Bug 2209444
| Summary: | PSA violation messages due to a restricted profile cluster-network-addons-operator and its components: kube-cni-linux-bridge-plugin, bridge-marker | ||
|---|---|---|---|
| Product: | Container Native Virtualization (CNV) | Reporter: | Debarati Basu-Nag <dbasunag> |
| Component: | Networking | Assignee: | Quique Llorente <ellorent> |
| Status: | CLOSED MIGRATED | QA Contact: | Yossi Segev <ysegev> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 4.13.0 | CC: | ahafe, ellorent, nrozen, phoracek |
| Target Milestone: | --- | ||
| Target Release: | 4.14.2 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-12-14 16:12:25 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Comment 2
Petr Horáček
2023-07-24 08:58:08 UTC
*** Bug 2223982 has been marked as a duplicate of this bug. *** From the 4.14 BZ: Sample entry (http://pastebin.test.redhat.com/1105334): ============= tests.install_upgrade_operators.pod_security.test_pod_security_audit_log.PodSecurityViolationError: User-agent: cluster-network-addons-operator/v0.0.0 (linux/amd64) kubernetes/$Format, Violations: {'kind': 'Event', 'apiVersion': 'audit.k8s.io/v1', 'level': 'Metadata', 'auditID': 'aacdc782-808c-4a97-86bf-dd0ad956fec5', 'stage': 'ResponseComplete', 'requestURI': '/apis/apps/v1/namespaces/openshift-cnv/daemonsets/kube-cni-linux-bridge-plugin', 'verb': 'update', 'user': {'username': 'system:serviceaccount:openshift-cnv:cluster-network-addons-operator', 'uid': '813a213c-e689-460e-bb7f-b6bfa1dc35e9', 'groups': ['system:serviceaccounts', 'system:serviceaccounts:openshift-cnv', 'system:authenticated'], 'extra': {'authentication.kubernetes.io/pod-name': ['cluster-network-addons-operator-58d9cd5fcb-ljswg'], 'authentication.kubernetes.io/pod-uid': ['47714ae1-1883-46e0-add1-c2e91e1c7a3b']}}, 'sourceIPs': ['10.9.96.50'], 'userAgent': 'cluster-network-addons-operator/v0.0.0 (linux/amd64) kubernetes/$Format', 'objectRef': {'resource': 'daemonsets', 'namespace': 'openshift-cnv', 'name': 'kube-cni-linux-bridge-plugin', 'uid': '51f47752-0518-4b52-a6d5-3b3474fc02e8', 'apiGroup': 'apps', 'apiVersion': 'v1', 'resourceVersion': '757730'}, 'responseStatus': {'metadata': {}, 'code': 200}, 'requestReceivedTimestamp': '2023-07-18T08:06:37.217045Z', 'stageTimestamp': '2023-07-18T08:06:37.230942Z', 'annotations': {'authorization.k8s.io/decision': 'allow', 'authorization.k8s.io/reason': 'RBAC: allowed by RoleBinding "kubevirt-hyperconverged-operator.v4.14.0-cluster-net-7dcf5fd9f6/openshift-cnv" of Role "kubevirt-hyperconverged-operator.v4.14.0-cluster-net-7dcf5fd9f6" to ServiceAccount "cluster-network-addons-operator/openshift-cnv"', 'pod-security.kubernetes.io/audit-violations': 'would violate PodSecurity "restricted:latest": privileged (container "cni-plugins" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "cni-plugins" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "cni-plugins" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volume "cnibin" uses restricted volume type "hostPath"), runAsNonRoot != true (pod or container "cni-plugins" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "cni-plugins" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")'}} ============= Setting the target for 4.14. Once we resolve the BZ, we can open a clone tracking 4.13 fix. @nrozen could QE provide YAML dumps of the openshift-cnv Namespace object and all cluster's scc objects from a 4.14 cluster? It would help Quique triage this BZ. Thanks. Moving to 4.14.1 since the blockers only is near and this is not a blocker. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |