diff --git a/changelog/fragments/05-rbu-psa.yaml b/changelog/fragments/05-rbu-psa.yaml new file mode 100644 index 0000000000..e3944007bd --- /dev/null +++ b/changelog/fragments/05-rbu-psa.yaml @@ -0,0 +1,31 @@ +# entries is a list of entries to include in +# release notes and/or the migration guide +entries: + - description: > + `operator-sdk run bundle(-upgrade)`: Fix a bug where SQLite bundle images were failing to be run properly due to + a change in the default channel that is used by `run bundle(-upgrade)` when creating a subscription. + + kind: "bugfix" + breaking: false + + - description: > + `operator-sdk run bundle(-upgrade)`: Update the logic used to set a Registry Pod's PSA configuration + to fix a bug where a Pod's containers still had a restrictive SecurityContext even when setting + `--security-context-config=legacy`. + + kind: "bugfix" + breaking: false + + - description: > + `operator-sdk run bundle(-upgrade)`: Change default of the `--security-context-config` flag to be `legacy` + instead of `restricted`. + + kind: "change" + breaking: false + + - description: > + `operator-sdk run bundle`: When creating the CatalogSource, we now set the `grpcPodConfig.SecurityContextConfig` + to the value of the `--security-context-config` flag. + + kind: "change" + breaking: false diff --git a/internal/olm/operator/bundle/install.go b/internal/olm/operator/bundle/install.go index cd3fe483cb..90f15e7145 100644 --- a/internal/olm/operator/bundle/install.go +++ b/internal/olm/operator/bundle/install.go @@ -17,6 +17,7 @@ package bundle import ( "context" "fmt" + "strings" log "github.com/sirupsen/logrus" "github.com/spf13/pflag" @@ -102,13 +103,7 @@ func (i *Install) setup(ctx context.Context) error { if i.IndexImageCatalogCreator.BundleAddMode != "" { return fmt.Errorf("specifying the bundle add mode is not supported for File-Based Catalog bundles and index images") } - } else { - // index image is of the SQLite index format. - deprecationMsg := fmt.Sprintf("%s is a SQLite index image. SQLite based index images are being deprecated and will be removed in a future release, please migrate your catalogs to the new File-Based Catalog format", i.IndexImageCatalogCreator.IndexImage) - log.Warn(deprecationMsg) - } - if i.IndexImageCatalogCreator.HasFBCLabel { // FBC variables f := &fbcutil.FBCContext{ Package: labels[registrybundle.PackageLabel], @@ -130,13 +125,20 @@ func (i *Install) setup(ctx context.Context) error { } i.IndexImageCatalogCreator.FBCContent = content + i.OperatorInstaller.Channel = fbcutil.DefaultChannel + } else { + // index image is of the SQLite index format. + deprecationMsg := fmt.Sprintf("%s is a SQLite index image. SQLite based index images are being deprecated and will be removed in a future release, please migrate your catalogs to the new File-Based Catalog format", i.IndexImageCatalogCreator.IndexImage) + log.Warn(deprecationMsg) + + // set the channel the old way + i.OperatorInstaller.Channel = strings.Split(labels[registrybundle.ChannelsLabel], ",")[0] } i.OperatorInstaller.PackageName = labels[registrybundle.PackageLabel] i.OperatorInstaller.CatalogSourceName = operator.CatalogNameForPackage(i.OperatorInstaller.PackageName) i.OperatorInstaller.StartingCSV = csv.Name i.OperatorInstaller.SupportedInstallModes = operator.GetSupportedInstallModes(csv.Spec.InstallModes) - i.OperatorInstaller.Channel = fbcutil.DefaultChannel i.IndexImageCatalogCreator.PackageName = i.OperatorInstaller.PackageName i.IndexImageCatalogCreator.BundleImage = i.BundleImage diff --git a/internal/olm/operator/registry/fbcindex/fbc_registry_pod.go b/internal/olm/operator/registry/fbcindex/fbc_registry_pod.go index 9099060ebe..32fd1e2cf1 100644 --- a/internal/olm/operator/registry/fbcindex/fbc_registry_pod.go +++ b/internal/olm/operator/registry/fbcindex/fbc_registry_pod.go @@ -32,7 +32,7 @@ import ( "k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/util/wait" "k8s.io/client-go/util/retry" - pointer "k8s.io/utils/pointer" + "k8s.io/utils/pointer" "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" "github.com/operator-framework/operator-sdk/internal/olm/operator" @@ -134,6 +134,16 @@ func (f *FBCRegistryPod) Create(ctx context.Context, cfg *operator.Configuration Type: corev1.SeccompProfileTypeRuntimeDefault, }, } + + // Update the Registry Pod container security context to be restrictive + f.pod.Spec.Containers[0].SecurityContext = &corev1.SecurityContext{ + Privileged: pointer.Bool(false), + ReadOnlyRootFilesystem: pointer.Bool(false), + AllowPrivilegeEscalation: pointer.Bool(false), + Capabilities: &corev1.Capabilities{ + Drop: []corev1.Capability{"ALL"}, + }, + } } if err := f.cfg.Client.Create(ctx, f.pod); err != nil { @@ -306,14 +316,6 @@ func (f *FBCRegistryPod) podForBundleRegistry(cs *v1alpha1.CatalogSource) (*core {Name: defaultContainerPortName, ContainerPort: f.GRPCPort}, }, VolumeMounts: volumeMounts, - SecurityContext: &corev1.SecurityContext{ - Privileged: pointer.Bool(false), - ReadOnlyRootFilesystem: pointer.Bool(false), - AllowPrivilegeEscalation: pointer.Bool(false), - Capabilities: &corev1.Capabilities{ - Drop: []corev1.Capability{"ALL"}, - }, - }, }, }, ServiceAccountName: f.cfg.ServiceAccount, diff --git a/internal/olm/operator/registry/index/registry_pod.go b/internal/olm/operator/registry/index/registry_pod.go index 61719c64d3..c9f3434f8c 100644 --- a/internal/olm/operator/registry/index/registry_pod.go +++ b/internal/olm/operator/registry/index/registry_pod.go @@ -139,6 +139,16 @@ func (rp *SQLiteRegistryPod) Create(ctx context.Context, cfg *operator.Configura Type: corev1.SeccompProfileTypeRuntimeDefault, }, } + + // Update the Registry Pod container security context to be restrictive + rp.pod.Spec.Containers[0].SecurityContext = &corev1.SecurityContext{ + Privileged: pointer.Bool(false), + ReadOnlyRootFilesystem: pointer.Bool(false), + AllowPrivilegeEscalation: pointer.Bool(false), + Capabilities: &corev1.Capabilities{ + Drop: []corev1.Capability{"ALL"}, + }, + } } if err := rp.cfg.Client.Create(ctx, rp.pod); err != nil { @@ -277,14 +287,7 @@ func (rp *SQLiteRegistryPod) podForBundleRegistry() (*corev1.Pod, error) { Ports: []corev1.ContainerPort{ {Name: defaultContainerPortName, ContainerPort: rp.GRPCPort}, }, - SecurityContext: &corev1.SecurityContext{ - Privileged: pointer.Bool(false), - ReadOnlyRootFilesystem: pointer.Bool(false), - AllowPrivilegeEscalation: pointer.Bool(false), - Capabilities: &corev1.Capabilities{ - Drop: []corev1.Capability{"ALL"}, - }, - }, + WorkingDir: "/tmp", }, }, ServiceAccountName: rp.cfg.ServiceAccount, @@ -362,11 +365,11 @@ func newBool(b bool) *bool { return bp } -const cmdTemplate = `mkdir -p {{ dirname .DBPath }} && \ +const cmdTemplate = `[[ -f {{ .DBPath }} ]] && cp {{ .DBPath }} /tmp/tmp.db; \ {{- range $i, $item := .BundleItems }} -opm registry add -d {{ $.DBPath }} -b {{ $item.ImageTag }} --mode={{ $item.AddMode }}{{ if $.CASecretName }} --ca-file=/certs/cert.pem{{ end }} --skip-tls-verify={{ $.SkipTLSVerify }} --use-http={{ $.UseHTTP }} && \ +opm registry add -d /tmp/tmp.db -b {{ $item.ImageTag }} --mode={{ $item.AddMode }}{{ if $.CASecretName }} --ca-file=/certs/cert.pem{{ end }} --skip-tls-verify={{ $.SkipTLSVerify }} --use-http={{ $.UseHTTP }} && \ {{- end }} -opm registry serve -d {{ .DBPath }} -p {{ .GRPCPort }} +opm registry serve -d /tmp/tmp.db -p {{ .GRPCPort }} ` // getContainerCmd uses templating to construct the container command diff --git a/internal/olm/operator/registry/index/registry_pod_test.go b/internal/olm/operator/registry/index/registry_pod_test.go index 2229c2482f..4f1f81130d 100644 --- a/internal/olm/operator/registry/index/registry_pod_test.go +++ b/internal/olm/operator/registry/index/registry_pod_test.go @@ -290,7 +290,8 @@ func containerCommandFor(dbPath string, items []BundleItem, hasCA, skipTLSVerify } additions := &strings.Builder{} for _, item := range items { - additions.WriteString(fmt.Sprintf("opm registry add -d %s -b %s --mode=%s%s --skip-tls-verify=%v --use-http=%v && \\\n", dbPath, item.ImageTag, item.AddMode, caFlag, skipTLSVerify, useHTTP)) + additions.WriteString(fmt.Sprintf("opm registry add -d /tmp/tmp.db -b %s --mode=%s%s --skip-tls-verify=%v --use-http=%v && \\\n", item.ImageTag, item.AddMode, caFlag, skipTLSVerify, useHTTP)) } - return fmt.Sprintf("mkdir -p /database && \\\n%sopm registry serve -d /database/index.db -p 50051\n", additions.String()) + + return fmt.Sprintf("[[ -f %s ]] && cp %s /tmp/tmp.db; \\\n%sopm registry serve -d /tmp/tmp.db -p 50051\n", dbPath, dbPath, additions.String()) } diff --git a/internal/olm/operator/registry/index_image.go b/internal/olm/operator/registry/index_image.go index db87f86223..2f080d3761 100644 --- a/internal/olm/operator/registry/index_image.go +++ b/internal/olm/operator/registry/index_image.go @@ -138,8 +138,8 @@ func (c *IndexImageCatalogCreator) BindFlags(fs *pflag.FlagSet) { fs.BoolVar(&c.UseHTTP, "use-http", false, "use plain HTTP for container image registries "+ "while pulling bundles") - // default to Restricted - c.SecurityContext = SecurityContext{ContextType: Restricted} + // default to Legacy + c.SecurityContext = SecurityContext{ContextType: Legacy} fs.Var(&c.SecurityContext, "security-context-config", "specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'.") } @@ -148,6 +148,7 @@ func (c IndexImageCatalogCreator) CreateCatalog(ctx context.Context, name string cs := newCatalogSource(name, c.cfg.Namespace, withSDKPublisher(c.PackageName), withSecrets(c.SecretName), + withGrpcPodSecurityContextConfig(c.SecurityContext.String()), ) if err := c.cfg.Client.Create(ctx, cs); err != nil { return nil, fmt.Errorf("error creating catalog source: %v", err) diff --git a/internal/olm/operator/registry/olm_resources.go b/internal/olm/operator/registry/olm_resources.go index d43b1e9934..41abc145bb 100644 --- a/internal/olm/operator/registry/olm_resources.go +++ b/internal/olm/operator/registry/olm_resources.go @@ -89,6 +89,15 @@ func withSecrets(secretNames ...string) func(*v1alpha1.CatalogSource) { } } +func withGrpcPodSecurityContextConfig(securityContextConfig string) func(*v1alpha1.CatalogSource) { + return func(cs *v1alpha1.CatalogSource) { + if cs.Spec.GrpcPodConfig == nil { + cs.Spec.GrpcPodConfig = &v1alpha1.GrpcPodConfig{} + } + cs.Spec.GrpcPodConfig.SecurityContextConfig = v1alpha1.SecurityConfig(securityContextConfig) + } +} + // newCatalogSource creates a new CatalogSource with a name derived from // pkgName, the package manifest's packageName, in namespace. opts will // be applied to the CatalogSource object. diff --git a/website/content/en/docs/advanced-topics/custom-bundle-validation.md b/website/content/en/docs/advanced-topics/custom-bundle-validation.md index eadc2ece4b..f0d9d2a0dd 100644 --- a/website/content/en/docs/advanced-topics/custom-bundle-validation.md +++ b/website/content/en/docs/advanced-topics/custom-bundle-validation.md @@ -309,7 +309,7 @@ $ operator-sdk bundle validate ./bundle --alpha-select-external ./myvalidator/ma WARN[0000] Warning: Value sandbox-op.v0.0.1: owned CRD "sandboxes.sandbox.example.come" has an empty description INFO[0000] All validation tests have completed successfully ``` -[errors-pkg]: https://github.com/operator-framework/api/pkg/tree/master/validation/errors +[errors-pkg]: https://github.com/operator-framework/api/tree/master/pkg/validation/errors [manifest_result]: https://github.com/operator-framework/api/blob/master/pkg/validation/errors/error.go#L9-L16 [of-api]: https://github.com/operator-framework/api [of-validation]: https://github.com/operator-framework/api/tree/master/pkg/validation diff --git a/website/content/en/docs/advanced-topics/multi-arch.md b/website/content/en/docs/advanced-topics/multi-arch.md index fc5e21e71c..863137ea22 100644 --- a/website/content/en/docs/advanced-topics/multi-arch.md +++ b/website/content/en/docs/advanced-topics/multi-arch.md @@ -50,7 +50,7 @@ For operators distributed through the [Operator Lifecycle Manager (OLM)][olm]: [manifest_list]: https://docs.docker.com/registry/spec/manifest-v2-2/#manifest-list [image_index]: https://github.com/opencontainers/image-spec/blob/main/image-index.md -[buildah]: https://github.com/containers/buildah/blob/main/docs/buildah-bud.md#building-an-multi-architecture-image-using-a---manifest-option-requires-emulation-software +[buildah]: https://github.com/containers/buildah/blob/main/docs/buildah-build.1.md#building-an-multi-architecture-image-using-the---manifest-option-requires-emulation-software [buildx]: https://docs.docker.com/buildx/working-with-buildx/#build-multi-platform-images [buildx_multiarch]: https://docs.docker.com/buildx/working-with-buildx/#build-multi-platform-images [olm]: https://olm.operatorframework.io/docs/ diff --git a/website/content/en/docs/cli/operator-sdk_run_bundle-upgrade.md b/website/content/en/docs/cli/operator-sdk_run_bundle-upgrade.md index a6e644db8d..f24f64d862 100644 --- a/website/content/en/docs/cli/operator-sdk_run_bundle-upgrade.md +++ b/website/content/en/docs/cli/operator-sdk_run_bundle-upgrade.md @@ -24,7 +24,7 @@ operator-sdk run bundle-upgrade [flags] --kubeconfig string Path to the kubeconfig file to use for CLI requests. -n, --namespace string If present, namespace scope for this CLI request --pull-secret-name string Name of image pull secret ("type: kubernetes.io/dockerconfigjson") required to pull bundle images. This secret *must* be both in the namespace and an imagePullSecret of the service account that this command is configured to run in - --security-context-config SecurityContext specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'. (default restricted) + --security-context-config SecurityContext specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'. (default legacy) --service-account string Service account name to bind registry objects to. If unset, the default service account is used. This value does not override the operator's service account --skip-tls skip authentication of image registry TLS certificate when pulling a bundle image in-cluster --skip-tls-verify skip TLS certificate verification for container image registries while pulling bundles diff --git a/website/content/en/docs/cli/operator-sdk_run_bundle.md b/website/content/en/docs/cli/operator-sdk_run_bundle.md index 3750a64243..7619e18309 100644 --- a/website/content/en/docs/cli/operator-sdk_run_bundle.md +++ b/website/content/en/docs/cli/operator-sdk_run_bundle.md @@ -35,7 +35,7 @@ operator-sdk run bundle [flags] --kubeconfig string Path to the kubeconfig file to use for CLI requests. -n, --namespace string If present, namespace scope for this CLI request --pull-secret-name string Name of image pull secret ("type: kubernetes.io/dockerconfigjson") required to pull bundle images. This secret *must* be both in the namespace and an imagePullSecret of the service account that this command is configured to run in - --security-context-config SecurityContext specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'. (default restricted) + --security-context-config SecurityContext specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'. (default legacy) --service-account string Service account name to bind registry objects to. If unset, the default service account is used. This value does not override the operator's service account --skip-tls skip authentication of image registry TLS certificate when pulling a bundle image in-cluster --skip-tls-verify skip TLS certificate verification for container image registries while pulling bundles diff --git a/website/content/en/docs/contribution-guidelines/releasing.md b/website/content/en/docs/contribution-guidelines/releasing.md index c72c91159f..6fc531210a 100644 --- a/website/content/en/docs/contribution-guidelines/releasing.md +++ b/website/content/en/docs/contribution-guidelines/releasing.md @@ -198,12 +198,10 @@ We will use the `v1.3.1` release version in this example. #### 0. Lock down release branches on GitHub -Lock down the `v1.3.x` branch to prevent further merges/commits. - -To do this, edit the `Branch protection rules`: https://github.com/operator-framework/operator-sdk/settings/branches - -- click `Edit` on the `v.*` branch rule. -- In section `Protect matching branches` of the `Rule settings` box, set "Required approving reviewers" to `6`. +1. Lock down the `v1.3.x` branch to prevent further commits before the release completes: + 1. Go to `Settings -> Branches` in the SDK repo. + 1. Under `Branch protection rules`, click `Edit` on the `v*.` branch rule. + 1. In section `Protect matching branches` of the `Rule settings` box, increase the number of required approving reviewers to `6`. #### 1. Branch diff --git a/website/content/en/docs/overview/cheat-sheet.md b/website/content/en/docs/overview/cheat-sheet.md index c8cf495d53..24db235e18 100644 --- a/website/content/en/docs/overview/cheat-sheet.md +++ b/website/content/en/docs/overview/cheat-sheet.md @@ -70,7 +70,7 @@ make bundle CHANNELS=fast,preview DEFAULT_CHANNEL=stable VERSION=1.0.0 IMG=