Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug 2000820: Gather installed PSP names #489

Merged
merged 1 commit into from
Sep 4, 2021
Merged

Bug 2000820: Gather installed PSP names #489

merged 1 commit into from
Sep 4, 2021

Conversation

tremes
Copy link
Contributor

@tremes tremes commented Sep 2, 2021 •
edited
Loading

This adds new gatherer for PodSecurityPolicies names installed in a cluster. There are no psps by default in a cluster so you have to create one (see the example below) to test this.

Categories

  • Bugfix
  • Enhancement
  • Backporting
  • Others (CI, Infrastructure, Documentation)

Sample Archive

Sample archive updated

  • docs/insights-archive-sample/config/psp_names.json

Documentation

Doc updated

  • docs/gathered-data.md

Unit Tests

  • path/to/file_test.go

Privacy

Yes. There are no sensitive data in the newly collected information.

Changelog

Breaking Changes

No

References

https://issues.redhat.com/browse/CCXDEV-5605
https://issues.redhat.com/browse/INSIGHTOCP-433
https://bugzilla.redhat.com/show_bug.cgi?id=???
https://access.redhat.com/solutions/5622051

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 2, 2021
@tremes
Copy link
Contributor Author

tremes commented Sep 2, 2021

psp example:

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  annotations:
    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
  name: next-psp-name
spec:
  # default set of capabilities are implicitly allowed
  allowedCapabilities: []
  allowPrivilegeEscalation: false
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      # Forbid adding the root group.
      - min: 1
        max: 65535
  hostIPC: false
  hostNetwork: false
  hostPID: false
  privileged: false
  readOnlyRootFilesystem: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      # Forbid adding the root group.
      - min: 1
        max: 65535
  volumes:
  - 'configMap'
  - 'downwardAPI'
  - 'emptyDir'
  - 'persistentVolumeClaim'
  - 'projected'
  - 'secret'
  hostPorts:
  - min: 0
    max: 0

tremes
tremes commented Sep 2, 2021
View reviewed changes
docs/gathered-data.md
* See: docs/insights-archive-sample/config/psp_names.json
* Id in config: psps
* Since versions:
* 4.10+
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmm who know..... :) but it's probably correct

natiiix
natiiix approved these changes Sep 2, 2021
View reviewed changes
Copy link
Contributor

@natiiix natiiix left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested locally with the provided PSP example and the name was successfully gathered as expected.
/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 2, 2021
@openshift-ci
Copy link

openshift-ci bot commented Sep 2, 2021

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: natiiix, tremes

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

7 similar comments
@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@tremes tremes changed the title Gather installed PSP names Bug 2000820: Gather installed PSP names Sep 3, 2021
@openshift-ci openshift-ci bot added the bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. label Sep 3, 2021
@openshift-ci
Copy link

openshift-ci bot commented Sep 3, 2021

@tremes: This pull request references Bugzilla bug 2000820, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.9.0) matches configured target release for branch (4.9.0)
  • bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

No GitHub users were found matching the public email listed for the QA contact in Bugzilla (dmisharo@redhat.com), skipping review request.

In response to this:

Bug 2000820: Gather installed PSP names

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Sep 3, 2021
@tremes
Copy link
Contributor Author

tremes commented Sep 3, 2021

/test e2e

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

6 similar comments
@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit 22f7d36 into openshift:master Sep 4, 2021
@openshift-ci
Copy link

openshift-ci bot commented Sep 4, 2021

@tremes: All pull requests linked via external trackers have merged:

Bugzilla bug 2000820 has been moved to the MODIFIED state.

In response to this:

Bug 2000820: Gather installed PSP names

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tremes added a commit to tremes/insights-operator that referenced this pull request Sep 6, 2021
@tremes
[release-4.8] Bug TBD: Gather installed PSP names (openshift#489)
ef1df87
@openshift-ci openshift-ci bot mentioned this pull request Sep 6, 2021
Merged
4 tasks
tremes added a commit to tremes/insights-operator that referenced this pull request Sep 9, 2021
@tremes
[release-4.7] Bug 2002539: Gather installed PSP names (openshift#489)
10e5370
@openshift-ci openshift-ci bot mentioned this pull request Sep 9, 2021
Merged
4 tasks
openshift-merge-robot pushed a commit that referenced this pull request Sep 10, 2021
@tremes
[release-4.8] Bug TBD: Gather installed PSP names (#489) (#490)
ce96050
openshift-merge-robot pushed a commit that referenced this pull request Sep 22, 2021
@tremes
[release-4.7] Bug 2002539: Gather installed PSP names (#489) (#493)
acf24a5
@tremes tremes deleted the psp branch May 6, 2022 09:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@natiiix natiiix natiiix approved these changes

@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr

@rluders rluders Awaiting requested review from rluders

Assignees

@natiiix natiiix

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@tremes @openshift-bot @natiiix @openshift-merge-robot