Uploaded image for project: 'OpenShift Authentication'
  1. OpenShift Authentication
  2. AUTH-229

Pod Security compliance: openshift-cert-manager-operator and its operand

    XMLWordPrintable

Details

    • Bug
    • Resolution: Won't Do
    • Undefined
    • None
    • None
    • None

    Description

      In latest 4.11 env with latest 1.8.0 openshift-cert-manager-operator installed, checked audit logs on masters, found:

      /apis/apps/v1/namespaces/openshift-cert-manager/deployments/cert-manager-cainjector would violate PodSecurity "restricted:latest": unrestricted capabilities (container "cert-manager" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "cert-manager" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

/apis/apps/v1/namespaces/openshift-cert-manager/deployments would violate PodSecurity "restricted:latest": unrestricted capabilities (container "cert-manager" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "cert-manager" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

/apis/apps/v1/namespaces/openshift-cert-manager-operator/deployments/cert-manager-operator would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "cert-manager-operator" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "cert-manager-operator" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "cert-manager-operator" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "cert-manager-operator" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

/apis/apps/v1/namespaces/openshift-cert-manager-operator/deployments would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "cert-manager-operator" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "cert-manager-operator" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "cert-manager-operator" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "cert-manager-operator" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

/apis/apps/v1/namespaces/openshift-cert-manager-operator/replicasets would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "cert-manager-operator" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "cert-manager-operator" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "cert-manager-operator" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "cert-manager-operator" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

/apis/apps/v1/namespaces/openshift-cert-manager/replicasets would violate PodSecurity "restricted:latest": unrestricted capabilities (container "cert-manager" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "cert-manager" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

/api/v1/namespaces/openshift-cert-manager-operator/pods would violate PodSecurity "restricted:latest": runAsNonRoot != true (pod or container "cert-manager-operator" must set securityContext.runAsNonRoot=true)

      Have raised this in #control-plane-qe channel yesterday, checked https://github.com/openshift/cert-manager-operator/pulls today, no new PR for it. So creating this Jira issue as tracker in case forgotten.

      Attachments

        Issue Links

          is cloned by

          Story - Created by Jira Software - do not edit or delete. Issue type for a user story. CFE-754 Operator Pod Security compliance: cert-manager

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Activity

            People

              Unassigned Unassigned
              xxia-1 Xingxing Xia
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: