security requirements of the container-native operators #1967
Conversation
shimritproj
force-pushed
the
securityOperators
branch
from
1fbed6f to
651df13
Compare
|
from change #1967: |
|
@shimritproj could you add this new test to the CATALOG.md? Thanks |
shimritproj
force-pushed
the
securityOperators
branch
from
651df13 to
e7b8a0c
Compare
shimritproj
force-pushed
the
securityOperators
branch
6 times, most recently
from
b9b2eb3 to
1deda2b
Compare
shimritproj
force-pushed
the
securityOperators
branch
from
1deda2b to
a976e0f
Compare
|
from change #1967: |
Don't know if it's expected, but the four new tests added in this change are all skipped in this DCI job. Are they behaving properly? |
shimritproj
force-pushed
the
securityOperators
branch
from
a976e0f to
584eca9
Compare
|
from change #1967: |
I am aware of the issue and actively working on it. This is why I indicated that the PR is still a work in progress and not yet ready for review. @ramperher |
|
from change #1967: |
|
/dci-rerun |
shimritproj
force-pushed
the
securityOperators
branch
2 times, most recently
from
c5b705e to
438c545
Compare
…ve operators
checks:
USER id should not be 0
readOnlyRootFilesystem = true
runAsNonRoot = true
automount service account token = false{}
shimritproj
force-pushed
the
securityOperators
branch
from
4750d6e to
44ef823
Compare
|
from change #1967: |
shimritproj
force-pushed
the
securityOperators
branch
from
b90c555 to
930d983
Compare
|
@ramperher Does this mean that if we rekick the DCI job the error is handled now as an expected failure? |
Exactly, we're running an operator that is not under our control, so I assume the tests that were failing before must be considered as exceptions. |
|
/dci-rerun |
|
from change #1967: |
sebrandon1
merged commit 7c0ddf6
into
redhat-best-practices-for-k8s:main
|
from change #1967: |
Issue Link
https://issues.redhat.com/browse/CNFCERT-882?filter=-1
This PR includes 4 operator test cases.
testOperatorPodsRunAsUserID(): This test verifies that no pods managed by operators run with the root user ID (UID) of 0, which could introduce security vulnerabilities.
testOperatorPodsRunAsNonRoot(): This test ensures that pods managed by operators adhere to security best practices by running as non-root users.
testOperatorPodsAutomountTokens(): This test evaluates the configuration of automount service tokens in pods managed by operators.
testOperatorContainersReadOnlyFilesystem(): This test verifies whether containers within pods managed by operators have a read-only root filesystem, enhancing security by preventing unauthorized modifications.
We get pods of all operators and then test the above conditions.
In addition, the 'rbac' folder moved into the 'common' folder because it is used by functions in many places in the code, and we want to avoid duplicating code.
build-depends: https://github.com/dci-labs/dallas-pipelines/pull/1159