Run-level 1 bypasses SCC, but many components have no need for that (are less secure as a result). Every component that does not need to be up before SCC starts should be in either the anyuid or restricted SCC profile so they get a stable SELinux label. Because these components are running without the appropriate restrictions, the security profile of these core components is weaker than it should be. All platform components that can run without a run level MUST do so, and use anyuid or restricted unless they can make a case for host network or privileged. Those components should be granted access to the protected SCCs. Each component listed here must be reviewed to determine whether it must be in run-level 1 or not, and if not, the label should be removed and appropriate SCC bindings created. NAME STATUS AGE openshift-apiserver Active 36m openshift-cloud-credential-operator Active 43m openshift-cluster-version Active 43m openshift-controller-manager Active 43m openshift-insights Active 43m openshift-kni-infra Active 43m openshift-kube-storage-version-migrator Active 36m openshift-machine-api Active 43m openshift-machine-config-operator Active 43m openshift-openstack-infra Active 43m openshift-operator-lifecycle-manager Active 43m openshift-operators Active 43m openshift-ovirt-infra Active 43m openshift-service-ca Active 36m openshift-service-ca-operator Active 43m openshift-support Active 43m openshift-vsphere-infra Active 43m
Insights and support handled in https://github.com/openshift/insights-operator/pull/78
Components that may already have child pods in the namespace should grant the "anyuid" SCC to all pods in their namespace (group "system:serviceaccount:NAMESPACE") if there is a chance user workloads or arbitrary pods have already landed.
*** This bug has been marked as a duplicate of bug 1807436 ***
We made quite a bit of progress on the topic. But there are core components like service-ca and openshift-apiserver which need serious changes in the architecture to fix. Hence, we move this umbrella BZ to 4.5 for follow-up work.
This isn't a showstopper for 4.5.0 GA at this point. Setting target release to 4.6.0 (the current development branch). For fixes (if any) requested/required on prior versions, clones will be created targeting those z-stream releases as appropriate.
Infra namespaces fix: - openshift-openstack-infra - openshift-kni-infra - openshift-ovirt-infra - openshift-vsphere-infra https://bugzilla.redhat.com/show_bug.cgi?id=1973525 https://github.com/openshift/machine-config-operator/pull/2627/files
- openshift-vertical-pod-autoscaler https://bugzilla.redhat.com/show_bug.cgi?id=1974567 - openshift-kubevirt-infra https://bugzilla.redhat.com/show_bug.cgi?id=1977129
- MCO https://bugzilla.redhat.com/show_bug.cgi?id=1978581 - CVO there is this comment here: https://github.com/openshift/cluster-version-operator/pull/24 saying that it is required, but that was 2018, not sure if it still is.
@sponnaga
CVO - https://github.com/openshift/cluster-version-operator/pull/623 - https://bugzilla.redhat.com/show_bug.cgi?id=2020107
I think we've fully removed `run-level: 1` from openshift now and we can close this one :-)
4.7 is EOL now, closing all the bugs.
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 365 days