration (SCC & ClusterRoleBinding)~~ Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding) Jan 20, 2021

openshift-ci-robot added bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Jan 20, 2021

natiiix marked this pull request as ready for review January 20, 2021 14:15

openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 20, 2021

natiiix force-pushed the gather-sap-scc-crb branch from e58d26b to 71c7bc2 Compare January 20, 2021 14:22

tremes reviewed Jan 22, 2021

View reviewed changes

natiiix force-pushed the gather-sap-scc-crb branch from 71c7bc2 to 50ad647 Compare January 22, 2021 15:35

openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 22, 2021

natiiix added 2 commits January 22, 2021 17:39

Vendor dynamic, security, auth clients + fake

37ffa23

Implement SAP config gather - SCC & CRB

76a944e

Add SAP config gathering docs

9d08b27

natiiix force-pushed the gather-sap-scc-crb branch from 50ad647 to 9d08b27 Compare January 22, 2021 16:40

openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 22, 2021

openshift-ci-robot assigned tremes Jan 25, 2021

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 25, 2021

openshift-merge-robot merged commit 95b969d into openshift:master Jan 25, 2021

natiiix mentioned this pull request Jan 31, 2021

[release-4.6] Bug 1922855: Gather SAP configuration (SCC & ClusterRoleBinding) #328

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding) #291

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding) #291

natiiix commented Dec 8, 2020 •

edited

Loading

openshift-ci-robot commented Dec 8, 2020

openshift-ci-robot commented Jan 20, 2021

openshift-ci-robot commented Jan 20, 2021

openshift-ci-robot commented Jan 20, 2021

natiiix commented Jan 21, 2021

tremes Jan 22, 2021

natiiix Jan 22, 2021

tremes Jan 22, 2021

natiiix Jan 22, 2021

tremes Jan 22, 2021

natiiix Jan 22, 2021

openshift-ci-robot commented Jan 25, 2021

tremes commented Jan 25, 2021

openshift-ci-robot commented Jan 25, 2021

openshift-bot commented Jan 25, 2021

openshift-bot commented Jan 25, 2021

openshift-bot commented Jan 25, 2021

openshift-ci-robot commented Jan 25, 2021

		@@ -0,0 +1 @@
		{"metadata":{"name":"privileged","selfLink":"/apis/security.openshift.io/v1/securitycontextconstraints/privileged","uid":"8c98d901-ea31-4ad8-8616-f2d2185af2f7","resourceVersion":"40739187","generation":2,"creationTimestamp":"2020-10-29T14:27:37Z","annotations":{"include.release.openshift.io/self-managed-high-availability":"true","kubernetes.io/description":"privileged allows access to all privileged and host features and the ability to run as any user, any group, any fsGroup, and with any SELinux context. WARNING: this is the most relaxed SCC and should be used only for cluster administration. Grant with caution.","release.openshift.io/create-only":"true"},"managedFields":[{"manager":"cluster-version-operator","operation":"Update","apiVersion":"security.openshift.io/v1","time":"2020-10-29T14:27:37Z","fieldsType":"FieldsV1","fieldsV1":{"f:allowHostDirVolumePlugin":{},"f:allowHostIPC":{},"f:allowHostNetwork":{},"f:allowHostPID":{},"f:allowHostPorts":{},"f:allowPrivilegeEscalation":{},"f:allowPrivilegedContainer":{},"f:allowedCapabilities":{},"f:allowedUnsafeSysctls":{},"f:defaultAddCapabilities":{},"f:fsGroup":{".":{},"f:type":{}},"f:groups":{},"f:metadata":{"f:annotations":{".":{},"f:include.release.openshift.io/self-managed-high-availability":{},"f:kubernetes.io/description":{},"f:release.openshift.io/create-only":{}}},"f:priority":{},"f:readOnlyRootFilesystem":{},"f:requiredDropCapabilities":{},"f:runAsUser":{".":{},"f:type":{}},"f:seLinuxContext":{".":{},"f:type":{}},"f:seccompProfiles":{},"f:supplementalGroups":{".":{},"f:type":{}},"f:volumes":{}}},{"manager":"kubectl-edit","operation":"Update","apiVersion":"security.openshift.io/v1","time":"2020-11-26T12:53:56Z","fieldsType":"FieldsV1","fieldsV1":{"f:users":{}}}]},"priority":null,"allowPrivilegedContainer":true,"defaultAddCapabilities":null,"requiredDropCapabilities":null,"allowedCapabilities":[""],"allowHostDirVolumePlugin":true,"volumes":[""],"allowHostNetwork":true,"allowHostPorts":true,"allowHostPID":true,"allowHostIPC":true,"allowPrivilegeEscalation":true,"seLinuxContext":{"type":"RunAsAny"},"runAsUser":{"type":"RunAsAny"},"supplementalGroups":{"type":"RunAsAny"},"fsGroup":{"type":"RunAsAny"},"readOnlyRootFilesystem":false,"users":["system:admin","system:serviceaccount:openshift-infra:build-controller","system:serviceaccount:sdi:mlf-deployment-api"],"groups":["system:cluster-admins","system:nodes","system:masters"],"seccompProfiles":[""],"allowedUnsafeSysctls":[""]}

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding) #291

Bug 1918351: Gather SAP configuration (SCC & ClusterRoleBinding) #291

Conversation

natiiix commented Dec 8, 2020 • edited Loading

Categories

Sample archive

Documentation

Unit Tests

Privacy

Changelog

References

openshift-ci-robot commented Dec 8, 2020

openshift-ci-robot commented Jan 20, 2021

openshift-ci-robot commented Jan 20, 2021

openshift-ci-robot commented Jan 20, 2021

natiiix commented Jan 21, 2021

tremes Jan 22, 2021

Choose a reason for hiding this comment

natiiix Jan 22, 2021

Choose a reason for hiding this comment

tremes Jan 22, 2021

Choose a reason for hiding this comment

natiiix Jan 22, 2021

Choose a reason for hiding this comment

tremes Jan 22, 2021

Choose a reason for hiding this comment

natiiix Jan 22, 2021

Choose a reason for hiding this comment

openshift-ci-robot commented Jan 25, 2021

tremes commented Jan 25, 2021

openshift-ci-robot commented Jan 25, 2021

openshift-bot commented Jan 25, 2021

openshift-bot commented Jan 25, 2021

openshift-bot commented Jan 25, 2021

openshift-ci-robot commented Jan 25, 2021

natiiix commented Dec 8, 2020 •

edited

Loading