From 28bddef227bc9b01185f3d0532f83864dca58c3c Mon Sep 17 00:00:00 2001
From: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
Date: Sat, 23 Nov 2019 00:52:14 +0000
Subject: [PATCH] Enable runtime-default Apparmor Profile to MySqlClient
 Utility Container.

 This also changes node to enabled to make it consistency across
 all nodes, and adds zuul gate jobs.

Change-Id: Idb8779d6b6d7f73d6450de59d5ed0575d91a1518
---
 .../templates/deployment-utility.yaml         |  3 +-
 charts/mysqlclient-utility/values.yaml        |  4 ++
 .../apparmor/040-mysqlclient-utility.sh       | 45 +++++++++++++++++++
 zuul.d/base.yaml                              |  1 +
 4 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100755 tools/deployment/apparmor/040-mysqlclient-utility.sh

diff --git a/charts/mysqlclient-utility/templates/deployment-utility.yaml b/charts/mysqlclient-utility/templates/deployment-utility.yaml
index 575dfbd9..ce5ddd0c 100644
--- a/charts/mysqlclient-utility/templates/deployment-utility.yaml
+++ b/charts/mysqlclient-utility/templates/deployment-utility.yaml
@@ -65,6 +65,7 @@ spec:
       name: {{ printf "%s" $envAll.Release.Name }}
       annotations:
         {{ tuple . | include "helm-toolkit.snippets.release_uuid" }}
+{{ dict "envAll" $envAll "podName" "mysqlclient-utility" "containerNames" (list "mysqlclient-utility") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
       labels:
 {{ tuple $envAll "mysqlclient" "utility" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
     spec:
@@ -75,7 +76,7 @@ spec:
       nodeSelector:
         {{ .Values.labels.utility.node_selector_key }}: {{ .Values.labels.utility.node_selector_value }}
       containers:
-        - name: {{ printf "%s" $envAll.Release.Name }}
+        - name: mysqlclient-utility
 {{ tuple $envAll "mysqlclient_utility" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.mysql_utility | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
 {{ dict "envAll" $envAll "application" "mysqlclient" "container" "mysqlclient_utility" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
diff --git a/charts/mysqlclient-utility/values.yaml b/charts/mysqlclient-utility/values.yaml
index 10be6d08..31d10fe3 100644
--- a/charts/mysqlclient-utility/values.yaml
+++ b/charts/mysqlclient-utility/values.yaml
@@ -56,6 +56,10 @@ pod:
         default: preferredDuringSchedulingIgnoredDuringExecution
       topologyKey:
         default: kubernetes.io/hostname
+  mandatory_access_control:
+    type: apparmor
+    mysqlclient-utility:
+      mysqlclient-utility: runtime/default
   resources:
     enabled: false
     utility:
diff --git a/tools/deployment/apparmor/040-mysqlclient-utility.sh b/tools/deployment/apparmor/040-mysqlclient-utility.sh
new file mode 100755
index 00000000..75d72181
--- /dev/null
+++ b/tools/deployment/apparmor/040-mysqlclient-utility.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Copyright 2019 The Openstack-Helm Authors.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+set -xe
+namespace="utility"
+CURRENT_DIR="$(pwd)"
+: ${OSH_INFRA_PATH:="../openstack-helm-infra"}
+
+mkdir charts/mysqlclient-utility/charts
+cp -r ${OSH_INFRA_PATH}/helm-toolkit-0.1.0.tgz  ${CURRENT_DIR}/charts/mysqlclient-utility/charts
+cd "${CURRENT_DIR}"/charts
+sleep 120
+
+kubectl label nodes --all openstack-helm-node-class=primary --overwrite
+helm upgrade --install mysqlclient-utility ./mysqlclient-utility --namespace=$namespace
+sleep 180
+kubectl get pods --namespace=$namespace
+
+com_pod=$(kubectl get pods --namespace=$namespace  -o wide | grep mysqlclient | awk '{print $1}')
+expected_profile="docker-default (enforce)"
+profile=`kubectl -n $namespace exec $com_pod -- cat /proc/1/attr/current`
+echo "Profile running: $profile"
+  if test "$profile" != "$expected_profile"
+  then
+    if test "$proc_name" == "pause"
+    then
+      echo "Root process (pause) can run docker-default, it's ok."
+    else
+      echo "$profile is the WRONG PROFILE!!"
+      return 1
+    fi
+  fi
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
index 34a9baba..7bbbebb7 100644
--- a/zuul.d/base.yaml
+++ b/zuul.d/base.yaml
@@ -121,4 +121,5 @@
          - ./tools/deployment/apparmor/005-calicoctl-utility.sh
          - ./tools/deployment/apparmor/010-ceph-utility.sh
          - ./tools/deployment/apparmor/030-etcdctl-utility.sh
+         - ./tools/deployment/apparmor/040-mysqlclient-utility.sh
          - ./tools/deployment/apparmor/050-openstack-utility.sh