Harden Redis, InstanceHA, Memcached, DNSMasq, and RabbitMQ workload security - #630
Harden Redis, InstanceHA, Memcached, DNSMasq, and RabbitMQ workload security#630lmiccini wants to merge 3 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: lmiccini The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
e0c8b06 to
7cab0e7
Compare
lmiccini
changed the title
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 11m 20s |
08cf4e2 to
7944f4e
Compare
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/lib-common#720 is needed. |
7944f4e to
9a05b05
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 12m 11s |
9a05b05 to
9c3f94c
Compare
lmiccini
changed the title
ba2781e to
d10ee2c
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 12m 45s |
d10ee2c to
3cc71d0
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 11m 15s |
3cc71d0 to
14636f1
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 10m 41s |
14636f1 to
87f993c
Compare
|
recheck |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 11m 22s |
|
recheck |
87f993c to
f8e17f6
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 10m 42s |
|
recheck |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 10m 52s |
|
recheck |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 6m 36s |
|
recheck |
…ecurity Address anyuid SCC and overly permissive RBAC findings across all infra-operator workloads. Redis: - Remove sudo -E kolla_set_configs from startup scripts — eliminates the only blocker for nonroot-v2. Config files are now read directly from the generated path (/var/lib/config-data/generated/), and TLS certs reference the volume-mounted paths instead of /etc/pki/tls/. - Change SCC from anyuid to nonroot-v2 - Remove kolla-config volumes and mounts (config.json files deleted) - Reduce workload SA pod verbs from full CRUD to get/list/watch/patch - Add full SecurityContext via pod.RestrictiveSecurityContext helper - Set AutomountServiceAccountToken: false with projected SA token volume InstanceHA: - Change SCC from anyuid to nonroot-v2 - Add SeccompProfile RuntimeDefault - Set AutomountServiceAccountToken: false with projected SA token volume - Use lib-common pod.RestrictiveSecurityContext helper Memcached: - Bypass kolla_start entrypoint — run memcached directly by sourcing /etc/sysconfig/memcached (volume-mounted) instead of going through kolla_set_configs which requires sudo. Delete kolla config.json and remove kolla-config volume/mount. - Change SCC from anyuid to nonroot-v2 - Remove full pod CRUD from workload SA (no SA token usage) - Set AutomountServiceAccountToken: false - Add full SecurityContext via pod.RestrictiveSecurityContext helper DNSMasq: - Change SCC from anyuid to nonroot-v2 - Remove full pod CRUD from workload SA (no SA token usage) - Set AutomountServiceAccountToken: false - Add DnsmasqUID constant (42435, neutron UID from kolla) - Add full SecurityContext via pod.RestrictiveSecurityContext helper RabbitMQ: - Change SCC from anyuid to nonroot-v2 (bypasses kolla entrypoint, runs rabbitmq-server directly as UID 999, no sudo needed) - Set AutomountServiceAccountToken: false with projected SA token volume - Add full SecurityContext via pod.RestrictiveSecurityContext on both rabbitmq and amqp-proxy containers - Change FSGroup from 0 to 999 with FSGroupChangePolicy OnRootMismatch for transparent one-time PVC chown on upgrade Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
f8e17f6 to
59d2055
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 7m 33s |
The pods/exec create permission was vestigial — no exec code exists in the codebase (no remotecommand, SPDY, or exec helper calls). The pods create permission was also unused — pods are managed by StatefulSet, not created directly by the controller. Retain pods get/list/watch/update/delete (needed for labeling pods with skipPreStopChecks during CR deletion and deleting pods with short grace period) and pods update/patch (needed by BGP controller for pod label management). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
f76939d to
585c936
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 7m 19s |
|
recheck |
|
/test infra-operator-build-deploy-kuttl |
The redis container's liveness/readiness probes were defined inline with Exec handlers but no timeout settings, falling back to Kubernetes defaults (TimeoutSeconds=1, InitialDelaySeconds=0). The probe variables defined earlier (with 5s timeout and initialDelay) were unused because the container spec created new Probe objects that discarded them. This caused kuttl CI failures under the nonroot-v2 security context where the probe script (sourcing common.sh, reading SA token, calling redis-cli) could not complete within the 1s default timeout. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 8m 00s |
|
/test functional |
|
recheck |
|
/test functional |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 57m 15s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 01m 25s |
|
recheck |
1 participant
Depends-On: openstack-k8s-operators/ci-framework#4075