Skip to content

Commit 2058be2

Browse files
everettraveneverettraven
authored
(bugfix): OCPBUGS-3072 - fix operator-sdk run bundle(-upgrade) PSA related issues (#6210)
1 parent cbeec47 commit 2058be2

File tree

14 files changed

+90
-43
lines changed

14 files changed

+90
-43
lines changed

‎changelog/fragments/05-rbu-psa.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# entries is a list of entries to include in
2+
# release notes and/or the migration guide
3+
entries:
4+
- description: >
5+
`operator-sdk run bundle(-upgrade)`: Fix a bug where SQLite bundle images were failing to be run properly due to
6+
a change in the default channel that is used by `run bundle(-upgrade)` when creating a subscription.
7+
8+
kind: "bugfix"
9+
breaking: false
10+
11+
- description: >
12+
`operator-sdk run bundle(-upgrade)`: Update the logic used to set a Registry Pod's PSA configuration
13+
to fix a bug where a Pod's containers still had a restrictive SecurityContext even when setting
14+
`--security-context-config=legacy`.
15+
16+
kind: "bugfix"
17+
breaking: false
18+
19+
- description: >
20+
`operator-sdk run bundle(-upgrade)`: Change default of the `--security-context-config` flag to be `legacy`
21+
instead of `restricted`.
22+
23+
kind: "change"
24+
breaking: false
25+
26+
- description: >
27+
`operator-sdk run bundle`: When creating the CatalogSource, we now set the `grpcPodConfig.SecurityContextConfig`
28+
to the value of the `--security-context-config` flag.
29+
30+
kind: "change"
31+
breaking: false

‎internal/olm/operator/bundle/install.go

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ package bundle
1717
import (
1818
"context"
1919
"fmt"
20+
"strings"
2021

2122
log "github.com/sirupsen/logrus"
2223
"github.com/spf13/pflag"
@@ -102,13 +103,7 @@ func (i *Install) setup(ctx context.Context) error {
102103
if i.IndexImageCatalogCreator.BundleAddMode != "" {
103104
return fmt.Errorf("specifying the bundle add mode is not supported for File-Based Catalog bundles and index images")
104105
}
105-
} else {
106-
// index image is of the SQLite index format.
107-
deprecationMsg := fmt.Sprintf("%s is a SQLite index image. SQLite based index images are being deprecated and will be removed in a future release, please migrate your catalogs to the new File-Based Catalog format", i.IndexImageCatalogCreator.IndexImage)
108-
log.Warn(deprecationMsg)
109-
}
110106

111-
if i.IndexImageCatalogCreator.HasFBCLabel {
112107
// FBC variables
113108
f := &fbcutil.FBCContext{
114109
Package: labels[registrybundle.PackageLabel],
@@ -130,13 +125,20 @@ func (i *Install) setup(ctx context.Context) error {
130125
}
131126

132127
i.IndexImageCatalogCreator.FBCContent = content
128+
i.OperatorInstaller.Channel = fbcutil.DefaultChannel
129+
} else {
130+
// index image is of the SQLite index format.
131+
deprecationMsg := fmt.Sprintf("%s is a SQLite index image. SQLite based index images are being deprecated and will be removed in a future release, please migrate your catalogs to the new File-Based Catalog format", i.IndexImageCatalogCreator.IndexImage)
132+
log.Warn(deprecationMsg)
133+
134+
// set the channel the old way
135+
i.OperatorInstaller.Channel = strings.Split(labels[registrybundle.ChannelsLabel], ",")[0]
133136
}
134137

135138
i.OperatorInstaller.PackageName = labels[registrybundle.PackageLabel]
136139
i.OperatorInstaller.CatalogSourceName = operator.CatalogNameForPackage(i.OperatorInstaller.PackageName)
137140
i.OperatorInstaller.StartingCSV = csv.Name
138141
i.OperatorInstaller.SupportedInstallModes = operator.GetSupportedInstallModes(csv.Spec.InstallModes)
139-
i.OperatorInstaller.Channel = fbcutil.DefaultChannel
140142

141143
i.IndexImageCatalogCreator.PackageName = i.OperatorInstaller.PackageName
142144
i.IndexImageCatalogCreator.BundleImage = i.BundleImage

‎internal/olm/operator/registry/fbcindex/fbc_registry_pod.go

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ import (
3232
"k8s.io/apimachinery/pkg/types"
3333
"k8s.io/apimachinery/pkg/util/wait"
3434
"k8s.io/client-go/util/retry"
35-
pointer "k8s.io/utils/pointer"
35+
"k8s.io/utils/pointer"
3636
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
3737

3838
"github.com/operator-framework/operator-sdk/internal/olm/operator"
@@ -134,6 +134,16 @@ func (f *FBCRegistryPod) Create(ctx context.Context, cfg *operator.Configuration
134134
Type: corev1.SeccompProfileTypeRuntimeDefault,
135135
},
136136
}
137+
138+
// Update the Registry Pod container security context to be restrictive
139+
f.pod.Spec.Containers[0].SecurityContext = &corev1.SecurityContext{
140+
Privileged: pointer.Bool(false),
141+
ReadOnlyRootFilesystem: pointer.Bool(false),
142+
AllowPrivilegeEscalation: pointer.Bool(false),
143+
Capabilities: &corev1.Capabilities{
144+
Drop: []corev1.Capability{"ALL"},
145+
},
146+
}
137147
}
138148

139149
if err := f.cfg.Client.Create(ctx, f.pod); err != nil {
@@ -306,14 +316,6 @@ func (f *FBCRegistryPod) podForBundleRegistry(cs *v1alpha1.CatalogSource) (*core
306316
{Name: defaultContainerPortName, ContainerPort: f.GRPCPort},
307317
},
308318
VolumeMounts: volumeMounts,
309-
SecurityContext: &corev1.SecurityContext{
310-
Privileged: pointer.Bool(false),
311-
ReadOnlyRootFilesystem: pointer.Bool(false),
312-
AllowPrivilegeEscalation: pointer.Bool(false),
313-
Capabilities: &corev1.Capabilities{
314-
Drop: []corev1.Capability{"ALL"},
315-
},
316-
},
317319
},
318320
},
319321
ServiceAccountName: f.cfg.ServiceAccount,

‎internal/olm/operator/registry/index/registry_pod.go

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,16 @@ func (rp *SQLiteRegistryPod) Create(ctx context.Context, cfg *operator.Configura
139139
Type: corev1.SeccompProfileTypeRuntimeDefault,
140140
},
141141
}
142+
143+
// Update the Registry Pod container security context to be restrictive
144+
rp.pod.Spec.Containers[0].SecurityContext = &corev1.SecurityContext{
145+
Privileged: pointer.Bool(false),
146+
ReadOnlyRootFilesystem: pointer.Bool(false),
147+
AllowPrivilegeEscalation: pointer.Bool(false),
148+
Capabilities: &corev1.Capabilities{
149+
Drop: []corev1.Capability{"ALL"},
150+
},
151+
}
142152
}
143153

144154
if err := rp.cfg.Client.Create(ctx, rp.pod); err != nil {
@@ -277,14 +287,7 @@ func (rp *SQLiteRegistryPod) podForBundleRegistry() (*corev1.Pod, error) {
277287
Ports: []corev1.ContainerPort{
278288
{Name: defaultContainerPortName, ContainerPort: rp.GRPCPort},
279289
},
280-
SecurityContext: &corev1.SecurityContext{
281-
Privileged: pointer.Bool(false),
282-
ReadOnlyRootFilesystem: pointer.Bool(false),
283-
AllowPrivilegeEscalation: pointer.Bool(false),
284-
Capabilities: &corev1.Capabilities{
285-
Drop: []corev1.Capability{"ALL"},
286-
},
287-
},
290+
WorkingDir: "/tmp",
288291
},
289292
},
290293
ServiceAccountName: rp.cfg.ServiceAccount,
@@ -362,11 +365,11 @@ func newBool(b bool) *bool {
362365
return bp
363366
}
364367

365-
const cmdTemplate = `mkdir -p {{ dirname .DBPath }} && \
368+
const cmdTemplate = `[[ -f {{ .DBPath }} ]] && cp {{ .DBPath }} /tmp/tmp.db; \
366369
{{- range $i, $item := .BundleItems }}
367-
opm registry add -d {{ $.DBPath }} -b {{ $item.ImageTag }} --mode={{ $item.AddMode }}{{ if $.CASecretName }} --ca-file=/certs/cert.pem{{ end }} --skip-tls-verify={{ $.SkipTLSVerify }} --use-http={{ $.UseHTTP }} && \
370+
opm registry add -d /tmp/tmp.db -b {{ $item.ImageTag }} --mode={{ $item.AddMode }}{{ if $.CASecretName }} --ca-file=/certs/cert.pem{{ end }} --skip-tls-verify={{ $.SkipTLSVerify }} --use-http={{ $.UseHTTP }} && \
368371
{{- end }}
369-
opm registry serve -d {{ .DBPath }} -p {{ .GRPCPort }}
372+
opm registry serve -d /tmp/tmp.db -p {{ .GRPCPort }}
370373
`
371374

372375
// getContainerCmd uses templating to construct the container command

‎internal/olm/operator/registry/index/registry_pod_test.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -290,7 +290,8 @@ func containerCommandFor(dbPath string, items []BundleItem, hasCA, skipTLSVerify
290290
}
291291
additions := &strings.Builder{}
292292
for _, item := range items {
293-
additions.WriteString(fmt.Sprintf("opm registry add -d %s -b %s --mode=%s%s --skip-tls-verify=%v --use-http=%v && \\\n", dbPath, item.ImageTag, item.AddMode, caFlag, skipTLSVerify, useHTTP))
293+
additions.WriteString(fmt.Sprintf("opm registry add -d /tmp/tmp.db -b %s --mode=%s%s --skip-tls-verify=%v --use-http=%v && \\\n", item.ImageTag, item.AddMode, caFlag, skipTLSVerify, useHTTP))
294294
}
295-
return fmt.Sprintf("mkdir -p /database && \\\n%sopm registry serve -d /database/index.db -p 50051\n", additions.String())
295+
296+
return fmt.Sprintf("[[ -f %s ]] && cp %s /tmp/tmp.db; \\\n%sopm registry serve -d /tmp/tmp.db -p 50051\n", dbPath, dbPath, additions.String())
296297
}

‎internal/olm/operator/registry/index_image.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,8 +138,8 @@ func (c *IndexImageCatalogCreator) BindFlags(fs *pflag.FlagSet) {
138138
fs.BoolVar(&c.UseHTTP, "use-http", false, "use plain HTTP for container image registries "+
139139
"while pulling bundles")
140140

141-
// default to Restricted
142-
c.SecurityContext = SecurityContext{ContextType: Restricted}
141+
// default to Legacy
142+
c.SecurityContext = SecurityContext{ContextType: Legacy}
143143
fs.Var(&c.SecurityContext, "security-context-config", "specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'.")
144144
}
145145

@@ -148,6 +148,7 @@ func (c IndexImageCatalogCreator) CreateCatalog(ctx context.Context, name string
148148
cs := newCatalogSource(name, c.cfg.Namespace,
149149
withSDKPublisher(c.PackageName),
150150
withSecrets(c.SecretName),
151+
withGrpcPodSecurityContextConfig(c.SecurityContext.String()),
151152
)
152153
if err := c.cfg.Client.Create(ctx, cs); err != nil {
153154
return nil, fmt.Errorf("error creating catalog source: %v", err)

‎internal/olm/operator/registry/olm_resources.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,15 @@ func withSecrets(secretNames ...string) func(*v1alpha1.CatalogSource) {
8989
}
9090
}
9191

92+
func withGrpcPodSecurityContextConfig(securityContextConfig string) func(*v1alpha1.CatalogSource) {
93+
return func(cs *v1alpha1.CatalogSource) {
94+
if cs.Spec.GrpcPodConfig == nil {
95+
cs.Spec.GrpcPodConfig = &v1alpha1.GrpcPodConfig{}
96+
}
97+
cs.Spec.GrpcPodConfig.SecurityContextConfig = v1alpha1.SecurityConfig(securityContextConfig)
98+
}
99+
}
100+
92101
// newCatalogSource creates a new CatalogSource with a name derived from
93102
// pkgName, the package manifest's packageName, in namespace. opts will
94103
// be applied to the CatalogSource object.

‎website/content/en/docs/advanced-topics/custom-bundle-validation.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,7 @@ $ operator-sdk bundle validate ./bundle --alpha-select-external ./myvalidator/ma
309309
WARN[0000] Warning: Value sandbox-op.v0.0.1: owned CRD "sandboxes.sandbox.example.come" has an empty description
310310
INFO[0000] All validation tests have completed successfully
311311
```
312-
[errors-pkg]: https://github.com/operator-framework/api/pkg/tree/master/validation/errors
312+
[errors-pkg]: https://github.com/operator-framework/api/tree/master/pkg/validation/errors
313313
[manifest_result]: https://github.com/operator-framework/api/blob/master/pkg/validation/errors/error.go#L9-L16
314314
[of-api]: https://github.com/operator-framework/api
315315
[of-validation]: https://github.com/operator-framework/api/tree/master/pkg/validation

‎website/content/en/docs/advanced-topics/multi-arch.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ For operators distributed through the [Operator Lifecycle Manager (OLM)][olm]:
5050

5151
[manifest_list]: https://docs.docker.com/registry/spec/manifest-v2-2/#manifest-list
5252
[image_index]: https://github.com/opencontainers/image-spec/blob/main/image-index.md
53-
[buildah]: https://github.com/containers/buildah/blob/main/docs/buildah-bud.md#building-an-multi-architecture-image-using-a---manifest-option-requires-emulation-software
53+
[buildah]: https://github.com/containers/buildah/blob/main/docs/buildah-build.1.md#building-an-multi-architecture-image-using-the---manifest-option-requires-emulation-software
5454
[buildx]: https://docs.docker.com/buildx/working-with-buildx/#build-multi-platform-images
5555
[buildx_multiarch]: https://docs.docker.com/buildx/working-with-buildx/#build-multi-platform-images
5656
[olm]: https://olm.operatorframework.io/docs/

‎website/content/en/docs/cli/operator-sdk_run_bundle-upgrade.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ operator-sdk run bundle-upgrade <bundle-image> [flags]
2424
--kubeconfig string Path to the kubeconfig file to use for CLI requests.
2525
-n, --namespace string If present, namespace scope for this CLI request
2626
--pull-secret-name string Name of image pull secret ("type: kubernetes.io/dockerconfigjson") required to pull bundle images. This secret *must* be both in the namespace and an imagePullSecret of the service account that this command is configured to run in
27-
--security-context-config SecurityContext specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'. (default restricted)
27+
--security-context-config SecurityContext specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'. (default legacy)
2828
--service-account string Service account name to bind registry objects to. If unset, the default service account is used. This value does not override the operator's service account
2929
--skip-tls skip authentication of image registry TLS certificate when pulling a bundle image in-cluster
3030
--skip-tls-verify skip TLS certificate verification for container image registries while pulling bundles

‎website/content/en/docs/cli/operator-sdk_run_bundle.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ operator-sdk run bundle <bundle-image> [flags]
3535
--kubeconfig string Path to the kubeconfig file to use for CLI requests.
3636
-n, --namespace string If present, namespace scope for this CLI request
3737
--pull-secret-name string Name of image pull secret ("type: kubernetes.io/dockerconfigjson") required to pull bundle images. This secret *must* be both in the namespace and an imagePullSecret of the service account that this command is configured to run in
38-
--security-context-config SecurityContext specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'. (default restricted)
38+
--security-context-config SecurityContext specifies the security context to use for the catalog pod. allowed: 'restricted', 'legacy'. (default legacy)
3939
--service-account string Service account name to bind registry objects to. If unset, the default service account is used. This value does not override the operator's service account
4040
--skip-tls skip authentication of image registry TLS certificate when pulling a bundle image in-cluster
4141
--skip-tls-verify skip TLS certificate verification for container image registries while pulling bundles

‎website/content/en/docs/contribution-guidelines/releasing.md

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -198,12 +198,10 @@ We will use the `v1.3.1` release version in this example.
198198

199199
#### 0. Lock down release branches on GitHub
200200

201-
Lock down the `v1.3.x` branch to prevent further merges/commits.
202-
203-
To do this, edit the `Branch protection rules`: https://github.com/operator-framework/operator-sdk/settings/branches
204-
205-
- click `Edit` on the `v.*` branch rule.
206-
- In section `Protect matching branches` of the `Rule settings` box, set "Required approving reviewers" to `6`.
201+
1. Lock down the `v1.3.x` branch to prevent further commits before the release completes:
202+
1. Go to `Settings -> Branches` in the SDK repo.
203+
1. Under `Branch protection rules`, click `Edit` on the `v*.` branch rule.
204+
1. In section `Protect matching branches` of the `Rule settings` box, increase the number of required approving reviewers to `6`.
207205

208206
#### 1. Branch
209207

‎website/content/en/docs/overview/cheat-sheet.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ make bundle CHANNELS=fast,preview DEFAULT_CHANNEL=stable VERSION=1.0.0 IMG=<some
7070
[bundle]:https://github.com/operator-framework/operator-registry/blob/v1.16.1/docs/design/operator-bundle.md
7171
[operatorhub-io]: https://operatorhub.io/
7272
[upgrade-project]: /docs/olm-integration/generation/#upgrade-your-operator
73-
[channel-namming-doc]: https://github.com/operator-framework/operator-lifecycle-manager/blob/master/doc/design/channel-naming.md
73+
[channel-namming-doc]: https://olm.operatorframework.io/docs/best-practices/channel-naming/
7474
[controllers-k8s-doc]: https://kubernetes.io/docs/concepts/architecture/controller
7575
[gkvs]: https://book.kubebuilder.io/cronjob-tutorial/gvks.html
7676
[extend-k8s-api]: https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/

‎website/content/en/docs/upgrading-sdk-version/v1.5.0.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ _See [#4402](https://github.com/operator-framework/operator-sdk/pull/4402) for m
1111

1212
## PROJECT config version 3-alpha must be upgraded to 3.
1313

14-
PROJECT config version 3-alpha has been stabilized as [version 3](https://github.com/kubernetes-sigs/kubebuilder/blob/master/docs/book/src/migration/manually_migration_guide_v2_v3.md) (the `version` key in your PROJECT file), and contains a set of config fields sufficient to fully describe a project. While this change is not technically breaking because the spec at that version was alpha, it was used by default in `operator-sdk` commands so should be marked as breaking and have a convenient migration path. The `alpha config-3alpha-to-3` command will convert most of your PROJECT file from version 3-alpha to 3, and leave comments with directions where automatic conversion is not possible:
14+
PROJECT config version 3-alpha has been stabilized as [version 3](https://github.com/kubernetes-sigs/kubebuilder/blob/master/docs/book/src/migration/legacy/manually_migration_guide_v2_v3.md) (the `version` key in your PROJECT file), and contains a set of config fields sufficient to fully describe a project. While this change is not technically breaking because the spec at that version was alpha, it was used by default in `operator-sdk` commands so should be marked as breaking and have a convenient migration path. The `alpha config-3alpha-to-3` command will convert most of your PROJECT file from version 3-alpha to 3, and leave comments with directions where automatic conversion is not possible:
1515

1616
```console
1717
$ cat PROJECT

0 commit comments

Comments
 (0)