-
Bug
-
Resolution: Done
-
Critical
-
Logging 5.4.1
-
False
-
None
-
False
-
NEW
-
VERIFIED
-
-
-
Log Collection - Sprint 225
From https://kubernetes.io/docs/concepts/security/pod-security-admission/
In v1.23(OCP 4.11), the PodSecurity feature gate is a Beta feature and is enabled by default.
The below logging containers violate PodSecurity
Collector:
seLinuxOptions (containers "collector", "logfilesmetricexporter" set forbidden securityContext.seLinuxOptions: type "spc_t"), unrestricted capabilities (containers "collector", "logfilesmetricexporter" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volumes "varlog", "varlogcontainers", "varlogpods", "varlogjournal", "varlogaudit", "varlogovn", "varlogoauthapiserver", "varlogopenshiftapiserver", "varlogkubeapiserver", "localtime", "datadir" use restricted volume type "hostPath"), restricted volume types (volumes "varlog", "varlogcontainers", "varlogpods", "varlogjournal", "varlogaudit", "varlogovn", "varlogoauthapiserver", "varlogopenshiftapiserver", "varlogkubeapiserver", "localtime", "filebufferstorage" use restricted volume type "hostPath"), runAsNonRoot != true (pod or containers "collector", "logfilesmetricexporter" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "collector", "logfilesmetricexporter" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
cluster-logging-operator:
allowPrivilegeEscalation != false (container "cluster-logging-operator" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "cluster-logging-operator" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "cluster-logging-operator" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "cluster-logging-operator" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")