Bug 2268065 - Not all csi-addons containers run with read-only filesystem
Summary: Not all csi-addons containers run with read-only filesystem
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenShift Data Foundation
Classification: Red Hat Storage
Component: csi-addons
Version: 4.14
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: ODF 4.15.2
Assignee: Niels de Vos
QA Contact: Filip Balák
URL:
Whiteboard:
Depends On:
Blocks: 2274499
TreeView+ depends on / blocked
 
Reported: 2024-03-06 09:00 UTC by Niels de Vos
Modified: 2024-05-01 01:31 UTC (History)
6 users (show)

Fixed In Version: 4.15.2-1
Doc Type: Bug Fix
Doc Text:
Previously, the security scanners or checkers reported that the `csi-addons-controller-manager` pod does not have "readOnlyRootFilesystem" enabled as the pod does not have "readOnlyRootFilesystem" enabled explicitly. With this fix, in the deployment of the `csi-addons-controller-manager` pod, "readOnlyRootFilesystem is set to `true`. As a result, the security scanners or checkers no longer report the missing "readOnlyRootFilesystem" option for csi-addons-controller-manager.
Clone Of:
: 2274499 (view as bug list)
Environment:
Last Closed: 2024-05-01 01:31:06 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github csi-addons kubernetes-csi-addons pull 529 0 None Merged deploy: run all containers with read-only filesystem 2024-03-08 11:56:29 UTC
Github red-hat-storage kubernetes-csi-addons pull 127 0 None open BUG 2268065: deploy: run all containers with read-only filesystem 2024-04-10 12:49:45 UTC
Red Hat Product Errata RHBA-2024:2636 0 None None None 2024-05-01 01:31:13 UTC

Description Niels de Vos 2024-03-06 09:00:39 UTC 
Description of problem (please be detailed as possible and provide log
snippests):

A security scanner reports:

only read-only root filesystem container is allowed: kube-rbac-proxy
only read-only root filesystem container is allowed: manager


Version of all relevant components (if applicable):

All
Comment 2 Niels de Vos 2024-03-06 09:02:18 UTC 
Security can be enhanced by setting "readOnlyRootFilesystem: true" for all containers that are part of the csi-addons-controller-manager deployment.
Comment 3 Niels de Vos 2024-03-08 11:58:35 UTC 
The upstream PR has been merged, so it will be included in odf-4.16 automatically.
Comment 4 Niels de Vos 2024-03-12 08:12:07 UTC 
Once this BZ is approved for ODF-4.15.z, please leave a comment "/bugzilla refresh" in https://github.com/red-hat-storage/kubernetes-csi-addons/pull/127 to get the PR merged.
Comment 5 Mudit Agarwal 2024-04-09 02:29:13 UTC 
Karthick/Sunil, please include this issue in the next 4.15 release.
Comment 6 Mudit Agarwal 2024-04-09 02:32:18 UTC 
is it possible to backport this to 4.14 also?
Comment 7 krishnaram Karthick 2024-04-10 08:02:58 UTC 
What are the steps to verify this bug?
Comment 10 Niels de Vos 2024-04-11 11:37:42 UTC 
(In reply to Mudit Agarwal from comment #6)
> is it possible to backport this to 4.14 also?

Yes, if that is wanted. A new csi-addons bundle will need to be provided as that contains the CSV with the change.
Comment 11 Niels de Vos 2024-04-11 11:40:19 UTC 
(In reply to krishnaram Karthick from comment #7)
> What are the steps to verify this bug?

You can "oc -n openshift-storage rsh -c manager csi-addons-controller-manager-..." into the manager container and try to create/delete/modify files on non-volume paths. That is expected to fail.
Comment 13 Filip Balák 2024-04-17 12:26:45 UTC 
csi-addons-controller-manager pod has read only file system:
$ touch /tmp/test
touch: cannot touch '/tmp/test': Read-only file system

4.15.2-1 regression runs didn't find any issue directly caused by the change:
tier1  - https://ocs4-jenkins-csb-odf-qe.apps.ocp-c1.prod.psi.redhat.com/job/qe-deploy-ocs-cluster-prod/11447/
tier3  - https://ocs4-jenkins-csb-odf-qe.apps.ocp-c1.prod.psi.redhat.com/job/qe-deploy-ocs-cluster-prod/11423/
tier4a - https://ocs4-jenkins-csb-odf-qe.apps.ocp-c1.prod.psi.redhat.com/job/qe-deploy-ocs-cluster-prod/11433/
tier4c - https://ocs4-jenkins-csb-odf-qe.apps.ocp-c1.prod.psi.redhat.com/job/qe-deploy-ocs-cluster-prod/11431/

--> VERIFIED

Tested with:
odf 4.15.2-1
Comment 17 errata-xmlrpc 2024-05-01 01:31:06 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenShift Data Foundation 4.15.2 Bug Fix Update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2024:2636
Note You need to log in before you can comment on or make changes to this bug.