Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[release-0.49] Integrate with Pod security #8529

Merged
merged 6 commits into from Oct 4, 2022
Merged

[release-0.49] Integrate with Pod security #8529

merged 6 commits into from Oct 4, 2022

Conversation

xpivarc
Copy link
Member

@xpivarc xpivarc commented Sep 27, 2022

This is backport of #8436 (smaller version)

What this PR does / why we need it:
Pod Security Standards shows Kubevirt still can't run as a restricted workload. Clusters enforcing restricted policy are not able to run VMs without manual adjustments of namespaces. There is also an issue with our upgrade path to the cluster that starts to enforce the policy.

This PR enables opt-in to an automatic escalation of namespaces where VMs run. This should be used only with additional security in place or after auditing of RBAC for Kubevirt access(ability to create VM/VMI or higher abstractions).

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Release note:

Kubevirt is able to run with restricted Pod Security Standard enabled with an automatic escalation of namespace privileges.

@xpivarc
Enforce AllowPrivilegeEscalation
416fa6a 
Be compliant with PSA restricted.
This can be achivied for virt-api,
virt-operator, virt-controller.

Signed-off-by: L. Pivarc <lpivarc@redhat.com>
(cherry picked from commit 6021d9e)
Signed-off-by: L. Pivarc <lpivarc@redhat.com>
@xpivarc
Drop ALL capabilities
96625b6 
Be compliant with PSA restricted. This can
be applied to virt-api, virt-operator,
virt-controller.

Signed-off-by: L. Pivarc <lpivarc@redhat.com>
(cherry picked from commit 46c395a)
Signed-off-by: L. Pivarc <lpivarc@redhat.com>
@xpivarc
Set SeccompProfile
dd7f468 
Be compliant with PSA restricted. This can
be applied to virt-api, virt-operator,
virt-controller.

Signed-off-by: L. Pivarc <lpivarc@redhat.com>
(cherry picked from commit 63c6f8e)
Signed-off-by: L. Pivarc <lpivarc@redhat.com>
@xpivarc
Pod security label for Kubevirt
998225b 
Kubevirt install namespace needs to
specify level to enforce as it contains
privileged workload.

Signed-off-by: L. Pivarc <lpivarc@redhat.com>
(cherry picked from commit 4690f39)
Signed-off-by: L. Pivarc <lpivarc@redhat.com>
@xpivarc
Integrate with Pod security
8fd9ac1 
VMs are unfortunatly still privileged workload(in Kubevirt).
We have to integrate with new Pod Security Standards in order to allow
seamless integration, upgrades.

This means we now make sure that target namespace allows
privileged workloads if PSA feature gate is enabled.
This unfortunatly means users escalate their privileges,
in terms of Pod security, by having ability to create VMs.

(cherry picked from commit 8512fe3)
Signed-off-by: L. Pivarc <lpivarc@redhat.com>

Signed-off-by: L. Pivarc <lpivarc@redhat.com>
@xpivarc
Pod secuirty on Openshift
39abb59 
Make sure we are not racing with cluster
sync mechanism on Openshift.

Signed-off-by: L. Pivarc <lpivarc@redhat.com>
(cherry picked from commit 230676f)
Signed-off-by: L. Pivarc <lpivarc@redhat.com>
@kubevirt-bot kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. size/L labels Sep 27, 2022
@xpivarc
Copy link
Member Author

xpivarc commented Sep 27, 2022

/cc @jean-edouard @acardace

@acardace
Copy link
Member

/lgtm

@kubevirt-bot kubevirt-bot added the lgtm Indicates that a PR is ready to be merged. label Sep 27, 2022
@acardace
Copy link
Member

@xpivarc this is failing to build, you're missing a dependency.

@xpivarc
Copy link
Member Author

xpivarc commented Sep 30, 2022

/retest

@xpivarc
Copy link
Member Author

xpivarc commented Sep 30, 2022

@xpivarc this is failing to build, you're missing a dependency.

I am failing to reproduce the issue. Let's see what happens.

@jean-edouard
Copy link
Contributor

jean-edouard commented Sep 30, 2022 •
edited

@xpivarc this is failing to build, you're missing a dependency.

I am failing to reproduce the issue. Let's see what happens.

It repros on my machine. Looks like #7526
Got a repro on release-0.49 too, so it's not this PR... Not sure what's going on.
Edit: maybe this has something to do with it? klauspost/compress#651
Edit2: yup, found in the builder container:

# ls /root/.cache/bazel/_bazel_root/6f347497f91c9a385dcd9294645b76e0/external/bazel_gazelle_go_repository_cache/pkg/mod/github.com/klauspost/
compress@v1.15.11

v1.15.11 got released 4 days ago and contains the go 1.16 deprecation commit.
Quite alarming that we follow moving targets, versions should be frozen in release branches IMO...
Edit3: That should fix the issue: #8553

@jean-edouard
Copy link
Contributor

/retest

@xpivarc xpivarc changed the title [release-0.49Integrate with Pod security [release-0.49] Integrate with Pod security Oct 3, 2022
@xpivarc
Copy link
Member Author

xpivarc commented Oct 4, 2022

@vladikr PTAL

@vladikr
Copy link
Member

vladikr commented Oct 4, 2022

/approve

@vladikr
Copy link
Member

vladikr commented Oct 4, 2022

/retest

@kubevirt-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vladikr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubevirt-bot kubevirt-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 4, 2022
@kubevirt-bot kubevirt-bot merged commit f7bd5bd into kubevirt:release-0.49 Oct 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vatsalparekh vatsalparekh Awaiting requested review from vatsalparekh

@yuhaohaoyu yuhaohaoyu Awaiting requested review from yuhaohaoyu

@acardace acardace Awaiting requested review from acardace

@jean-edouard jean-edouard Awaiting requested review from jean-edouard

Assignees

@acardace acardace

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@xpivarc @acardace @jean-edouard @vladikr @kubevirt-bot