Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Scorecard] - Create images that run as a non-root user by default #6295

Closed
everettraven opened this issue Feb 7, 2023 · 0 comments · Fixed by #6335
Closed

[Scorecard] - Create images that run as a non-root user by default #6295

everettraven opened this issue Feb 7, 2023 · 0 comments · Fixed by #6335
Assignees
@everettraven
Labels
scorecard Issue relates to the scorecard subcomponent
Milestone
v1.28.0

Comments

@everettraven
Copy link
Contributor

Feature Request

Describe the problem you need a feature to resolve.

The operator-sdk scorecard command recently got a new flag (--pod-security) to enable restricted pod security configurations on Scorecard test pods. Currently, Scorecard defaults to an untar image that runs as a root user:

operator-sdk/internal/cmd/operator-sdk/scorecard/cmd.go

Lines 96 to 98 in 5cbdad9

scorecardCmd.Flags().StringVarP(&c.untarImage, "untar-image", "u",
"registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7",
"Untar image to be used by the Scorecard pod")

This results in PSA failures due to the container running as a root user instead of a non-root user when --pod-security=restricted

Describe the solution you'd like.

Audit all default images used by Scorecard pods and make changes as needed to ensure that the images we are using will run as a non-root user by default.
@everettraven everettraven added the scorecard Issue relates to the scorecard subcomponent label Feb 7, 2023
@jberkhahn jberkhahn added this to the v1.29.0 milestone Feb 13, 2023
everettraven added a commit to everettraven/operator-sdk that referenced this issue Feb 23, 2023
@everettraven
Add new images for scorecard
fe984e0 
and use them as the default untar and storage images to ensure
that scorecard pods are fully compliant with restricted PSA. This
is done by making the images run as non-root by default (sets the user
to non-root in the Dockerfile)

fixes operator-framework#6295

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
@everettraven everettraven mentioned this issue Feb 23, 2023
Merged
2 tasks
everettraven added a commit that referenced this issue Feb 28, 2023
@everettraven
(scorecard): Add new images for default untar and storage options (#6335
c57ebf9 
)

* add images for scorecard untar and storage

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* Add new images for scorecard

and use them as the default untar and storage images to ensure
that scorecard pods are fully compliant with restricted PSA. This
is done by making the images run as non-root by default (sets the user
to non-root in the Dockerfile)

fixes #6295

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update images & docs;add changelog

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* add missing newline

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

---------

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
shanemcd pushed a commit to shanemcd/operator-sdk that referenced this issue Mar 3, 2023
@everettraven @shanemcd
(scorecard): Add new images for default untar and storage options (op…
e9414cc 
…erator-framework#6335)

* add images for scorecard untar and storage

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* Add new images for scorecard

and use them as the default untar and storage images to ensure
that scorecard pods are fully compliant with restricted PSA. This
is done by making the images run as non-root by default (sets the user
to non-root in the Dockerfile)

fixes operator-framework#6295

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update images & docs;add changelog

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* add missing newline

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

---------

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
shanemcd pushed a commit to shanemcd/operator-sdk that referenced this issue Mar 3, 2023
@everettraven @shanemcd
(scorecard): Add new images for default untar and storage options (op…
80005c2 
…erator-framework#6335)

* add images for scorecard untar and storage

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* Add new images for scorecard

and use them as the default untar and storage images to ensure
that scorecard pods are fully compliant with restricted PSA. This
is done by making the images run as non-root by default (sets the user
to non-root in the Dockerfile)

fixes operator-framework#6295

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update images & docs;add changelog

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* add missing newline

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

---------

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
shanemcd pushed a commit to shanemcd/operator-sdk that referenced this issue Mar 3, 2023
@everettraven @shanemcd
(scorecard): Add new images for default untar and storage options (op…
0006fb8 
…erator-framework#6335)

* add images for scorecard untar and storage

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* Add new images for scorecard

and use them as the default untar and storage images to ensure
that scorecard pods are fully compliant with restricted PSA. This
is done by making the images run as non-root by default (sets the user
to non-root in the Dockerfile)

fixes operator-framework#6295

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update images & docs;add changelog

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* add missing newline

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

---------

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
shanemcd pushed a commit to shanemcd/operator-sdk that referenced this issue Mar 3, 2023
@everettraven @shanemcd
(scorecard): Add new images for default untar and storage options (op…
cda21ba 
…erator-framework#6335)

* add images for scorecard untar and storage

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* Add new images for scorecard

and use them as the default untar and storage images to ensure
that scorecard pods are fully compliant with restricted PSA. This
is done by making the images run as non-root by default (sets the user
to non-root in the Dockerfile)

fixes operator-framework#6295

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update images & docs;add changelog

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* add missing newline

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

---------

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
shanemcd pushed a commit to shanemcd/operator-sdk that referenced this issue Mar 3, 2023
@everettraven @shanemcd
(scorecard): Add new images for default untar and storage options (op…
c60c6ff 
…erator-framework#6335)

* add images for scorecard untar and storage

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* Add new images for scorecard

and use them as the default untar and storage images to ensure
that scorecard pods are fully compliant with restricted PSA. This
is done by making the images run as non-root by default (sets the user
to non-root in the Dockerfile)

fixes operator-framework#6295

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update images & docs;add changelog

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* add missing newline

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

---------

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
@varshaprasad96 varshaprasad96 modified the milestones: v1.29.0, v1.28.0 Mar 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@everettraven everettraven

Labels
scorecard Issue relates to the scorecard subcomponent
Projects
None yet
Milestone
v1.28.0
Development

Successfully merging a pull request may close this issue.

(scorecard): Add new images for default untar and storage options everettraven/operator-sdk
3 participants
@jberkhahn @everettraven @varshaprasad96