OCPBUGS-43316: Enforce privileged PSA by default #4834

Evan-Reilly · 2024-10-01T14:53:04Z

What this PR does / why we need it:
OpenShiftPodSecurityAdmission feature gate is not enabled by default in 4.17 any longer. Therefore, to ensure namespace security is not enforcing restricted by default any longer, this PR is required to properly enforce privileged PSA by default.

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes https://issues.redhat.com/browse/OCPBUGS-43316

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci · 2024-10-01T14:54:26Z

Hi @Evan-Reilly. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

rtheis · 2024-10-01T14:58:52Z

/ok-to-test

rtheis

@Evan-Reilly please take a look at the failures

control-plane-operator/controllers/hostedcontrolplane/clusterpolicy/config.go

rtheis

/lgtm

rtheis

/hold for changes based on https://ibm-argonauts.slack.com/archives/C01C8502FMM/p1727808157696799.

rtheis · 2024-10-03T10:13:07Z

/remove-hold

rtheis · 2024-10-03T10:13:22Z

@Evan-Reilly please fix the following test:

{Failed  === RUN   TestCreateClusterRequestServingIsolation/Main/EnsurePSANotPrivileged
    util.go:667: pod admitted when rejection was expected
    util.go:670: forbidden error expected, got %!s(<nil>)
        --- FAIL: TestCreateClusterRequestServingIsolation/Main/EnsurePSANotPrivileged (0.16s)
}

rtheis · 2024-10-04T11:23:12Z

/test verify

rtheis · 2024-10-04T18:58:19Z

test/e2e/create_cluster_test.go

@@ -129,7 +129,6 @@ func TestCreateClusterRequestServingIsolation(t *testing.T) {

 	e2eutil.NewHypershiftTest(t, ctx, func(t *testing.T, g Gomega, mgtClient crclient.Client, hostedCluster *hyperv1.HostedCluster) {
 		guestClient := e2eutil.WaitForGuestClient(t, testContext, mgtClient, hostedCluster)
-		e2eutil.EnsurePSANotPrivileged(t, ctx, guestClient)


Per our slack discussion, I think you need to first remove the test in a separate PR in order for PR testing to pass on this PR.

#4855 will hopefully resolve this.

rtheis · 2024-10-16T11:28:37Z

/jira refresh

openshift-ci-robot · 2024-10-16T11:28:41Z

@rtheis: This pull request references Jira Issue OCPBUGS-43316, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-43316 to depend on a bug targeting a version in 4.18.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rvanderp3 · 2024-10-16T13:38:55Z

/jira refresh

openshift-ci-robot · 2024-10-16T13:38:59Z

@rvanderp3: This pull request references Jira Issue OCPBUGS-43316, which is invalid:

expected Jira Issue OCPBUGS-43316 to depend on a bug targeting a version in 4.18.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rvanderp3 · 2024-10-16T13:40:27Z

/jira refresh

openshift-ci-robot · 2024-10-16T13:40:32Z

@rvanderp3: This pull request references Jira Issue OCPBUGS-43316, which is invalid:

expected the bug to target either version "4.17." or "openshift-4.17.", but it targets "4.18.0" instead
expected Jira Issue OCPBUGS-43316 to depend on a bug targeting a version in 4.18.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rvanderp3 · 2024-10-16T13:41:09Z

/jira refresh

openshift-ci-robot · 2024-10-16T13:41:15Z

@rvanderp3: This pull request references Jira Issue OCPBUGS-43316, which is invalid:

expected Jira Issue OCPBUGS-43316 to depend on a bug targeting a version in 4.18.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sjenning · 2024-10-16T13:45:59Z

/approve

sjenning · 2024-10-16T13:47:09Z

/hold

on review from hyperhift team. didn't really no one from our side had looked yet.

openshift-ci · 2024-10-16T13:48:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Evan-Reilly, rtheis, sjenning

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [sjenning]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

control-plane-operator/controllers/hostedcontrolplane/clusterpolicy/params.go

Update the openshift-api module to get updated feature flags

OpenShiftPodSecurityAdmission feature gate is not enabled by default in 4.17 any longer. Therefore, to ensure namespace security is not enforcing restricted by default any longer, this PR is required to properly enforce privileged PSA by default.

sjenning · 2024-10-16T15:19:09Z

/lgtm
/hold cancel

openshift-ci-robot · 2024-10-16T20:48:57Z

/retest-required

Remaining retests: 0 against base HEAD 4785464 and 2 for PR HEAD d96393d in total

openshift-ci · 2024-10-16T22:25:15Z

@Evan-Reilly: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-10-16T22:29:06Z

@Evan-Reilly: Jira Issue OCPBUGS-43316: All pull requests linked via external trackers have merged:

openshift/hypershift#4834

Jira Issue OCPBUGS-43316 has been moved to the MODIFIED state.

In response to this:

What this PR does / why we need it:
OpenShiftPodSecurityAdmission feature gate is not enabled by default in 4.17 any longer. Therefore, to ensure namespace security is not enforcing restricted by default any longer, this PR is required to properly enforce privileged PSA by default.

https://github.com/openshift/api/blob/release-4.17/features/features.go

features: disable PSA api#2018

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes https://issues.redhat.com/browse/OCPBUGS-43316

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-bot · 2024-10-17T00:22:18Z

[ART PR BUILD NOTIFIER]

Distgit: hypershift
This PR has been included in build ose-hypershift-container-v4.17.0-202410162336.p0.g93ca4ee.assembly.stream.el9.
All builds following this will include this PR.

openshift-ci bot added the do-not-merge/needs-area label Oct 1, 2024

openshift-ci bot requested review from enxebre and sjenning October 1, 2024 14:53

openshift-ci bot added area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. and removed do-not-merge/needs-area labels Oct 1, 2024

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 1, 2024

rtheis reviewed Oct 1, 2024

View reviewed changes

control-plane-operator/controllers/hostedcontrolplane/clusterpolicy/config.go Outdated Show resolved Hide resolved

Evan-Reilly force-pushed the fix-psa-4.17 branch from 6f250f1 to f6d5c66 Compare October 1, 2024 18:12

rtheis approved these changes Oct 1, 2024

View reviewed changes

openshift-ci bot assigned rtheis Oct 1, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 1, 2024

rtheis suggested changes Oct 1, 2024

View reviewed changes

openshift-ci bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. and removed lgtm Indicates that a PR is ready to be merged. labels Oct 1, 2024

Evan-Reilly force-pushed the fix-psa-4.17 branch 4 times, most recently from 91cf662 to 9cc94ab Compare October 2, 2024 17:29

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 3, 2024

Evan-Reilly force-pushed the fix-psa-4.17 branch from 9cc94ab to c8ba741 Compare October 3, 2024 14:21

openshift-ci bot added the area/testing Indicates the PR includes changes for e2e testing label Oct 3, 2024

Evan-Reilly force-pushed the fix-psa-4.17 branch from c8ba741 to a370cc6 Compare October 4, 2024 14:43

rtheis suggested changes Oct 4, 2024

View reviewed changes

sjenning added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 16, 2024

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 16, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 16, 2024

enxebre reviewed Oct 16, 2024

View reviewed changes

control-plane-operator/controllers/hostedcontrolplane/clusterpolicy/params.go Outdated Show resolved Hide resolved

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 16, 2024

Evan-Reilly added 2 commits October 16, 2024 10:14

Update openshift-api

8f7225b

Update the openshift-api module to get updated feature flags

Enforce privileged PSA by default

d96393d

OpenShiftPodSecurityAdmission feature gate is not enabled by default in 4.17 any longer. Therefore, to ensure namespace security is not enforcing restricted by default any longer, this PR is required to properly enforce privileged PSA by default.

Evan-Reilly force-pushed the fix-psa-4.17 branch from e34dd08 to d96393d Compare October 16, 2024 15:16

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 16, 2024

openshift-ci bot assigned sjenning Oct 16, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 16, 2024

openshift-merge-bot bot merged commit 93ca4ee into openshift:release-4.17 Oct 16, 2024
10 checks passed

rtheis mentioned this pull request Jan 9, 2025

OCPBUGS-45600: Enforce privileged PSA by default #5359

Open

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-43316: Enforce privileged PSA by default #4834

OCPBUGS-43316: Enforce privileged PSA by default #4834

Evan-Reilly commented Oct 1, 2024 •

edited

Loading

openshift-ci bot commented Oct 1, 2024

rtheis commented Oct 1, 2024

rtheis left a comment

rtheis left a comment

rtheis left a comment

rtheis commented Oct 3, 2024

rtheis commented Oct 3, 2024

rtheis commented Oct 4, 2024

rtheis Oct 4, 2024

rtheis Oct 8, 2024

rtheis commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

rvanderp3 commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

rvanderp3 commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

rvanderp3 commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

sjenning commented Oct 16, 2024

sjenning commented Oct 16, 2024

openshift-ci bot commented Oct 16, 2024

sjenning commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

openshift-ci bot commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

openshift-bot commented Oct 17, 2024

OCPBUGS-43316: Enforce privileged PSA by default #4834

OCPBUGS-43316: Enforce privileged PSA by default #4834

Conversation

Evan-Reilly commented Oct 1, 2024 • edited Loading

openshift-ci bot commented Oct 1, 2024

rtheis commented Oct 1, 2024

rtheis left a comment

Choose a reason for hiding this comment

rtheis left a comment

Choose a reason for hiding this comment

rtheis left a comment

Choose a reason for hiding this comment

rtheis commented Oct 3, 2024

rtheis commented Oct 3, 2024

rtheis commented Oct 4, 2024

rtheis Oct 4, 2024

Choose a reason for hiding this comment

rtheis Oct 8, 2024

Choose a reason for hiding this comment

rtheis commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

rvanderp3 commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

rvanderp3 commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

rvanderp3 commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

sjenning commented Oct 16, 2024

sjenning commented Oct 16, 2024

openshift-ci bot commented Oct 16, 2024

sjenning commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

openshift-ci bot commented Oct 16, 2024

openshift-ci-robot commented Oct 16, 2024

openshift-bot commented Oct 17, 2024

Evan-Reilly commented Oct 1, 2024 •

edited

Loading