Bug 2101444

Summary: kube-apiserver-operator should raise an alert when there is a Pod Security admission violation
Product: OpenShift Container Platform Reporter: Standa Laznicka <slaznick>
Component: apiserver-authAssignee: Standa Laznicka <slaznick>
Status: CLOSED ERRATA QA Contact: Xingxing Xia <xxia>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 4.11CC: mfojtik, surbania, wlewis, xxia
Target Milestone: ---Keywords: FastFix, NeedsTestCase
Target Release: 4.12.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: 2100155 Environment:
Last Closed: 2023-01-17 19:50:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2100155    

Comment 2 Yash Tripathi 2022-07-04 12:59:30 UTC 
Verified in 4.12.0-0.nightly-2022-07-02-041854

1. Create and label a namespace with pod-security.kubernetes.io/enforce=restricted
$ oc new-project testproj
$ oc label ns testproj pod-security.kubernetes.io/enforce=restricted

2. Create a sample pod that should get denied due to scc restrictions
$ oc create -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: testpod
spec:
  containers:
  - image: quay.io/openshifttest/hello-openshift:openshift
    name: node-hello
    securityContext:
      privileged: true
      runAsUser: 0
EOF
Error from server (Forbidden): error when creating "STDIN": pods "testpod" is forbidden: violates PodSecurity "restricted:latest": privileged (container "node-hello" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "node-hello" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "node-hello" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "node-hello" must set securityContext.runAsNonRoot=true), runAsUser=0 (container "node-hello" must not set runAsUser=0), seccompProfile (pod or container "node-hello" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

3. Check the Alerts in Openshift console 

Actual
PodSecurityViolation alert is being fired

Expected
PodSecurityViolation alert should be in a firing state
Moving to verified
Comment 6 errata-xmlrpc 2023-01-17 19:50:47 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.12.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:7399