Uploaded image for project: 'OpenShift CFE'
  1. OpenShift CFE
  2. CFE-390

As a developer I want to implement the use of the openshift security-profile-operator to deploy custom SELinux scripts into each node so that I can mitigate the need for executing a container as privileged

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Minor Minor
    • None
    • None
    • node
    • 0

      Overview

      This body of work is derived from the spike please refer to this story https://issues.redhat.com/browse/CFE-384

      Tasks

      • Well documented README - describing how to deploy SPO
      • Ensure that the node-observability-operator deploys normally
        • Update the SCC 
        • allowPrivilegedContainer: false
      • Ensure that this section is removed from the daemonset 
        • SecurityContext: &corev1.SecurityContext{
            Privileged: &privileged,
          },
      • Implement the logic to check for the SPO (fully operational)
      • Implement the logic to create the RawSeLinuxProfile CR
      • Validate that the nodes have been updated accordingly
      • Ensure the daemonset (and agents) deploy correctly
      • Delete all references to the SPO and CR before allowing profiling to start
      • Ensure E2E tests are updated with the dependency of the SPO and RawSeLinuxProfile CR

      Acceptance Criteria

      • Documentation approval
      • QE approval
      • All unit tests passing
      • Updated E2E tests 
      • CI (prow) step updated with SPO dependency and CR 

            luzuccar@redhat.com Luigi Mario Zuccarelli
            luzuccar@redhat.com Luigi Mario Zuccarelli
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: