Uploaded image for project: 'OpenShift Migration Toolkit for Containers'
  1. OpenShift Migration Toolkit for Containers
  2. MIG-560

Descope rsync-anyuid SCC to least privilege

XMLWordPrintable

    • Icon: Task Task
    • Resolution: Done
    • Icon: Minor Minor
    • MTC 1.4.3
    • None
    • None
    • False
    • False
    • Passed
    • Undefined

      Rsync-anyuid SCC is now only granted a minimal set of capabilities needed for rsync to operate without any restrictions. Before this story, the SCC had additional privileges. Here is the link to a doc to better understand what changes were made and why, and how to test the results of the changes made.

      To Test the changes and verify that scrapping privileges did not affect migration at all, do the following:

      1. Run a migration with DVM enables and pvcs. Make sure the containers of the pods on which the pvcs are mounted are not running with root user
      2. ssh inside the containers on source and destination clusters, and verify that file permissions and uid/guid of the files are intact and uid/guid are the same as the uid/guid of the pod/container user

      Note: Make sure to run a migration with DVM where storage class of pvc remain same for destination and source cluster.

              jgabani@redhat.com Jaydipkumar Gabani (Inactive)
              ernelson@redhat.com Erik Nelson (Inactive)
              Xin Jiang Xin Jiang
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: