Remove kolla entrypoint pattern, harden SecurityContext by stuggi · Pull Request #768 · openstack-k8s-operators/ironic-operator

stuggi · 2026-08-06T11:09:15Z

Replaces the kolla_start/kolla_set_configs/config.json staging pattern with direct volume mounts to final config paths and direct service commands, across ironic-api, ironic-conductor, ironic-inspector, ironic-neutron-agent, and both db-sync jobs.

RBAC: IronicAPI/Conductor/Inspector/NeutronAgent share one ServiceAccount/Role when owned by the parent Ironic CR, so they cannot get independently different SCC grants. The shared Role grants anyuid;privileged;nonroot-v2 -- conductor/inspector genuinely need anyuid+privileged for PXE chroot (SYS_CHROOT/SETFCAP) and DHCP/TFTP sub-1024-port binding (NET_ADMIN/NET_RAW), while nonroot-v2 is included to match every other operator in the effort.

Mixed-privilege pods (conductor, inspector) carry a pod-level RestrictivePodSecurityContext for their non-root siblings, with dnsmasq and pxe-init explicitly overriding RunAsUser/RunAsNonRoot back to root on their own container SecurityContext. Both dnsmasq and pxe-init Drop ALL capabilities first, then add back only the specific caps they need (NET_ADMIN/NET_RAW for dnsmasq, SYS_CHROOT/SETFCAP for pxe-init).

AutomountServiceAccountToken set to false on all workloads including conductor -- get_net_ip reads network status from the DownwardAPI volume (/etc/podinfo/network-status), not from the k8s API.

Writable paths:

run-httpd emptyDir added to conductor (was missing entirely) and mount added to both conductor's and inspector's httpboot containers -- httpd cannot write its PID file without writable /run/httpd
Adopts lib-common volume.WritableDirVolume/WritableDirVolumeMount helpers with constants for run-httpd, string literals for ironic-specific volumes (var-lib-ironic, logs, etc.)

Config secret DefaultMode tightened from 0640 to 0440.

Also fixes: the standard TLS cert/key staging-path bug on ironic-api's and ironic-inspector's httpd; httpd.conf User/Group changed from apache to ironic on ironic-api specifically, matching its pre-existing WSGIDaemonProcess user=ironic evidence, while ironic-inspector's proxy httpd and both httpboot instances keep apache (no such evidence).

Config delivery uses three variants of the EmptyDir-seed pattern: plain final-path Secret SubPath mounts, a single merged file written by the init container's crudini-merge step
(03-init-container-conductor.conf), and a dynamically pxe-init-generated dnsmasq.conf -- all safe because the writer runs in an earlier container through a whole-directory mount.

dbsync.sh had only its one kolla-specific line
(sudo -E kolla_set_configs) removed.

Jira: OSPRH-33504
Jira: OSPRH-33503

Depends-On: openstack-k8s-operators/lib-common#728

Describe your changes

Jira Ticket Link

Jira:

Checklist before requesting a review

I have performed a self-review of my code and confirmed it passes tests
Performed pre-commit run --all
Tested operator image in a test/dev environment. It can be CRC via install_yamls or a hotstack instance (optional)
Verified that no failures present in logs(optional):
- ironic-operator-build-deploy-kuttl
- podified-multinode-ironic-deployment

centosinfra-prod-github-app · 2026-08-06T13:25:27Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/4fb67c361b2448fd9f74d982983e0616

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 30m 38s
❌ podified-multinode-ironic-deployment FAILURE in 1h 08m 57s

centosinfra-prod-github-app · 2026-08-06T15:47:14Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/6a0fafb01235444994490e7585f8f6d4

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 39m 42s
❌ podified-multinode-ironic-deployment FAILURE in 1h 17m 50s

centosinfra-prod-github-app · 2026-08-06T18:08:08Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/7651f3504a334d30956dd2ac1b40898f

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 53m 11s
❌ podified-multinode-ironic-deployment FAILURE in 1h 11m 43s

centosinfra-prod-github-app · 2026-08-07T09:24:10Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/ad156c2fc68945e1812cc0c088f602c5

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 00m 50s
❌ podified-multinode-ironic-deployment FAILURE in 1h 15m 45s

centosinfra-prod-github-app · 2026-08-07T13:52:25Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/63bbf92513574dd389aa7a4ece6fdbfe

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 03m 37s
❌ podified-multinode-ironic-deployment FAILURE in 1h 16m 14s

stuggi · 2026-08-07T15:19:41Z

/retest

centosinfra-prod-github-app · 2026-08-10T12:48:14Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/b8b01baab1fa451186642b11cc9428e2

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 04m 52s
❌ podified-multinode-ironic-deployment NODE_FAILURE Node(set) request 099-0000165990 failed in 0s

centosinfra-prod-github-app · 2026-08-10T15:39:49Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/e1d73ec9bff548fb8025f014a3b72a79

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 00m 42s
❌ podified-multinode-ironic-deployment FAILURE in 1h 15m 03s

stuggi · 2026-08-12T11:27:37Z

/retest

stuggi · 2026-08-12T12:30:05Z

/test precommit-check

centosinfra-prod-github-app · 2026-08-12T17:26:42Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/c9b13ea5432a49c39f1d2bbca20deaa3

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 47m 50s
❌ podified-multinode-ironic-deployment FAILURE in 55m 38s

stuggi · 2026-08-12T20:51:50Z

recheck

centosinfra-prod-github-app · 2026-08-12T20:58:38Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/5be2383893f641bc8cdef0a377f410dc

❌ openstack-k8s-operators-content-provider FAILURE in 5m 45s
⚠️ podified-multinode-ironic-deployment SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

stuggi · 2026-08-13T06:49:18Z

recheck

stuggi · 2026-08-17T12:53:29Z

/test ironic-operator-build-deploy-kuttl

stuggi · 2026-08-18T07:57:19Z

/test ironic-operator-build-deploy-kuttl

stuggi · 2026-08-18T07:57:24Z

recheck

stuggi · 2026-08-19T11:51:36Z

@hjensas @steveb please have a look at this when you have time

steveb · 2026-08-19T22:50:28Z

+			// container's own explicit fields override the pod-level
+			// default, exempting dnsmasq specifically.
 			SecurityContext: &corev1.SecurityContext{
+				RunAsUser:    ptr.To(int64(0)),


We need to merge #779 first and backport it to stable-18, so you'll likely need to rebase this when it is merged

steveb · 2026-08-19T22:52:48Z

This looks good to me. After #779 is merged I'm happy for this to land.

Replaces the kolla_start/kolla_set_configs/config.json staging pattern with direct volume mounts to final config paths and direct service commands, across ironic-api, ironic-conductor, ironic-inspector, ironic-neutron-agent, and both db-sync jobs. RBAC: IronicAPI/Conductor/Inspector/NeutronAgent share one ServiceAccount/Role when owned by the parent Ironic CR, so they cannot get independently different SCC grants. The shared Role grants anyuid;privileged;nonroot-v2 -- conductor/inspector genuinely need anyuid+privileged for PXE chroot (SYS_CHROOT/SETFCAP) and DHCP/TFTP sub-1024-port binding (NET_ADMIN/NET_RAW), while nonroot-v2 is included to match every other operator in the effort. Mixed-privilege pods (conductor, inspector) carry a pod-level RestrictivePodSecurityContext for their non-root siblings, with dnsmasq and pxe-init explicitly overriding RunAsUser/RunAsNonRoot back to root on their own container SecurityContext. Both dnsmasq and pxe-init Drop ALL capabilities first, then add back only the specific caps they need (NET_ADMIN/NET_RAW for dnsmasq, SYS_CHROOT/SETFCAP for pxe-init). AutomountServiceAccountToken set to false on all workloads including conductor -- get_net_ip reads network status from the DownwardAPI volume (/etc/podinfo/network-status), not from the k8s API. Writable paths: - run-httpd emptyDir added to conductor (was missing entirely) and mount added to both conductor's and inspector's httpboot containers -- httpd cannot write its PID file without writable /run/httpd - Adopts lib-common volume.WritableDirVolume/WritableDirVolumeMount helpers with constants for run-httpd, string literals for ironic-specific volumes (var-lib-ironic, logs, etc.) Config secret DefaultMode tightened from 0640 to 0440. Also fixes: the standard TLS cert/key staging-path bug on ironic-api's and ironic-inspector's httpd; httpd.conf User/Group changed from apache to ironic on ironic-api specifically, matching its pre-existing WSGIDaemonProcess user=ironic evidence, while ironic-inspector's proxy httpd and both httpboot instances keep apache (no such evidence). Config delivery uses three variants of the EmptyDir-seed pattern: plain final-path Secret SubPath mounts, a single merged file written by the init container's crudini-merge step (03-init-container-conductor.conf), and a dynamically pxe-init-generated dnsmasq.conf -- all safe because the writer runs in an earlier container through a whole-directory mount. dbsync.sh had only its one kolla-specific line (sudo -E kolla_set_configs) removed. Jira: OSPRH-33504 Jira: OSPRH-33503 Depends-On: openstack-k8s-operators/lib-common#728 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Martin Schuppert <mschuppert@redhat.com>

stuggi · 2026-08-20T08:08:00Z

This looks good to me. After #779 is merged I'm happy for this to land.

thanks, I rebased it

abays · 2026-08-20T09:16:12Z


-	args := []string{"-c", DBSyncCommand}
-
 	envVars := map[string]env.Setter{}


Could probably drop this since it's not used anymore, but I'm fine with leaving it and having someone clean it up later if they want.

abays

/lgtm

openshift-ci · 2026-08-20T09:17:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abays, stuggi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [abays,stuggi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

stuggi added the do-not-merge/hold label Aug 6, 2026

openshift-ci Bot requested review from juliakreger and steveb August 6, 2026 11:09

openshift-ci Bot added the approved label Aug 6, 2026

stuggi force-pushed the remove-kolla branch from 59564f2 to c91ad63 Compare August 6, 2026 11:47

stuggi force-pushed the remove-kolla branch from c91ad63 to 0ca649a Compare August 6, 2026 14:05

stuggi force-pushed the remove-kolla branch from 0ca649a to 255a79c Compare August 6, 2026 16:08

stuggi force-pushed the remove-kolla branch from 255a79c to ac4df89 Compare August 7, 2026 07:17

stuggi force-pushed the remove-kolla branch from ac4df89 to 16eb799 Compare August 7, 2026 11:46

openshift-ci Bot added the needs-rebase label Aug 9, 2026

stuggi force-pushed the remove-kolla branch from 16eb799 to 18a276a Compare August 10, 2026 11:41

openshift-ci Bot removed the needs-rebase label Aug 10, 2026

stuggi force-pushed the remove-kolla branch from 971852b to b9c468b Compare August 12, 2026 10:32

stuggi force-pushed the remove-kolla branch from b9c468b to e038e54 Compare August 12, 2026 15:10

stuggi force-pushed the remove-kolla branch from e038e54 to 582cfe1 Compare August 14, 2026 07:21

stuggi requested a review from hjensas August 14, 2026 10:23

openshift-ci Bot added the needs-rebase label Aug 15, 2026

stuggi force-pushed the remove-kolla branch from 582cfe1 to fffbae2 Compare August 17, 2026 09:07

openshift-ci Bot removed the needs-rebase label Aug 17, 2026

stuggi removed the do-not-merge/hold label Aug 19, 2026

steveb reviewed Aug 19, 2026

View reviewed changes

openshift-ci Bot added the needs-rebase label Aug 20, 2026

stuggi force-pushed the remove-kolla branch from fffbae2 to 9946c94 Compare August 20, 2026 05:48

openshift-ci Bot removed the needs-rebase label Aug 20, 2026

abays reviewed Aug 20, 2026

View reviewed changes

abays approved these changes Aug 20, 2026

View reviewed changes

openshift-ci Bot assigned abays Aug 20, 2026

openshift-ci Bot added the lgtm label Aug 20, 2026

openshift-merge-bot Bot merged commit 5247e6e into openstack-k8s-operators:main Aug 20, 2026
8 checks passed

stuggi mentioned this pull request Aug 20, 2026

Drop ALL capabilities in inspector-pxe-init container #788

Merged

6 tasks


		args := []string{"-c", DBSyncCommand}

		envVars := map[string]env.Setter{}

Uh oh!

Conversation

stuggi commented Aug 6, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Describe your changes

Jira Ticket Link

Checklist before requesting a review

Uh oh!

centosinfra-prod-github-app Bot commented Aug 6, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 6, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 6, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 7, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 7, 2026

Uh oh!

stuggi commented Aug 7, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 10, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 10, 2026

Uh oh!

stuggi commented Aug 12, 2026

Uh oh!

stuggi commented Aug 12, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 12, 2026

Uh oh!

stuggi commented Aug 12, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 12, 2026

Uh oh!

stuggi commented Aug 13, 2026

Uh oh!

stuggi commented Aug 17, 2026

Uh oh!

stuggi commented Aug 18, 2026

Uh oh!

stuggi commented Aug 18, 2026

Uh oh!

stuggi commented Aug 19, 2026

Uh oh!

steveb Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

steveb commented Aug 19, 2026

Uh oh!

stuggi commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

abays Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

abays left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Aug 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

stuggi commented Aug 6, 2026 •

edited by openshift-ci Bot

Loading

stuggi commented Aug 20, 2026 •

edited

Loading