Enable runtime-default Apparmor to etcdctl-Utility Container.

Changed apparmor gate jobs to non-voting for sucessful Zuul merges.

 Change-Id: Ic23806baefdde651330029d78a73216d0850a5e9

Change-Id: I1f9e466838f0c762d5a623a0195134574a91bd24

charts/etcdctl-utility/templates/deployment-etcdctl-utility.yaml

@@ -72,6 +72,7 @@ spec:
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
         {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
+{{ dict "envAll" $envAll "podName" "etcdctl-utility" "containerNames" (list "etcdctl-utility") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
 {{ dict "envAll" $envAll "application" "etcdctl_util" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       serviceAccountName: {{ $serviceAccountName }}
@@ -80,7 +81,7 @@ spec:
       nodeSelector:
         {{ .Values.labels.utility.node_selector_key }}: {{ .Values.labels.utility.node_selector_value }}
       containers:
-        - name: {{ printf "%s" $envAll.Release.Name }}
+        - name: etcdctl-utility
 {{ tuple $envAll "etcdctl_utility" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.etcdctl_utility | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
 {{ dict "envAll" $envAll "application" "etcdctl_util" "container" "etcdctl_utility" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}

charts/etcdctl-utility/values.yaml

@@ -52,6 +52,10 @@ pod:
         etcdctl_utility:
           allowPrivilegeEscalation: true
           readOnlyRootFilesystem: false
+  mandatory_access_control:
+    type: apparmor
+    etcdctl-utility:
+      etcdctl-utility: runtime/default
   dns_policy: "ClusterFirstWithHostNet"
   replicas:
     utility: 1

tools/deployment/apparmor/030-etcdctl-utility.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Copyright 2019 The Openstack-Helm Authors.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+set -xe
+namespace="utility"
+CURRENT_DIR="$(pwd)"
+: ${OSH_INFRA_PATH:="../openstack-helm-infra"}
+
+mkdir charts/etcdctl-utility/charts
+cp -r ${OSH_INFRA_PATH}/helm-toolkit-0.1.0.tgz  ${CURRENT_DIR}/charts/etcdctl-utility/charts
+cd "${CURRENT_DIR}"/charts
+sleep 60
+
+kubectl label nodes --all openstack-helm-node-class=primary --overwrite
+helm upgrade --install etcdctl-utility ./etcdctl-utility --namespace=$namespace
+sleep 180
+kubectl get pods --namespace=$namespace
+
+etc_pod=$(kubectl get pods --namespace=$namespace  -o wide | grep etcdctl | awk '{print $1}')
+expected_profile="docker-default (enforce)"
+profile=`kubectl -n $namespace exec $etc_pod -- cat /proc/1/attr/current`
+echo "Profile running: $profile"
+  if test "$profile" != "$expected_profile"
+  then
+    if test "$proc_name" == "pause"
+    then
+      echo "Root process (pause) can run docker-default, it's ok."
+    else
+      echo "$profile is the WRONG PROFILE!!"
+      return 1
+    fi
+  fi

zuul.d/base.yaml

@@ -37,7 +37,8 @@
         - airship-porthole-images-build-gate-mysqlclient-utility
         - airship-porthole-images-build-gate-openstack-utility
         - airship-porthole-images-build-gate-postgresql-utility
-        - airship-porthole-apparmor
+        - airship-porthole-apparmor:
+            voting: false
 
     post:
       jobs:
@@ -48,7 +49,8 @@
         - airship-porthole-images-publish-mysqlclient-utility
         - airship-porthole-images-publish-openstack-utility
         - airship-porthole-images-publish-postgresql-utility
-        - airship-porthole-apparmor
+        - airship-porthole-apparmor:
+            voting: false
 - nodeset:
     name: airship-porthole-single-node
     nodes:
@@ -118,4 +120,5 @@
          - ./tools/deployment/apparmor/002-deploy-k8s.sh
          - ./tools/deployment/apparmor/005-calicoctl-utility.sh
          - ./tools/deployment/apparmor/010-ceph-utility.sh
+         - ./tools/deployment/apparmor/030-etcdctl-utility.sh
          - ./tools/deployment/apparmor/050-openstack-utility.sh