Uploaded image for project: 'OpenShift Image Registry'
  1. OpenShift Image Registry
  2. IR-455

Align the IR with security best practices about read-only root filesystem

XMLWordPrintable

    • Icon: Epic Epic
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • None
    • Registry
    • Read-only root file system for integrated registry pods
    • BU Product Work
    • False
    • None
    • False
    • Not Selected
    • To Do
    • OCPSTRAT-1076 - Align the IR with security best practices about read-only root filesystem
    • OCPSTRAT-1076Align the IR with security best practices about read-only root filesystem
    • 100% To Do, 0% In Progress, 0% Done

      Epic Goal

      • Address concerns during security audits that the integrated registry pods do not set the readOnlyRootFilesystem property to true

      Why is this important?

      • Extensive security audits are run on OpenShift Container Platform 4 and are highlighting that many vendor specific container is missing to set readOnlyRootFilesystem: true or else justify why readOnlyRootFilesystem: false is set.

      Scenarios

      1. The integrated registry pods don't have any business writing to the root filesystem mount so they should be explicitly scheduled with readOnlyRootFilesystem: true 

      Acceptance Criteria

      • CI - MUST be running successfully with tests automated
      • Release Technical Enablement - Provide necessary release enablement details and documents.
      • ...

      Done Checklist

      • CI - CI is running, tests are automated and merged.
      • Release Enablement <link to Feature Enablement Presentation>
      • DEV - Upstream code and tests merged: <link to meaningful PR or GitHub Issue>
      • DEV - Upstream documentation merged: <link to meaningful PR or GitHub Issue>
      • DEV - Downstream build attached to advisory: <link to errata>
      • QE - Test plans in Polarion: <link or reference to Polarion>
      • QE - Automated tests merged: <link or reference to automated tests>
      • DOC - Downstream documentation merged: <link to meaningful PR>

              fmissi Flavian Missi
              DanielMesser Daniel Messer
              Wen Wang Wen Wang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: