Merge pull request #728 from stuggi/remove-kolla

Add helpers for removing kolla

Author: abays

.pre-commit-config.yaml

@@ -19,6 +19,13 @@ repos:
       entry: make
       args: ['golangci']
       pass_filenames: false
+    - id: make-verify-uids-gids
+      name: make-verify-uids-gids
+      language: system
+      entry: make
+      args: ['verify-uids-gids']
+      pass_filenames: false
+      files: ^modules/users/registry\.go$
 
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v4.4.0

Makefile

@@ -98,8 +98,22 @@ ginkgo: $(GINKGO) ## Download ginkgo locally if necessary.
 $(GINKGO): $(LOCALBIN)
 	test -s $(LOCALBIN)/ginkgo || GOBIN=$(LOCALBIN) go install github.com/onsi/ginkgo/v2/ginkgo
 
+.PHONY: generate-uids-gids
+generate-uids-gids: ## Regenerate modules/users/zz_generated_uid_gid.yaml from Go constants.
+	cd modules/users && go run ./cmd/gen-uid-gid-yaml
+
+.PHONY: verify-uids-gids
+verify-uids-gids: ## Verify modules/users/zz_generated_uid_gid.yaml is up-to-date (fails if regeneration produces a diff).
+	@cp modules/users/zz_generated_uid_gid.yaml modules/users/zz_generated_uid_gid.yaml.bak
+	@$(MAKE) generate-uids-gids
+	@diff modules/users/zz_generated_uid_gid.yaml.bak modules/users/zz_generated_uid_gid.yaml || \
+		(echo ""; echo "ERROR: modules/users/zz_generated_uid_gid.yaml is out of date. Run 'make generate-uids-gids' and commit the result."; \
+		 mv modules/users/zz_generated_uid_gid.yaml.bak modules/users/zz_generated_uid_gid.yaml; exit 1)
+	@rm -f modules/users/zz_generated_uid_gid.yaml.bak
+	@echo "modules/users/zz_generated_uid_gid.yaml is up-to-date."
+
 .PHONY: generate
-generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
+generate: controller-gen generate-uids-gids ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
 	for mod in $(shell find modules/ -maxdepth 1 -mindepth 1 -type d); do \
 		$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./$$mod/..." ; \
 	done

modules/common/pod/security.go

@@ -22,17 +22,15 @@ import (
 )
 
 // RestrictiveSecurityContext returns a hardened container SecurityContext
-// suitable for unprivileged workloads. It sets RunAsNonRoot, drops all
-// capabilities, disables privilege escalation, and applies the RuntimeDefault
-// seccomp profile. The provided uid is used for both RunAsUser and RunAsGroup.
+// suitable for unprivileged workloads. It sets RunAsUser to uid, RunAsGroup
+// to gid, RunAsNonRoot, drops all capabilities, disables privilege escalation,
+// and applies the RuntimeDefault seccomp profile.
 // Optional addCapabilities are added back after dropping ALL.
-func RestrictiveSecurityContext(uid int64, addCapabilities ...corev1.Capability) *corev1.SecurityContext {
-	return RestrictiveSecurityContextWithGID(uid, uid, addCapabilities...)
-}
-
-// RestrictiveSecurityContextWithGID is like RestrictiveSecurityContext but
-// allows specifying a different GID.
-func RestrictiveSecurityContextWithGID(uid, gid int64, addCapabilities ...corev1.Capability) *corev1.SecurityContext {
+//
+// Does not set ReadOnlyRootFilesystem -- a future RestrictiveReadOnlySecurityContext
+// is the intended way for an individual service to opt into that later, without
+// changing this function's behavior for every existing caller.
+func RestrictiveSecurityContext(uid, gid int64, addCapabilities ...corev1.Capability) *corev1.SecurityContext {
 	caps := &corev1.Capabilities{
 		Drop: []corev1.Capability{"ALL"},
 	}
@@ -43,11 +41,57 @@ func RestrictiveSecurityContextWithGID(uid, gid int64, addCapabilities ...corev1
 		RunAsUser:                ptr.To(uid),
 		RunAsGroup:               ptr.To(gid),
 		RunAsNonRoot:             ptr.To(true),
-		ReadOnlyRootFilesystem:   ptr.To(true),
 		AllowPrivilegeEscalation: ptr.To(false),
 		Capabilities:             caps,
 		SeccompProfile: &corev1.SeccompProfile{
 			Type: corev1.SeccompProfileTypeRuntimeDefault,
 		},
 	}
 }
+
+// RestrictivePodSecurityContext returns a hardened PodSecurityContext for
+// unprivileged workloads. It sets RunAsUser to uid, RunAsGroup and FSGroup
+// to gid, RunAsNonRoot, and applies the RuntimeDefault seccomp profile.
+// FSGroup ensures that volumes mounted from Secrets/ConfigMaps are
+// group-readable by the service process without needing chown.
+//
+// Optional supplementalGroups grant additional GIDs to the pod — use this
+// when the workload needs to read files not covered by FSGroup, e.g.
+// RPM-shipped configs baked into the container image with restrictive
+// group ownership rather than mounted from a Secret/ConfigMap.
+func RestrictivePodSecurityContext(uid, gid int64, supplementalGroups ...int64) *corev1.PodSecurityContext {
+	return &corev1.PodSecurityContext{
+		RunAsUser:          ptr.To(uid),
+		RunAsGroup:         ptr.To(gid),
+		RunAsNonRoot:       ptr.To(true),
+		FSGroup:            ptr.To(gid),
+		SupplementalGroups: supplementalGroups,
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeRuntimeDefault,
+		},
+	}
+}
+
+// RestrictiveSecurityContextWithGID is an alias for RestrictiveSecurityContext.
+// Deprecated: use RestrictiveSecurityContext directly.
+func RestrictiveSecurityContextWithGID(uid, gid int64, addCapabilities ...corev1.Capability) *corev1.SecurityContext {
+	return RestrictiveSecurityContext(uid, gid, addCapabilities...)
+}
+
+// PrivilegedSecurityContext returns a SecurityContext for a workload that
+// needs full Privileged access to the host (e.g. LVM/iSCSI/multipath device
+// management via nsenter'd host binaries) and therefore cannot use
+// RestrictiveSecurityContext — Privileged is incompatible with
+// ReadOnlyRootFilesystem and capability dropping. RunAsUser is set to uid,
+// RunAsGroup to gid. RunAsNonRoot is only set when uid is non-zero, since
+// Kubernetes rejects a pod at admission if RunAsNonRoot is true while
+// RunAsUser is 0 — some privileged host tooling genuinely needs to run as
+// root.
+func PrivilegedSecurityContext(uid, gid int64) *corev1.SecurityContext {
+	return &corev1.SecurityContext{
+		RunAsUser:    ptr.To(uid),
+		RunAsGroup:   ptr.To(gid),
+		RunAsNonRoot: ptr.To(uid != 0),
+		Privileged:   ptr.To(true),
+	}
+}

modules/common/pod/security_test.go

@@ -24,13 +24,14 @@ import (
 
 func TestRestrictiveSecurityContext(t *testing.T) {
 	var uid int64 = 42457
-	sc := RestrictiveSecurityContext(uid)
+	var gid int64 = 42458
+	sc := RestrictiveSecurityContext(uid, gid)
 
 	if sc.RunAsUser == nil || *sc.RunAsUser != uid {
 		t.Errorf("expected RunAsUser %d, got %v", uid, sc.RunAsUser)
 	}
-	if sc.RunAsGroup == nil || *sc.RunAsGroup != uid {
-		t.Errorf("expected RunAsGroup %d, got %v", uid, sc.RunAsGroup)
+	if sc.RunAsGroup == nil || *sc.RunAsGroup != gid {
+		t.Errorf("expected RunAsGroup %d, got %v", gid, sc.RunAsGroup)
 	}
 	if sc.RunAsNonRoot == nil || !*sc.RunAsNonRoot {
 		t.Error("expected RunAsNonRoot true")
@@ -44,15 +45,52 @@ func TestRestrictiveSecurityContext(t *testing.T) {
 	if sc.SeccompProfile == nil || sc.SeccompProfile.Type != corev1.SeccompProfileTypeRuntimeDefault {
 		t.Errorf("expected SeccompProfile RuntimeDefault, got %v", sc.SeccompProfile)
 	}
-	if sc.ReadOnlyRootFilesystem == nil || !*sc.ReadOnlyRootFilesystem {
-		t.Error("expected ReadOnlyRootFilesystem true")
+	if sc.ReadOnlyRootFilesystem != nil {
+		t.Errorf("expected ReadOnlyRootFilesystem unset, got %v", sc.ReadOnlyRootFilesystem)
+	}
+}
+
+func TestRestrictivePodSecurityContext(t *testing.T) {
+	var uid int64 = 42425
+	var gid int64 = 42426
+	psc := RestrictivePodSecurityContext(uid, gid)
+
+	if psc.RunAsUser == nil || *psc.RunAsUser != uid {
+		t.Errorf("expected RunAsUser %d, got %v", uid, psc.RunAsUser)
+	}
+	if psc.RunAsGroup == nil || *psc.RunAsGroup != gid {
+		t.Errorf("expected RunAsGroup %d, got %v", gid, psc.RunAsGroup)
+	}
+	if psc.RunAsNonRoot == nil || !*psc.RunAsNonRoot {
+		t.Error("expected RunAsNonRoot true")
+	}
+	if psc.FSGroup == nil || *psc.FSGroup != gid {
+		t.Errorf("expected FSGroup %d, got %v", gid, psc.FSGroup)
+	}
+	if psc.SeccompProfile == nil || psc.SeccompProfile.Type != corev1.SeccompProfileTypeRuntimeDefault {
+		t.Errorf("expected SeccompProfile RuntimeDefault, got %v", psc.SeccompProfile)
+	}
+}
+
+func TestRestrictivePodSecurityContextNoSupplementalGroups(t *testing.T) {
+	psc := RestrictivePodSecurityContext(42425, 42425)
+	if psc.SupplementalGroups != nil {
+		t.Errorf("expected no SupplementalGroups, got %v", psc.SupplementalGroups)
 	}
 }
 
-func TestRestrictiveSecurityContextWithGID(t *testing.T) {
-	var uid int64 = 42415
-	var gid int64 = 42416
-	sc := RestrictiveSecurityContextWithGID(uid, gid)
+func TestRestrictivePodSecurityContextWithSupplementalGroups(t *testing.T) {
+	psc := RestrictivePodSecurityContext(42425, 42425, 48)
+
+	if len(psc.SupplementalGroups) != 1 || psc.SupplementalGroups[0] != 48 {
+		t.Errorf("expected SupplementalGroups [48], got %v", psc.SupplementalGroups)
+	}
+}
+
+func TestPrivilegedSecurityContext(t *testing.T) {
+	var uid int64 = 42407
+	var gid int64 = 42408
+	sc := PrivilegedSecurityContext(uid, gid)
 
 	if sc.RunAsUser == nil || *sc.RunAsUser != uid {
 		t.Errorf("expected RunAsUser %d, got %v", uid, sc.RunAsUser)
@@ -63,20 +101,37 @@ func TestRestrictiveSecurityContextWithGID(t *testing.T) {
 	if sc.RunAsNonRoot == nil || !*sc.RunAsNonRoot {
 		t.Error("expected RunAsNonRoot true")
 	}
-	if sc.AllowPrivilegeEscalation == nil || *sc.AllowPrivilegeEscalation {
-		t.Error("expected AllowPrivilegeEscalation false")
+	if sc.Privileged == nil || !*sc.Privileged {
+		t.Error("expected Privileged true")
+	}
+	if sc.Capabilities != nil {
+		t.Errorf("expected no Capabilities set, got %v", sc.Capabilities)
+	}
+	if sc.ReadOnlyRootFilesystem != nil {
+		t.Errorf("expected ReadOnlyRootFilesystem unset, got %v", sc.ReadOnlyRootFilesystem)
+	}
+}
+
+func TestPrivilegedSecurityContextRootUser(t *testing.T) {
+	sc := PrivilegedSecurityContext(0, 42408)
+
+	if sc.RunAsUser == nil || *sc.RunAsUser != 0 {
+		t.Errorf("expected RunAsUser 0, got %v", sc.RunAsUser)
+	}
+	if sc.RunAsNonRoot == nil || *sc.RunAsNonRoot {
+		t.Error("expected RunAsNonRoot false when uid is 0")
 	}
 }
 
 func TestRestrictiveSecurityContextNoAddCaps(t *testing.T) {
-	sc := RestrictiveSecurityContext(42457)
+	sc := RestrictiveSecurityContext(42457, 42457)
 	if sc.Capabilities.Add != nil {
 		t.Errorf("expected no Add capabilities, got %v", sc.Capabilities.Add)
 	}
 }
 
 func TestRestrictiveSecurityContextWithAddCaps(t *testing.T) {
-	sc := RestrictiveSecurityContext(42457, "NET_BIND_SERVICE", "CHOWN")
+	sc := RestrictiveSecurityContext(42457, 42457, "NET_BIND_SERVICE", "CHOWN")
 
 	if len(sc.Capabilities.Drop) != 1 || sc.Capabilities.Drop[0] != "ALL" {
 		t.Errorf("expected Drop [ALL], got %v", sc.Capabilities.Drop)

modules/common/util/templates/common/config/ssl.conf

@@ -8,7 +8,7 @@
   AddType application/x-pkcs7-crl    .crl
 
   SSLPassPhraseDialog builtin
-  SSLSessionCache "shmcb:/var/cache/mod_ssl/scache(512000)"
+  SSLSessionCache "shmcb:/run/httpd/ssl_scache(512000)"
   SSLSessionCacheTimeout 300
   Mutex default
   SSLCryptoDevice builtin

modules/common/volume/volume.go

@@ -0,0 +1,114 @@
+/*
+Copyright 2026 Red Hat
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package volume
+
+import (
+	"strconv"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+)
+
+const (
+	// RunHttpdVolumeName is the standard volume name for the httpd PID file directory.
+	RunHttpdVolumeName = "run-httpd"
+	// RunHttpdMountPath is the canonical mount path for the httpd PID directory.
+	RunHttpdMountPath = "/run/httpd"
+	// VarLogHttpdVolumeName is the standard volume name for the httpd log directory.
+	VarLogHttpdVolumeName = "var-log-httpd"
+	// VarLogHttpdMountPath is the mount path for the httpd log directory.
+	VarLogHttpdMountPath = "/var/log/httpd"
+	// TmpVolumeName is the standard volume name for /tmp.
+	TmpVolumeName = "tmp"
+	// TmpMountPath is the mount path for /tmp.
+	TmpMountPath = "/tmp"
+	// HomeDirCacheSubdir is the ".cache" subdirectory under a service's
+	// home directory. RHEL's python3-setuptools downstream patch caches
+	// iter_entry_points() scans under $HOME/.cache/python-entrypoints/
+	// on every process start. Needs a writable emptyDir mount when
+	// ReadOnlyRootFilesystem is enabled.
+	HomeDirCacheSubdir = ".cache"
+)
+
+// WritableDirVolume returns an emptyDir Volume. Used for any path that needs
+// to be writable by a non-root service user: /run/httpd (PID file),
+// /var/log/httpd, /var/log/<service>, /tmp, service home-dir subdirs, etc.
+// Pass an optional sizeLimit to cap the volume's ephemeral storage.
+func WritableDirVolume(name string, sizeLimit ...*resource.Quantity) corev1.Volume {
+	var limit *resource.Quantity
+	if len(sizeLimit) > 0 {
+		limit = sizeLimit[0]
+	}
+	return corev1.Volume{
+		Name: name,
+		VolumeSource: corev1.VolumeSource{
+			EmptyDir: &corev1.EmptyDirVolumeSource{SizeLimit: limit},
+		},
+	}
+}
+
+// WritableDirVolumeMount returns a VolumeMount for a writable emptyDir.
+func WritableDirVolumeMount(name, mountPath string) corev1.VolumeMount {
+	return corev1.VolumeMount{
+		Name:      name,
+		MountPath: mountPath,
+	}
+}
+
+// WritableDirSubPathMounts returns SubPath VolumeMounts onto the emptyDir
+// named volumeName for the given subdirectories of baseDir. Mounted via
+// SubPath rather than shadowing baseDir itself, since the image may bake
+// real content there (e.g. shell dotfiles under a service home directory).
+func WritableDirSubPathMounts(volumeName, baseDir string, subdirs ...string) []corev1.VolumeMount {
+	mounts := make([]corev1.VolumeMount, 0, len(subdirs))
+	for _, subdir := range subdirs {
+		mounts = append(mounts, corev1.VolumeMount{
+			Name:      volumeName,
+			MountPath: baseDir + "/" + subdir,
+			SubPath:   subdir,
+		})
+	}
+	return mounts
+}
+
+// ConfigSecretVolumes returns Volumes and VolumeMounts for a list of Secret
+// names, each mounted read-only at /var/lib/config-data/secret-{idx} with
+// DefaultMode 0440.
+func ConfigSecretVolumes(secretNames []string) ([]corev1.Volume, []corev1.VolumeMount) {
+	var configSecretMode int32 = 0440
+	volumes := make([]corev1.Volume, 0, len(secretNames))
+	mounts := make([]corev1.VolumeMount, 0, len(secretNames))
+
+	for idx, secretName := range secretNames {
+		volumes = append(volumes, corev1.Volume{
+			Name: secretName,
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					SecretName:  secretName,
+					DefaultMode: &configSecretMode,
+				},
+			},
+		})
+		mounts = append(mounts, corev1.VolumeMount{
+			Name:      secretName,
+			MountPath: "/var/lib/config-data/secret-" + strconv.Itoa(idx),
+			ReadOnly:  true,
+		})
+	}
+
+	return volumes, mounts
+}