Remove kolla entrypoint pattern, harden SecurityContext - #695
Conversation
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 45m 09s |
ffcc8f8 to
0dbe030
Compare
|
This change depends on a change that failed to merge. Changes openstack-k8s-operators/lib-common#732, openstack-k8s-operators/s2i-openstack-containers#46 are needed. |
|
recheck |
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/lib-common#728 is needed. |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 45m 07s |
|
recheck |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 15m 15s |
|
recheck |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 14m 00s |
| // runOnHostVolumeMount returns a VolumeMount that shims a host storage binary | ||
| // via the "scripts" secret's run-on-host nsenter wrapper, so cinder-backup can | ||
| // invoke host-installed multipath/iscsi tooling from inside the container | ||
| // (the pod already runs with HostPID: true). | ||
| func runOnHostVolumeMount(destPath string) corev1.VolumeMount { | ||
| return corev1.VolumeMount{ | ||
| Name: "scripts", | ||
| MountPath: destPath, | ||
| SubPath: "run-on-host", | ||
| } | ||
| } |
There was a problem hiding this comment.
This seems like a duplicate of cindervolumes/volumes.go's function of the same name. Maybe could be moved to cinder/volumes.go?
There was a problem hiding this comment.
sure, yes makes sense!
Eliminate kolla_start/kolla_set_configs and the config.json staging pattern across all 4 cinder workloads (api, scheduler, volume, backup). Configs are now mounted directly to final paths via SubPath volume mounts, removing the need for root privilege escalation at container startup. Cinder's Pattern A conf.d-overlay config mechanism (parent Cinder CR renders global config, each child merges its own snippets into cinder.conf.d) is native to cinder/oslo.config and untouched by this change. Key changes: - Replace kolla_start with direct commands per workload (httpd -DFOREGROUND, cinder-scheduler/-volume/-backup --config-dir) - Remove all KOLLA_CONFIG_STRATEGY env vars and the 5 kolla config.json templates - Mount configs via SubPath to /etc/cinder/, /etc/httpd/, /etc/my.cnf - Mount ssl.conf from lib-common CommonTemplates at /etc/httpd/conf.d/ssl.conf to override the RPM-shipped default (which references the non-existent localhost.crt) - Replace kolla's run-on-host shim copy (multipath/iscsi/lvm tooling for cinder-volume/backup) with SubPath mounts of the existing scripts secret at each host-binary destination path - Use pod.RestrictiveSecurityContext and RestrictivePodSecurityContext from lib-common for cinder-api/scheduler and both probe sidecars; cinder-volume/backup keep Privileged: true (genuine LVM/iSCSI/ multipath device access need) but now pin RunAsUser/RunAsGroup/ RunAsNonRoot instead of defaulting to root - Set AutomountServiceAccountToken=false on all workloads - Import CinderUID from lib-common modules/serviceuser, drop the now-unused local CinderUserID/CinderGroupID constants - Override TLS CertMount/KeyMount to /etc/pki/tls/ for cinder-api - Migrate SCC rbacRules from [anyuid, privileged] to [privileged, nonroot-v2] — anyuid is no longer needed anywhere in this repo - Harden the db-sync/online-data-migrations Job (previously RunAsUser: 0) and db-purge CronJob to the same restrictive context - Standardize all config-data secret DefaultMode to 0440 (owner-read + group-read) across every volume definition - Adopt lib-common volume.WritableDirVolume/WritableDirVolumeMount helpers for all emptyDir volumes (tmp, run-httpd, logs), replacing inline EmptyDir constructions with standardized constants - Update httpd.conf: User/Group cinder, PidFile /run/httpd/httpd.pid, ErrorLog to stderr - Update functional and kuttl tests Jira: OSPRH-33504 Jira: OSPRH-33503 Depends-On: openstack-k8s-operators/lib-common#728 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abays, fmount, stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
114b7c2
into
openstack-k8s-operators:main
3 participants
Eliminate kolla_start/kolla_set_configs and the config.json staging pattern across all 4 cinder workloads (api, scheduler, volume, backup). Configs are now mounted directly to final paths via SubPath volume mounts, removing the need for root privilege escalation at container startup. Cinder's Pattern A conf.d-overlay config mechanism (parent Cinder CR renders global config, each child merges its own snippets into cinder.conf.d) is native to cinder/oslo.config and untouched by this change.
Key changes:
Jira: OSPRH-33504
Jira: OSPRH-33503
Depends-On: openstack-k8s-operators/lib-common#728