Remove kolla entrypoint pattern, harden SecurityContext - #623
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 58m 19s |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 12m 47s |
Remove kolla_start / kolla config.json / KOLLA_CONFIG_STRATEGY from all
manila workloads (API, scheduler, share, dbsync job, cronjob). Each
service binary is now launched directly:
- manila-api: /usr/sbin/httpd -DFOREGROUND
- manila-scheduler: /usr/bin/manila-scheduler --config-dir ...
- manila-share: /usr/bin/manila-share --config-dir ...
Config files (httpd.conf, 10-manila_wsgi.conf) are mounted directly via
SubPath from the config-data secret instead of being copied by kolla at
startup. The deleted kolla config.json templates and the ssl.conf common
template reference are no longer needed.
Harden the security posture:
- Replace inline SecurityContext with pod.RestrictivePodSecurityContext
and pod.RestrictiveSecurityContext from lib-common (using
serviceuser.ManilaUID / serviceuser.ApacheGID).
- Add AutomountServiceAccountToken: ptr.To(false) to all workload
PodSpecs (API statefulset, scheduler statefulset, share statefulset,
dbsync job, db-purge cronjob).
- Change secret DefaultMode from 0644/0640 to 0440 across all volume
definitions using a package-level configMode variable.
- Switch SCC requirement from anyuid to hostmount-anyuid + nonroot-v2.
Adopt lib-common volume helpers:
- Replace inline emptyDir volumes/mounts for run-httpd, var-log-httpd,
and logs with volume.WritableDirVolume / volume.WritableDirVolumeMount
from lib-common/modules/common/volume.
- Remove GetConfigSecretVolumes (replaced by volume.ConfigSecretVolumes
in lib-common).
- Fix run-httpd mount path from /etc/httpd/run to the canonical
/run/httpd (matching lib-common's volume.RunHttpdMountPath constant).
Update httpd.conf to run as manila:manila (not apache:apache) since
containers no longer start as root.
Remove ManilaUserID / ManilaGroupID constants (replaced by
serviceuser.ManilaUID from lib-common).
Update MTLS volume mounts to use explicit cert/key mount paths instead
of nil (matching the infra-operator API change).
Update kuttl and functional tests to match the new volume counts,
mount paths, commands, and security context.
Jira: OSPRH-33504
Jira: OSPRH-33503
Depends-On: openstack-k8s-operators/lib-common#728
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 12m 35s |
|
/test functional |
|
recheck |
|
@stuggi: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Remove kolla_start / kolla config.json / KOLLA_CONFIG_STRATEGY from all manila workloads (API, scheduler, share, dbsync job, cronjob). Each service binary is now launched directly:
Config files (httpd.conf, 10-manila_wsgi.conf) are mounted directly via SubPath from the config-data secret instead of being copied by kolla at startup. The deleted kolla config.json templates and the ssl.conf common template reference are no longer needed.
Harden the security posture:
Adopt lib-common volume helpers:
Update httpd.conf to run as manila:manila (not apache:apache) since containers no longer start as root.
Remove ManilaUserID / ManilaGroupID constants (replaced by serviceuser.ManilaUID from lib-common).
Update MTLS volume mounts to use explicit cert/key mount paths instead of nil (matching the infra-operator API change).
Update kuttl and functional tests to match the new volume counts, mount paths, commands, and security context.
Jira: OSPRH-33504
Jira: OSPRH-33503
Depends-On: openstack-k8s-operators/lib-common#728