Set SCC allowPrivilegeEscalation to true when container build enabled #1596
Conversation
Running Podman inside a container in OpenShift requires the pod to have allowPrivilegeEscalation: true in its security context. Signed-off-by: Angel Misevski <[email protected]>
amisevsk
requested review from
nickboldt,
tolusha,
AndrienkoAleksandr and
flacatus
as code owners
|
Once merged, likely needs a backport to 7.59.x |
Signed-off-by: Angel Misevski <[email protected]>
|
/test v11-devworkspace-happy-path |
Codecov Report
@@ Coverage Diff @@
## main #1596 +/- ##
=======================================
Coverage 58.95% 58.95%
=======================================
Files 73 73
Lines 8614 8614
=======================================
Hits 5078 5078
Misses 3190 3190
Partials 346 346 Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: amisevsk, ibuziuk, tolusha The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build 3.5 :: operator_3.x/170: Console, Changes, Git Data |
…eclipse-che#1596) * Set SCC allowPrivilegeEscalation to true when container build enabled Running Podman inside a container in OpenShift requires the pod to have allowPrivilegeEscalation: true in its security context. * Fix tests Signed-off-by: Angel Misevski <[email protected]>
|
Build 3.5 :: sync-to-downstream_3.x/1965: Console, Changes, Git Data |
|
Build 3.5 :: push-latest-container-to-quay_3.x/1513: Console, Changes, Git Data |
|
Build 3.5 :: push-latest-container-to-quay_3.x/1513: Copied: devspaces-rhel8-operator; /job/DS_CI/job/update-digests_3.x triggered; |
|
Build 3.5 :: update-digests_3.x/1841: Console, Changes, Git Data |
|
Build 3.5 :: copyIIBsToQuay/653: Console, Changes, Git Data |
|
Build 3.5 :: get-sources-rhpkg-container-build_3.x/1895: devspaces-operator : 3.x :: Build 49999325 : quay.io/devspaces/devspaces-rhel8-operator:3.5-17 |
|
Build 3.5 :: sync-to-downstream_3.x/1965: Build container: devspaces-operator synced; /DS_CI/get-sources-rhpkg-container-build_3.x/1895 triggered; |
|
Build 3.5 :: operator_3.x/170: Upstream sync done; /DS_CI/sync-to-downstream_3.x/1965 triggered |
|
Build 3.5 :: operator-bundle_3.x/764: Console, Changes, Git Data |
|
Build 3.5 :: sync-to-downstream_3.x/1966: Console, Changes, Git Data |
|
Build 3.5 :: push-latest-container-to-quay_3.x/1514: Console, Changes, Git Data |
|
Build 3.5 :: copyIIBsToQuay/654: Console, Changes, Git Data |
|
Build 3.5 :: push-latest-container-to-quay_3.x/1514: Copied: devspaces-operator-bundle; bundle-generated updated; |
|
Build 3.5 :: sync-to-downstream_3.x/1966: Build container: devspaces-operator-bundle synced; /DS_CI/get-sources-rhpkg-container-build_3.x/1896 triggered; /job/DS_CI/job/dsc_3.x triggered; |
|
Build 3.5 :: operator-bundle_3.x/764: Upstream sync done; /DS_CI/sync-to-downstream_3.x/1966 triggered |
|
Build 3.5 :: dsc_3.x/559: Console, Changes, Git Data |
|
Build 3.5 :: update-digests_3.x/1841: Detected new images: rebuild operator-bundle |
|
Build 3.5 :: dsc_3.x/559: 3.5.0 CI |
…eclipse-che#1596) * Set SCC allowPrivilegeEscalation to true when container build enabled Running Podman inside a container in OpenShift requires the pod to have allowPrivilegeEscalation: true in its security context. * Fix tests Signed-off-by: Angel Misevski <[email protected]>
…eclipse-che#1596) * Set SCC allowPrivilegeEscalation to true when container build enabled Running Podman inside a container in OpenShift requires the pod to have allowPrivilegeEscalation: true in its security context. * Fix tests Signed-off-by: Angel Misevski <[email protected]>
* feat: configure workspace security context for container builds Fix eclipse-che/che#21770 Signed-off-by: Andrew Obuchowicz <[email protected]> * Set SCC allowPrivilegeEscalation to true when container build enabled (#1596) * Set SCC allowPrivilegeEscalation to true when container build enabled Running Podman inside a container in OpenShift requires the pod to have allowPrivilegeEscalation: true in its security context. * Fix tests Signed-off-by: Angel Misevski <[email protected]> * fix: set scc priority to null Signed-off-by: Anatolii Bazko <[email protected]> --------- Signed-off-by: Andrew Obuchowicz <[email protected]> Signed-off-by: Angel Misevski <[email protected]> Signed-off-by: Anatolii Bazko <[email protected]> Co-authored-by: Angel Misevski <[email protected]> Co-authored-by: Anatolii Bazko <[email protected]>
What does this PR do?
Sets
allowPrivilegeEscalation: truein the pod security context whenDisableContainerBuildCapabilitiesisfalse. This was incorrectly set to false in https://github.com/eclipse-che/che-operator/pull/1576, as thecontainer-buildSCC containsallowPrivilegeEscalation: true`.What issues does this PR fix or reference?
Closes eclipse-che/che#21927
How to test this PR?
podman imagessucceeds (potentially with warnings) and prints an empty list of images rather than an error.PR Checklist
As the author of this Pull Request I made sure that:
What issues does this PR fix or referenceandHow to test this PRcompletedReviewers
Reviewers, please comment how you tested the PR when approving it.