Fix for test case operator-install-status-no-privileges. #1665
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
With this fix, the test case fails when resourceName's rules have been found in the CSV's clusterPermissions field and the operator was not cluster-wide installed. Also, minor refactor to use a helper pointer to the env.Operators[i].
edcdavid
reviewed
Nov 28, 2023
Apetree100122
approved these changes
Dec 27, 2023
Apetree100122
approved these changes
Jan 5, 2024
|
from change #1665: |
|
/dci-rerun |
|
from change #1665: |
The original motivation for this test case was checking whether the operator wasn't creating any SA with RBAC rules related to SCC. The implementation was wrong as it was (only) checking the resourceNames list to be empty to pass. But empty list means that any resourceName is allowed (as per k8s docs). Since it's impossible to predict all the "privileged" SCCs that might have been created in the cluster apart from the default ones, this new implementation is another "canary in the mine" check so we can flag operators that try to use/create cluster's SCCs. Operators will need to justify the SCC accesses in their SAs.
|
from change #1665: |
edcdavid
reviewed
Apr 4, 2024
edcdavid
approved these changes
Apr 4, 2024
Also, minor refactor to remove the need for the helper var securityResourceFound.
|
from change #1665: |
sebrandon1
approved these changes
Apr 10, 2024
sebrandon1
merged commit f1ce203
into
redhat-best-practices-for-k8s:main
22 checks passed
|
from change #1665: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The original motivation for this test case was checking whether the
operator wasn't creating any SA with RBAC rules related to SCC.
The implementation was wrong as it was (only) checking the resourceNames
list to be empty to pass. But empty list means that any resourceName is
allowed (as per k8s docs).
Since it's impossible to predict all the "privileged" SCCs that might
have been created in the cluster apart from the default ones, this new
implementation is another "canary in the mine" check so we can flag
operators that try to use/create cluster's SCCs.
Operators will need to justify the SCC accesses in their SAs.