Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-4787

SPO does not merge recorded policies per-container but per pod with mergeStrategy=containers

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Critical Critical
    • None
    • 4.12.0
    • None
    • Critical
    • None
    • 2
    • CMP Sprint 57, CMP Sprint 58
    • 2
    • Proposed
    • False
    • Hide

      None

      Show
      None

      Description of problem:

      When using a profilerecorder with mergeStrategy=containers we expect the number of merged policies to be equal the number of containers in the recorded app. That was not the case though and SPO always created one per-pod policy

      Version-Release number of selected component (if applicable):

      0.5.0 and later

      How reproducible:

      always

      Steps to Reproduce:

      1. create a profileRecording with mergeStrategy=containers
      like this one:
      apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
      kind: ProfileRecording
      metadata:
        name: test-recording
        namespace: mytest
      spec:
        kind: SelinuxProfile
        recorder: logs
        mergeStrategy: containers
        podSelector:
          matchLabels:
            app: hello-openshift 
      2. create a deployment
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: hello-openshift
        namespace: mytest
      spec:
        replicas: 3
        selector:
          matchLabels:
            app: hello-openshift
        template:
          metadata:
            labels:
              app: hello-openshift
          spec:
            serviceAccountName: spo-record-sa
            initContainers:
            - name: wait
              image: quay.io/openshifttest/centos:centos7
              command: ["/bin/sh", "-c", "env"]
            containers:
            - name: hello-openshift
              image: quay.io/openshifttest/hello-openshift:multiarch
              ports:
              - containerPort: 8080
              readinessProbe:
                tcpSocket:
                  port: 8080
                initialDelaySeconds: 5
                periodSeconds: 5
            - name: hello-openshift2
              image: quay.io/openshifttest/hello-openshift:multiarch-fedora
              ports:
              - containerPort: 8081
              readinessProbe:
                tcpSocket:
                  port: 8081
                initialDelaySeconds: 5
                periodSeconds: 5
       3. wait until the deployment is ready, then delete the deployment, then delete the recording
      

      Actual results:

      one policy is merged called test-recording-hello-openshift

      Expected results:

      two policies are merged called test-recording-hello-openshift and test-recording-hello-openshift2

      Additional info:

       

              jhrozek@redhat.com Jakub Hrozek (Inactive)
              jhrozek@redhat.com Jakub Hrozek (Inactive)
              Xiaojie Yuan Xiaojie Yuan
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: