Bug 2000820 - (release-4.9) Gather PodSecurityPolicies names installed in a cluster
Summary: (release-4.9) Gather PodSecurityPolicies names installed in a cluster
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Insights Operator
Version: 4.9
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.9.0
Assignee: Tomas Remes
QA Contact: Dmitry Misharov
URL:
Whiteboard:
Depends On:
Blocks: 2001457
TreeView+ depends on / blocked
 
Reported: 2021-09-03 05:56 UTC by Tomas Remes
Modified: 2021-10-18 17:51 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2001457 (view as bug list)
Environment:
Last Closed: 2021-10-18 17:51:23 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift insights-operator pull 489 0 None None None 2021-09-03 05:57:11 UTC
Red Hat Product Errata RHSA-2021:3759 0 None None None 2021-10-18 17:51:38 UTC

Description Tomas Remes 2021-09-03 05:56:25 UTC 
Description of problem:


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Comment 3 Dmitry Misharov 2021-09-06 13:11:42 UTC 
Verified on 4.9.0-0.ci-2021-09-06-064221.
Verification steps:

1. cat psp.yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  annotations:
    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
  name: next-psp-name
spec:
  # default set of capabilities are implicitly allowed
  allowedCapabilities: []
  allowPrivilegeEscalation: false
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      # Forbid adding the root group.
      - min: 1
        max: 65535
  hostIPC: false
  hostNetwork: false
  hostPID: false
  privileged: false
  readOnlyRootFilesystem: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      # Forbid adding the root group.
      - min: 1
        max: 65535
  volumes:
  - 'configMap'
  - 'downwardAPI'
  - 'emptyDir'
  - 'persistentVolumeClaim'
  - 'projected'
  - 'secret'
  hostPorts:
  - min: 0
    max: 0
2. oc apply -f psp.yaml
3. oc delete pod insights-operator-<some name>
4. download the archive 
oc rsync insights-operator-<some name>:/var/lib/insights-operator/insights-<date>.tar.gz /tmp
5. check if config/psp_names.json exists and has the right content
Comment 6 errata-xmlrpc 2021-10-18 17:51:23 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.9.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:3759
Note You need to log in before you can comment on or make changes to this bug.