Bug 2101444 - kube-apiserver-operator should raise an alert when there is a Pod Security admission violation
Summary: kube-apiserver-operator should raise an alert when there is a Pod Security ad...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 4.11
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 4.12.0
Assignee: Standa Laznicka
QA Contact: Xingxing Xia
URL:
Whiteboard:
Depends On:
Blocks: 2100155
TreeView+ depends on / blocked
 
Reported: 2022-06-27 14:04 UTC by Standa Laznicka
Modified: 2023-01-17 19:51 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of: 2100155
Environment:
Last Closed: 2023-01-17 19:50:47 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-kube-apiserver-operator pull 1363 0 None open Bug 2101444: specify resource=pod for PSa violation alerts 2022-06-27 17:24:39 UTC
Red Hat Product Errata RHSA-2022:7399 0 None None None 2023-01-17 19:51:07 UTC

Comment 2 Yash Tripathi 2022-07-04 12:59:30 UTC
Verified in 4.12.0-0.nightly-2022-07-02-041854

1. Create and label a namespace with pod-security.kubernetes.io/enforce=restricted
$ oc new-project testproj
$ oc label ns testproj pod-security.kubernetes.io/enforce=restricted

2. Create a sample pod that should get denied due to scc restrictions
$ oc create -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: testpod
spec:
  containers:
  - image: quay.io/openshifttest/hello-openshift:openshift
    name: node-hello
    securityContext:
      privileged: true
      runAsUser: 0
EOF
Error from server (Forbidden): error when creating "STDIN": pods "testpod" is forbidden: violates PodSecurity "restricted:latest": privileged (container "node-hello" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "node-hello" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "node-hello" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "node-hello" must set securityContext.runAsNonRoot=true), runAsUser=0 (container "node-hello" must not set runAsUser=0), seccompProfile (pod or container "node-hello" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

3. Check the Alerts in Openshift console 

Actual
PodSecurityViolation alert is being fired

Expected
PodSecurityViolation alert should be in a firing state
Moving to verified

Comment 6 errata-xmlrpc 2023-01-17 19:50:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.12.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:7399


Note You need to log in before you can comment on or make changes to this bug.