openstack/openstack-helm-addons
Code Issues Proposed changes

Enable Apparmor to Components in Addons

Browse Source 
1)Added Apparmor Script andimoved apparmor configurations
to values-overrides to enable optional experimental Jobs.

2)Added Apparmor to mini-mirror,ranger,ranger-agent
 and sonobuy Components.

3)Moved apparmot
Change-Id: I9772d8425aa3d46e1fb0e1a6962ea999e77a6655
This commit is contained in:
dt241s@att.com 2020-06-04 16:10:48 -05:00 committed by diwakar thyagaraj
parent ce635602ea
commit 768722b1cf
13 changed files with 103 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
mini-mirror/templates/pod-helm-test.yaml
View File

@ -26,6 +26,7 @@ metadata:
annotations:
"helm.sh/hook": test-success
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
{{ dict "envAll" $envAll "podName" "mini-mirror-test" "containerNames" (list "mini-mirror-helm-test") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 4 }}
spec:
nodeSelector:
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
@ -49,5 +50,4 @@ spec:
configMap:
name: mini-mirror-bin
defaultMode: 0555
{{- end }}
{{- end }}

2
mini-mirror/values_overrides/apparmor.yaml
View File

@ -4,4 +4,6 @@ pod:
type: apparmor
mini-mirror:
mini-mirror-api: runtime/default
mini-mirror-test:
mini-mirror-helm-test: runtime/default
...

2
ranger-agent/templates/deployment-ranger-agent-engine.yaml
View File

@ -66,7 +66,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-agent" "containerNames" (list "ranger-agent-engine") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
{{ dict "envAll" $envAll "podName" "ranger-agent-engine" "containerNames" (list "init" "ranger-agent-engine") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "ranger_agent" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}

5
ranger-agent/templates/pod-test.yaml
View File

@ -24,10 +24,11 @@ limitations under the License.
apiVersion: v1
kind: Pod
metadata:
name: "{{$envAll.Release.Name}}-test"
name: ranger-agent-test
annotations:
"helm.sh/hook": test-success
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
{{ dict "envAll" $envAll "podName" "ranger-agent-test" "containerNames" (list "init" "ranger-agent-test") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 4 }}
labels:
{{ tuple $envAll "ranger-agent" "test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
spec:
@ -38,7 +39,7 @@ spec:
initContainers:
{{ tuple $envAll "tests" $mounts_tests_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 4 }}
containers:
- name: {{.Release.Name}}-test
- name: ranger-agent-test
image: {{ .Values.images.tags.scripted_test }}
env:
- name: RANGER_SERVICE_URL

7
ranger-agent/values_overrides/apparmor.yaml
View File

@ -5,7 +5,10 @@ pod:
ranger-agent-api:
init: runtime/default
ranger-agent-api: runtime/default
ranger-agent:
ranger-agent-engine:
ranger-agent-engine: runtime/default
init: runtime/default
ranger-agent-test:
ranger-agent-test: runtime/default
init: runtime/default
...

22
ranger/values_overrides/apparmor.yaml
View File

@ -2,7 +2,25 @@
pod:
mandatory_access_control:
type: apparmor
ranger:
ranger-audit-service:
init: runtime/default
ranger-services: runtime/default
ranger-audit-service: runtime/default
ranger-cms-service:
init: runtime/default
ranger-cms-service: runtime/default
ranger-fms-service:
init: runtime/default
ranger-fms-service: runtime/default
ranger-ims-service:
init: runtime/default
ranger-ims-service: runtime/default
ranger-rds-service:
init: runtime/default
ranger-rds-service: runtime/default
ranger-rms-service:
init: runtime/default
ranger-rms-service: runtime/default
ranger-uuid-service:
init: runtime/default
ranger-uuid-service: runtime/default
...

2
sonobuoy/templates/pod-api.yaml
View File

@ -55,7 +55,7 @@ metadata:
name: sonobuoy
annotations:
"helm.sh/hook": test-success
{{- $containers := (list "kube-sonobuoy" ) }}
{{- $containers := (list "kube-sonobuoy" "init" ) }}
{{- if $envAll.Values.conf.publish_results }}
{{- $containers = append $containers "results-publisher" }}
{{- end }}

5
sonobuoy/values.yaml
View File

@ -39,11 +39,6 @@ dependencies:
- sonobuoy-ks-user
pod:
mandatory_access_control:
type: apparmor
sonobuoy:
kube-sonobuoy: localhost/docker-default
results-publisher: localhost/docker-default
resources:
enabled: false
jobs:

9
sonobuoy/values_overrides/apparmor.yaml Normal file
View File

@ -0,0 +1,9 @@
---
pod:
mandatory_access_control:
type: apparmor
sonobuoy:
kube-sonobuoy: runtime/default
results-publisher: runtime/default
init: runtime/default
...

3
tools/deployment/common/install-packages.sh
View File

@ -19,4 +19,5 @@ sudo apt-get install --no-install-recommends -y \
nmap \
curl \
uuid-runtime \
bc
bc \
python3-pip

9
tools/deployment/component/sonobuoy/sonobuoy.sh
View File

@ -14,11 +14,15 @@
set -xe
#NOTE: Get the overrides to use
: ${OSH_EXTRA_HELM_ARGS_SONOBUOY:="$(./tools/deployment/common/get-values-overrides.sh sonobuoy)"}
helm dependency update sonobuoy
helm upgrade --install sonobuoy sonobuoy \
--namespace=heptio-sonobuoy \
--set endpoints.identity.namespace=openstack \
--set manifests.serviceaccount_readonly=true
--set manifests.serviceaccount_readonly=true \
${OSH_EXTRA_HELM_ARGS_SONOBUOY}
helm test sonobuoy
# test that the readonly service account CANNOT perform pod/exec in any namespaces
@ -41,7 +45,8 @@ helm upgrade --install another-sonobuoy sonobuoy \
--set manifests.serviceaccount_readonly=true \
--set manifests.serviceaccount_readonly_exec=true \
--set conf.exec_role_namespace=exec \
--set conf.publish_results=false
--set conf.publish_results=false \
${OSH_EXTRA_HELM_ARGS_SONOBUOY}
helm test another-sonobuoy
# test that the readonly service account can perform pod/exec in exec namespace

47
zuul.d/jobs.yaml
View File

@ -96,3 +96,50 @@
- ./tools/deployment/common/deploy-k8s.sh
- ./tools/deployment/common/setup-client.sh
- ./tools/deployment/component/mini-mirror/mini-mirror.sh
- job:
name: osh-addons-minimirror-ranger-apparmor
parent: osh-addons-base
run: tools/gate/playbooks/osh-gate-runner.yaml
vars:
osh_params:
openstack_release: ocata
container_distro_name: ubuntu
container_distro_version: bionic
feature_gates: apparmor
gate_scripts:
- ./tools/deployment/common/install-packages.sh
- ./tools/deployment/common/deploy-k8s.sh
- ./tools/deployment/common/setup-client.sh
- ./tools/deployment/component/mini-mirror/mini-mirror.sh
- ./tools/deployment/component/common/ingress.sh
- ./tools/deployment/component/common/mariadb.sh
- ./tools/deployment/component/common/rabbitmq.sh
- ./tools/deployment/component/common/memcached.sh
- ./tools/deployment/component/keystone/keystone.sh
- ./tools/deployment/component/ranger/ranger.sh
- ./tools/deployment/component/ranger/ranger-agent.sh
- job:
name: osh-addons-sonobuoy-apparmor
parent: osh-addons-base
run: tools/gate/playbooks/osh-gate-runner.yaml
vars:
osh_params:
openstack_release: ocata
container_distro_name: ubuntu
container_distro_version: xenial
feature_gates: apparmor
gate_scripts:
- ./tools/deployment/common/install-packages.sh
- ./tools/deployment/common/deploy-k8s.sh
- ./tools/deployment/common/setup-client.sh
- ./tools/deployment/component/common/ingress.sh
- ./tools/deployment/component/common/mariadb.sh
- ./tools/deployment/component/common/rabbitmq.sh
- ./tools/deployment/component/common/memcached.sh
- ./tools/deployment/component/ceph/ceph.sh
- ./tools/deployment/component/ceph/ceph-ns-activate.sh
- ./tools/deployment/component/keystone/keystone.sh
- ./tools/deployment/component/ceph/radosgateway.sh
- ./tools/deployment/component/sonobuoy/sonobuoy.sh

4
zuul.d/project.yaml
View File

@ -24,3 +24,7 @@
- osh-addons-sonobuoy
- osh-addons-ranger
- osh-addons-mini-mirror
experimental:
jobs:
- osh-addons-sonobuoy-apparmor
- osh-addons-minimirror-ranger-apparmor