Skip to content

Commit 8b45786

Browse files
sxdjsilvelaNiccoloFeileonardoce
authored
chore: avoid setting seccompProfile when not supported (cloudnative-pg#930)
With this patch the operator will avoid setting a seccomp profile for Kubernetes older than 1.24, where this feature is not yet supported. seccomp profiles are still supported for Kubernetes 1.24 and beyond. Signed-off-by: Jonathan Gonzalez V <jonathan.gonzalez@enterprisedb.com> Signed-off-by: Jaime Silvela <jaime.silvela@enterprisedb.com> Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com> Signed-off-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com> Co-authored-by: Jaime Silvela <jaime.silvela@enterprisedb.com> Co-authored-by: Niccolò Fei <niccolo.fei@enterprisedb.com> Co-authored-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com>
1 parent e64c4b0 commit 8b45786

File tree

9 files changed

+132
-24
lines changed

9 files changed

+132
-24
lines changed

‎internal/cmd/manager/controller/controller.go

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,12 @@ func RunController(
202202
return err
203203
}
204204

205+
// Detect if we support SeccompProfile
206+
if err = utils.DetectSeccompSupport(discoveryClient); err != nil {
207+
setupLog.Error(err, "unable to detect SeccompProfile support")
208+
return err
209+
}
210+
205211
// Retrieve the Kubernetes cluster system UID
206212
if err = utils.DetectKubeSystemUID(ctx, clientSet); err != nil {
207213
setupLog.Error(err, "unable to retrieve the Kubernetes cluster system UID")
@@ -210,7 +216,8 @@ func RunController(
210216

211217
setupLog.Info("Kubernetes system metadata",
212218
"systemUID", utils.GetKubeSystemUID(),
213-
"haveSCC", utils.HaveSecurityContextConstraints())
219+
"haveSCC", utils.HaveSecurityContextConstraints(),
220+
"haveSeccompProfile", utils.HaveSeccompSupport())
214221

215222
if err := ensurePKI(ctx, mgr.GetWebhookServer().CertDir); err != nil {
216223
return err

‎pkg/specs/containers.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323

2424
apiv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
2525
"github.com/cloudnative-pg/cloudnative-pg/internal/configuration"
26+
"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
2627
)
2728

2829
// createBootstrapContainer creates the init container bootstrapping the operator
@@ -60,6 +61,13 @@ func CreateContainerSecurityContext() *corev1.SecurityContext {
6061
trueValue := true
6162
falseValue := false
6263

64+
seccompProfile := &corev1.SeccompProfile{
65+
Type: corev1.SeccompProfileTypeRuntimeDefault,
66+
}
67+
if !utils.HaveSeccompSupport() {
68+
seccompProfile = nil
69+
}
70+
6371
return &corev1.SecurityContext{
6472
Capabilities: &corev1.Capabilities{
6573
Drop: []corev1.Capability{
@@ -70,8 +78,6 @@ func CreateContainerSecurityContext() *corev1.SecurityContext {
7078
RunAsNonRoot: &trueValue,
7179
ReadOnlyRootFilesystem: &trueValue,
7280
AllowPrivilegeEscalation: &falseValue,
73-
SeccompProfile: &corev1.SeccompProfile{
74-
Type: corev1.SeccompProfileTypeRuntimeDefault,
75-
},
81+
SeccompProfile: seccompProfile,
7682
}
7783
}

‎pkg/specs/pods.go

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -280,15 +280,20 @@ func CreatePodSecurityContext(user, group int64) *corev1.PodSecurityContext {
280280
return nil
281281
}
282282

283+
seccompProfile := &corev1.SeccompProfile{
284+
Type: corev1.SeccompProfileTypeRuntimeDefault,
285+
}
286+
if !utils.HaveSeccompSupport() {
287+
seccompProfile = nil
288+
}
289+
283290
trueValue := true
284291
return &corev1.PodSecurityContext{
285-
RunAsNonRoot: &trueValue,
286-
RunAsUser: &user,
287-
RunAsGroup: &group,
288-
FSGroup: &group,
289-
SeccompProfile: &corev1.SeccompProfile{
290-
Type: corev1.SeccompProfileTypeRuntimeDefault,
291-
},
292+
RunAsNonRoot: &trueValue,
293+
RunAsUser: &user,
294+
RunAsGroup: &group,
295+
FSGroup: &group,
296+
SeccompProfile: seccompProfile,
292297
}
293298
}
294299

‎pkg/utils/discovery.go

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,19 @@ limitations under the License.
1717
package utils
1818

1919
import (
20+
"strconv"
21+
2022
apierrors "k8s.io/apimachinery/pkg/api/errors"
2123
"k8s.io/client-go/discovery"
2224
ctrl "sigs.k8s.io/controller-runtime"
2325
)
2426

25-
// This variable store the result of the DetectSecurityContextConstraints check
27+
// This variable stores the result of the DetectSecurityContextConstraints check
2628
var haveSCC bool
2729

30+
// This variable specifies whether we should set the SeccompProfile or not in the pods
31+
var supportSeccomp bool
32+
2833
// GetDiscoveryClient creates a discovery client or return error
2934
func GetDiscoveryClient() (*discovery.DiscoveryClient, error) {
3035
config, err := ctrl.GetConfig()
@@ -86,3 +91,30 @@ func PodMonitorExist(client *discovery.DiscoveryClient) (bool, error) {
8691

8792
return exist, nil
8893
}
94+
95+
// HaveSeccompSupport returns true if Seccomp is supported. If it is, we should
96+
// set the SeccompProfile in the pods
97+
func HaveSeccompSupport() bool {
98+
return supportSeccomp
99+
}
100+
101+
// DetectSeccompSupport checks the version of Kubernetes in the cluster to determine
102+
// whether Seccomp is supported
103+
func DetectSeccompSupport(client *discovery.DiscoveryClient) (err error) {
104+
supportSeccomp = false
105+
kubernetesVersion, err := client.ServerVersion()
106+
if err != nil {
107+
return err
108+
}
109+
110+
minor, err := strconv.Atoi(kubernetesVersion.Minor)
111+
if err != nil {
112+
return err
113+
}
114+
115+
if minor >= 24 {
116+
supportSeccomp = true
117+
}
118+
119+
return
120+
}

‎tests/utils/azurite.go

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"k8s.io/utils/pointer"
2626

2727
"github.com/cloudnative-pg/cloudnative-pg/pkg/certs"
28+
"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
2829
)
2930

3031
const (
@@ -104,6 +105,13 @@ func InstallAzCli(namespace string, env *TestingEnvironment) error {
104105

105106
// getAzuriteClientPod get the cli client pod
106107
func getAzuriteClientPod(namespace string) corev1.Pod {
108+
seccompProfile := &corev1.SeccompProfile{
109+
Type: corev1.SeccompProfileTypeRuntimeDefault,
110+
}
111+
if !utils.HaveSeccompSupport() {
112+
seccompProfile = nil
113+
}
114+
107115
cliClientPod := corev1.Pod{
108116
ObjectMeta: metav1.ObjectMeta{
109117
Name: "az-cli",
@@ -149,7 +157,7 @@ func getAzuriteClientPod(namespace string) corev1.Pod {
149157
},
150158
SecurityContext: &corev1.SecurityContext{
151159
AllowPrivilegeEscalation: pointer.Bool(false),
152-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
160+
SeccompProfile: seccompProfile,
153161
},
154162
},
155163
},
@@ -176,7 +184,7 @@ func getAzuriteClientPod(namespace string) corev1.Pod {
176184
},
177185
},
178186
SecurityContext: &corev1.PodSecurityContext{
179-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
187+
SeccompProfile: seccompProfile,
180188
},
181189
},
182190
}
@@ -210,6 +218,13 @@ func getAzuriteService(namespace string) corev1.Service {
210218
// getAzuriteDeployment get the deployment for Azurite
211219
func getAzuriteDeployment(namespace string) apiv1.Deployment {
212220
replicas := int32(1)
221+
seccompProfile := &corev1.SeccompProfile{
222+
Type: corev1.SeccompProfileTypeRuntimeDefault,
223+
}
224+
if !utils.HaveSeccompSupport() {
225+
seccompProfile = nil
226+
}
227+
213228
azuriteDeployment := apiv1.Deployment{
214229
ObjectMeta: metav1.ObjectMeta{
215230
Name: "azurite",
@@ -266,7 +281,7 @@ func getAzuriteDeployment(namespace string) apiv1.Deployment {
266281
},
267282
SecurityContext: &corev1.SecurityContext{
268283
AllowPrivilegeEscalation: pointer.Bool(false),
269-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
284+
SeccompProfile: seccompProfile,
270285
},
271286
},
272287
},
@@ -297,7 +312,7 @@ func getAzuriteDeployment(namespace string) apiv1.Deployment {
297312
},
298313
},
299314
SecurityContext: &corev1.PodSecurityContext{
300-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
315+
SeccompProfile: seccompProfile,
301316
},
302317
},
303318
},

‎tests/utils/curl.go

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,19 @@ import (
2222
corev1 "k8s.io/api/core/v1"
2323
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2424
"k8s.io/utils/pointer"
25+
26+
"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
2527
)
2628

2729
// CurlClient returns the Pod definition for a curl client
2830
func CurlClient(namespace string) corev1.Pod {
31+
seccompProfile := &corev1.SeccompProfile{
32+
Type: corev1.SeccompProfileTypeRuntimeDefault,
33+
}
34+
if !utils.HaveSeccompSupport() {
35+
seccompProfile = nil
36+
}
37+
2938
curlPod := corev1.Pod{
3039
ObjectMeta: metav1.ObjectMeta{
3140
Namespace: namespace,
@@ -40,14 +49,14 @@ func CurlClient(namespace string) corev1.Pod {
4049
Command: []string{"sleep", "3600"},
4150
SecurityContext: &corev1.SecurityContext{
4251
AllowPrivilegeEscalation: pointer.Bool(false),
43-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
52+
SeccompProfile: seccompProfile,
4453
},
4554
},
4655
},
4756
DNSPolicy: corev1.DNSClusterFirst,
4857
RestartPolicy: corev1.RestartPolicyAlways,
4958
SecurityContext: &corev1.PodSecurityContext{
50-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
59+
SeccompProfile: seccompProfile,
5160
},
5261
},
5362
}

‎tests/utils/environment.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,16 @@ func NewTestingEnvironment() (*TestingEnvironment, error) {
109109
env.PreserveNamespaces = strings.Fields(preserveNamespaces)
110110
}
111111

112+
clientDiscovery, err := utils.GetDiscoveryClient()
113+
if err != nil {
114+
return nil, fmt.Errorf("could not get the discovery client: %w", err)
115+
}
116+
117+
err = utils.DetectSeccompSupport(clientDiscovery)
118+
if err != nil {
119+
return nil, fmt.Errorf("could not detect SeccompProfile support: %w", err)
120+
}
121+
112122
return &env, nil
113123
}
114124

‎tests/utils/minio.go

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
"sigs.k8s.io/controller-runtime/pkg/client"
3535

3636
"github.com/cloudnative-pg/cloudnative-pg/pkg/postgres"
37+
"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
3738
)
3839

3940
const (
@@ -113,6 +114,13 @@ func MinioDefaultSetup(namespace string) (MinioSetup, error) {
113114

114115
// MinioDefaultDeployment returns a default Deployment for minio
115116
func MinioDefaultDeployment(namespace string, minioPVC corev1.PersistentVolumeClaim) appsv1.Deployment {
117+
seccompProfile := &corev1.SeccompProfile{
118+
Type: corev1.SeccompProfileTypeRuntimeDefault,
119+
}
120+
if !utils.HaveSeccompSupport() {
121+
seccompProfile = nil
122+
}
123+
116124
minioDeployment := appsv1.Deployment{
117125
ObjectMeta: metav1.ObjectMeta{
118126
Name: "minio",
@@ -189,12 +197,12 @@ func MinioDefaultDeployment(namespace string, minioPVC corev1.PersistentVolumeCl
189197
},
190198
SecurityContext: &corev1.SecurityContext{
191199
AllowPrivilegeEscalation: pointer.Bool(false),
192-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
200+
SeccompProfile: seccompProfile,
193201
},
194202
},
195203
},
196204
SecurityContext: &corev1.PodSecurityContext{
197-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
205+
SeccompProfile: seccompProfile,
198206
},
199207
},
200208
},
@@ -324,6 +332,13 @@ func MinioSSLSetup(namespace string) (MinioSetup, error) {
324332

325333
// MinioDefaultClient returns the default Pod definition for a minio client
326334
func MinioDefaultClient(namespace string) corev1.Pod {
335+
seccompProfile := &corev1.SeccompProfile{
336+
Type: corev1.SeccompProfileTypeRuntimeDefault,
337+
}
338+
if !utils.HaveSeccompSupport() {
339+
seccompProfile = nil
340+
}
341+
327342
minioClient := corev1.Pod{
328343
ObjectMeta: metav1.ObjectMeta{
329344
Namespace: namespace,
@@ -365,13 +380,13 @@ func MinioDefaultClient(namespace string) corev1.Pod {
365380
},
366381
SecurityContext: &corev1.SecurityContext{
367382
AllowPrivilegeEscalation: pointer.Bool(false),
368-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
383+
SeccompProfile: seccompProfile,
369384
},
370385
Command: []string{"sleep", "3600"},
371386
},
372387
},
373388
SecurityContext: &corev1.PodSecurityContext{
374-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
389+
SeccompProfile: seccompProfile,
375390
},
376391
DNSPolicy: corev1.DNSClusterFirst,
377392
RestartPolicy: corev1.RestartPolicyAlways,

‎tests/utils/webapp.go

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,20 @@ import (
2020
corev1 "k8s.io/api/core/v1"
2121
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2222
"k8s.io/utils/pointer"
23+
24+
"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
2325
)
2426

2527
// DefaultWebapp returns a struct representing a
2628
func DefaultWebapp(namespace string, name string, rootCASecretName string, tlsSecretName string) corev1.Pod {
2729
var secretMode int32 = 0o600
30+
seccompProfile := &corev1.SeccompProfile{
31+
Type: corev1.SeccompProfileTypeRuntimeDefault,
32+
}
33+
if !utils.HaveSeccompSupport() {
34+
seccompProfile = nil
35+
}
36+
2837
return corev1.Pod{
2938
ObjectMeta: metav1.ObjectMeta{
3039
Namespace: namespace,
@@ -72,12 +81,12 @@ func DefaultWebapp(namespace string, name string, rootCASecretName string, tlsSe
7281
},
7382
SecurityContext: &corev1.SecurityContext{
7483
AllowPrivilegeEscalation: pointer.Bool(false),
75-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
84+
SeccompProfile: seccompProfile,
7685
},
7786
},
7887
},
7988
SecurityContext: &corev1.PodSecurityContext{
80-
SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
89+
SeccompProfile: seccompProfile,
8190
},
8291
},
8392
}

0 commit comments

Comments
 (0)