Remove kolla entrypoint pattern from Cyborg, harden SecurityContext - #1182
Remove kolla entrypoint pattern from Cyborg, harden SecurityContext#1182stuggi wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
2710a4d to
277ae2c
Compare
|
Build failed (check pipeline). Post ✔️ openstack-meta-content-provider SUCCESS in 3h 28m 52s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-meta-content-provider SUCCESS in 3h 11m 17s |
|
recheck |
277ae2c to
e53f219
Compare
|
It'd be great if we can test this with #1143 |
I can rebase as soon it landed, or I should rebase on top of yours? |
|
Build failed (check pipeline). Post ✔️ openstack-meta-content-provider SUCCESS in 4h 23m 45s |
|
recheck |
e53f219 to
71e8bd2
Compare
|
rebased after #1181 merged |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
💤 Files with no reviewable changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughSummary by CodeRabbit
WalkthroughCyborg workloads now use shared read-only configuration mounts, restrictive security contexts, and direct process commands. Legacy Kolla configuration files, environment variables, and shell wrappers were removed. RBAC and tests now expect ChangesCyborg runtime hardening
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to The PR moves Cyborg configuration to direct mounts and tightens workload security settings; no actionable merge-blocking risk remains after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant ConfigSecret
participant CyborgWorkloads
participant CyborgProcesses
ConfigSecret->>CyborgWorkloads: Provide read-only final-path configuration mounts
CyborgWorkloads->>CyborgProcesses: Start direct API, conductor, or dbsync commands
CyborgProcesses->>CyborgWorkloads: Write permitted runtime and log files
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
71e8bd2 to
9123624
Compare
|
rebased after #1143 merged |
|
Build failed (check pipeline). Post ✔️ openstack-meta-content-provider SUCCESS in 3h 51m 37s |
Eliminate kolla_start and the config.json staging pattern for the
CyborgAPI, CyborgConductor and DB sync workloads. Configs are now
mounted directly to their final paths via SubPath volume mounts,
removing the need for root privilege escalation at container startup.
Standalone branch mirroring the Cyborg portion of the combined
kolla-removal-test branch (which also migrated Nova and Placement), so
Cyborg can be pushed and tested independently -- see sibling
remove-kolla-nova and remove-kolla-placement branches, based on the
same commit. Nova and Placement are still kolla-based here, so
internal/common.ServiceCommand is intentionally kept: it is still
their only consumer on this branch.
Key changes:
- CyborgAPI: replace "/bin/bash -c kolla_start" with
"/usr/sbin/httpd -DFOREGROUND"
- CyborgConductor: replace kolla_start with
"cyborg-conductor --config-dir /etc/cyborg/cyborg.conf.d"
- DB sync: replace kolla_start with
"cyborg-dbsync --config-dir /etc/cyborg/cyborg.conf.d/ upgrade"
- Remove KOLLA_CONFIG_STRATEGY/KOLLA_BOOTSTRAP env vars
- Delete cyborg-api-config.json, cyborg-conductor-config.json,
cyborg-dbsync-config.json (no longer needed)
- Mount 00-default.conf/01-service-custom.conf (only added when
CustomServiceConfig is set) directly under
/etc/cyborg/cyborg.conf.d/, plus /etc/my.cnf, via new
cyborg.GetConfVolumeMounts() shared by API/Conductor/DB sync
- CyborgAPI: add run-httpd and var-log-httpd emptyDir volumes
(kolla used to chown /etc/httpd/run and /var/log/httpd at startup)
- Use pod.RestrictiveSecurityContext/RestrictivePodSecurityContext
from lib-common for all three workloads, passing users.CyborgUID
and users.CyborgGID from lib-common modules/users
(replaces the local CyborgUserID constant) -- the lib-common revision
this pulls in takes an explicit gid parameter instead of deriving it
from uid
- httpd.conf: User/Group apache -> cyborg, matching the pre-existing
WSGIDaemonProcess user=cyborg group=cyborg evidence
- Override TLS CertMount/KeyMount to /etc/pki/tls/{certs,private}/,
matching what 10-cyborg-wsgi-main.conf's SSLCertificateFile/
SSLCertificateKeyFile actually render -- svc.CreateVolumeMounts()
otherwise defaults to lib-common's staging path, which nothing
copies from once kolla's config.json is gone
- RBAC: SCC anyuid -> nonroot-v2 (marker + rbacRules)
Security hardening (standardized across remove-kolla effort):
- DefaultMode 0440 for all config Secret volumes (configMode in
volumes.go, dbsync config-data volume), replacing 0640/0644 --
group-write is unnecessary since configs are immutable at runtime
- AutomountServiceAccountToken: ptr.To(false) on all three workloads
(CyborgAPI, CyborgConductor, DB sync) -- no container needs the
projected service-account token
- Adopt lib-common volume.WritableDirVolume/WritableDirVolumeMount
helpers for logs, run-httpd, var-log-httpd emptyDir volumes,
replacing local GetLogVolume/GetLogVolumeMount/GetRunHttpdVolume/
GetVarLogHttpdVolume wrappers; remove now-redundant RunHttpdVolume
and VarLogHttpdVolume constants (use volume.RunHttpdVolumeName and
volume.VarLogHttpdVolumeName from lib-common instead)
- Update functional and kuttl tests for the new mount paths and SCC
Jira: OSPRH-33504
Jira: OSPRH-33503
Depends-On: openstack-k8s-operators/lib-common#728
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
9123624 to
b8ac3a9
Compare
|
/test functional |
amartyasinha
left a comment
amartyasinha
left a comment
There was a problem hiding this comment.
+1 from my side. But will wait for @amoralej or @SeanMooney from Cyborg team to review.
3 participants
Eliminate kolla_start and the config.json staging pattern for the CyborgAPI, CyborgConductor and DB sync workloads. Configs are now mounted directly to their final paths via SubPath volume mounts, removing the need for root privilege escalation at container startup.
Standalone branch mirroring the Cyborg portion of the combined kolla-removal-test branch (which also migrated Nova and Placement), so Cyborg can be pushed and tested independently -- see sibling remove-kolla-nova and remove-kolla-placement branches, based on the same commit. Nova and Placement are still kolla-based here, so internal/common.ServiceCommand is intentionally kept: it is still their only consumer on this branch.
Key changes:
Security hardening (standardized across remove-kolla effort):
Jira: OSPRH-33504
Jira: OSPRH-33503
Depends-On: openstack-k8s-operators/lib-common#728