Repository: openshift/cluster-kube-apiserver-operator
Pull request #1834: OCPBUGS-55013: SCC: add hostmount-anyuid-v2
Author: login: haircommander
Labels: name: lgtm
description: Indicates that a PR is ready to be merged.
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: jira/valid-bug
description: Indicates that a referenced Jira bug is valid for the branch this PR is targeting.
name: jira/valid-reference
description: Indicates that this PR references a valid Jira ticket of any type.
Created: 2025-04-28T19:42:06Z | Merged: 2025-05-15T16:35:35Z

the intent of hostmount-anyuid is to allow a pod access to paths on the host. The problem is, hostPath volumes aren't selinux relabeled, and there are paths that the default selinux type `container_t` cannot access.

This breaks expectation, and makes pods that rely on hostmount-anyuid brittle to selinux changes on the host (see https://issues.redhat.com/browse/OCPBUGS-55013)

Instead of relaxing permissions of all paths on the host, or increasing the ability of container_t, we should trust pods that are granted access to this already powerful SCC to use its power fully.


Diff:
diff --git a/bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_cr-scc-hostmount-anyuid-v2.yaml b/bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_cr-scc-hostmount-anyuid-v2.yaml
new file mode 100644
index 0000000000..ce007cb37f
--- /dev/null
+++ b/bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_cr-scc-hostmount-anyuid-v2.yaml
@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    rbac.authorization.kubernetes.io/autoupdate: "true"
+  name: system:openshift:scc:hostmount-anyuid-v2
+rules:
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - hostmount-anyuid-v2
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
diff --git a/bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml b/bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml
new file mode 100644
index 0000000000..01d60402a4
--- /dev/null
+++ b/bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml
@@ -0,0 +1,47 @@
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities:
+apiVersion: security.openshift.io/v1
+defaultAddCapabilities:
+fsGroup:
+  type: RunAsAny
+groups: []
+kind: SecurityContextConstraints
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/create-only: "true"
+    kubernetes.io/description: |-
+      hostmount-anyuid-v2 provides all the features of the
+      restricted SCC but allows host mounts any UID, and any SELinux label by a pod.  This is primarily
+      used by the persistent volume recycler. WARNING: this SCC allows host file
+      system access as any UID, including UID 0.  Grant with caution.
+  name: hostmount-anyuid-v2
+priority:
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+- MKNOD
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: RunAsAny
+supplementalGroups:
+  type: RunAsAny
+volumes:
+- configMap
+- csi
+- downwardAPI
+- emptyDir
+- ephemeral
+- hostPath
+- nfs
+- persistentVolumeClaim
+- projected
+- secret


Reviews:
user: login: aleskandro
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-29T06:11:23Z
user: login: haircommander
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-29T13:09:06Z
user: login: ibihim
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T14:34:55Z
user: login: sjenning
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T14:35:52Z
user: login: ibihim
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T14:36:02Z
user: login: sjenning
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T14:36:31Z
user: login: ibihim-unsafe
body: Looks good. Please create a PR for [e2e tests](https://github.com/openshift/origin) as well.
state: CHANGES_REQUESTED
author_association: NONE
submitted_at: 2025-05-15T09:58:58Z
user: login: ibihim
body: Looks good. Please create a PR for [e2e tests](https://github.com/openshift/origin) as well.
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-15T10:00:25Z
user: login: ibihim-unsafe
state: APPROVED
author_association: NONE
submitted_at: 2025-05-15T10:06:12Z

Review comments:
diff_hunk: @@ -0,0 +1,49 @@
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities:
+apiVersion: security.openshift.io/v1
+defaultAddCapabilities:
+fsGroup:
+  type: RunAsAny
+groups: []
+kind: SecurityContextConstraints
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/create-only: "true"
+    kubernetes.io/description: |-
+      hostmount-anyuid-v2 provides all the features of the
+      restricted SCC but allows host mounts any UID, and any SELinux label by a pod.  This is primarily
+      used by the persistent volume recycler. WARNING: this SCC allows host file
+      system access as any UID, including UID 0.  Grant with caution.
+  name: hostmount-anyuid
path: bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml
user: login: aleskandro
body: Hey @haircommander , thanks for the quick follow up! Should this be 

```suggestion
  name: hostmount-anyuid-v2
```
?

cc @lwan-wanglin 
created_at: 2025-04-29T06:11:22Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,49 @@
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities:
+apiVersion: security.openshift.io/v1
+defaultAddCapabilities:
+fsGroup:
+  type: RunAsAny
+groups: []
+kind: SecurityContextConstraints
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/create-only: "true"
+    kubernetes.io/description: |-
+      hostmount-anyuid-v2 provides all the features of the
+      restricted SCC but allows host mounts any UID, and any SELinux label by a pod.  This is primarily
+      used by the persistent volume recycler. WARNING: this SCC allows host file
+      system access as any UID, including UID 0.  Grant with caution.
+  name: hostmount-anyuid
path: bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml
user: login: haircommander
body: absolutely good catch
created_at: 2025-04-29T13:09:06Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,49 @@
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities:
+apiVersion: security.openshift.io/v1
+defaultAddCapabilities:
+fsGroup:
+  type: RunAsAny
+groups: []
+kind: SecurityContextConstraints
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/create-only: "true"
+    kubernetes.io/description: |-
+      hostmount-anyuid-v2 provides all the features of the
+      restricted SCC but allows host mounts any UID, and any SELinux label by a pod.  This is primarily
+      used by the persistent volume recycler. WARNING: this SCC allows host file
+      system access as any UID, including UID 0.  Grant with caution.
path: bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml
user: login: ibihim
body:  Well, in good practice of the v2s, we should mention that we are by-passing SELinux context as well.
created_at: 2025-05-14T14:34:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,49 @@
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities:
+apiVersion: security.openshift.io/v1
+defaultAddCapabilities:
+fsGroup:
+  type: RunAsAny
+groups: []
+kind: SecurityContextConstraints
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/create-only: "true"
+    kubernetes.io/description: |-
+      hostmount-anyuid-v2 provides all the features of the
+      restricted SCC but allows host mounts any UID, and any SELinux label by a pod.  This is primarily
+      used by the persistent volume recycler. WARNING: this SCC allows host file
+      system access as any UID, including UID 0.  Grant with caution.
+  name: hostmount-anyuid-v2
+priority:
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+- MKNOD
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: RunAsAny
+supplementalGroups:
+  type: RunAsAny
+users:
+- system:serviceaccount:openshift-infra:pv-recycler-controller
path: bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml
user: login: sjenning
body: we are moving away from specifying subjects directly in the SCC and it seems that `pv-recycler-controller` works just fine with with old SCC, so let start out clean in v2.
created_at: 2025-05-14T14:35:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,49 @@
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities:
+apiVersion: security.openshift.io/v1
+defaultAddCapabilities:
+fsGroup:
+  type: RunAsAny
+groups: []
+kind: SecurityContextConstraints
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/create-only: "true"
+    kubernetes.io/description: |-
+      hostmount-anyuid-v2 provides all the features of the
+      restricted SCC but allows host mounts any UID, and any SELinux label by a pod.  This is primarily
+      used by the persistent volume recycler. WARNING: this SCC allows host file
+      system access as any UID, including UID 0.  Grant with caution.
+  name: hostmount-anyuid-v2
+priority:
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+- MKNOD
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: RunAsAny
+supplementalGroups:
+  type: RunAsAny
+users:
+- system:serviceaccount:openshift-infra:pv-recycler-controller
path: bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml
user: login: ibihim
body: Curious if we can drop this.
created_at: 2025-05-14T14:36:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,49 @@
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities:
+apiVersion: security.openshift.io/v1
+defaultAddCapabilities:
+fsGroup:
+  type: RunAsAny
+groups: []
+kind: SecurityContextConstraints
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/create-only: "true"
+    kubernetes.io/description: |-
+      hostmount-anyuid-v2 provides all the features of the
+      restricted SCC but allows host mounts any UID, and any SELinux label by a pod.  This is primarily
+      used by the persistent volume recycler. WARNING: this SCC allows host file
+      system access as any UID, including UID 0.  Grant with caution.
path: bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-hostmount-anyuid-v2.yaml
user: login: sjenning
body: I think this is captured with `and any SELinux label by a pod`
created_at: 2025-05-14T14:36:31Z
author_association: CONTRIBUTOR

PR comments:
user: login: openshift-ci-robot
created_at: 2025-04-28T19:42:12Z
body: @haircommander: This pull request references [Jira Issue OCPBUGS-55013](https://issues.redhat.com//browse/OCPBUGS-55013), which is invalid:
 - expected the bug to target the "4.19.0" version, but no target version was set

Comment <code>/jira refresh</code> to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

<details>

In response to [this](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1834):

>the intent of hostmount-anyuid is to allow a pod access to paths on the host. The problem is, hostPath volumes aren't selinux relabeled, and there are paths that the default selinux type `container_t` cannot access.
>
>This breaks expectation, and makes pods that rely on hostmount-anyuid brittle to selinux changes on the host (see https://issues.redhat.com/browse/OCPBUGS-55013)
>
>Instead of relaxing permissions of all paths on the host, or increasing the ability of container_t, we should trust pods that are granted access to this already powerful SCC to use its power fully.


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcluster-kube-apiserver-operator).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: haircommander
created_at: 2025-04-28T19:43:39Z
body: /jira refresh
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-04-28T19:43:45Z
body: @haircommander: This pull request references [Jira Issue OCPBUGS-55013](https://issues.redhat.com//browse/OCPBUGS-55013), which is valid. The bug has been moved to the POST state.

<details><summary>3 validation(s) were run on this bug</summary>

* bug is open, matching expected state (open)
* bug target version (4.19.0) matches configured target version for branch (4.19.0)
* bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)</details>

Requesting review from QA contact:
/cc @sergiordlr

<details>

In response to [this](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1834#issuecomment-2836331905):

>/jira refresh


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcluster-kube-apiserver-operator).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: vrutkovs
created_at: 2025-04-29T11:00:00Z
body: /cc @ibihim 
author_association: CONTRIBUTOR
user: login: haircommander
created_at: 2025-04-30T20:24:55Z
body: /retest
author_association: MEMBER
user: login: haircommander
created_at: 2025-05-01T13:14:18Z
body: /retest
author_association: MEMBER
user: login: openshift-ci[bot]
created_at: 2025-05-14T18:10:18Z
body: @haircommander: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
ci/prow/e2e-gcp-operator-single-node | 8ecdca3bc7c84c4d1e23023bf8ec25e4d78ea7ea | [link](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-kube-apiserver-operator/1834/pull-ci-openshift-cluster-kube-apiserver-operator-main-e2e-gcp-operator-single-node/1922666852861874176) | false | `/test e2e-gcp-operator-single-node`
ci/prow/e2e-aws-ovn-single-node | 8ecdca3bc7c84c4d1e23023bf8ec25e4d78ea7ea | [link](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-kube-apiserver-operator/1834/pull-ci-openshift-cluster-kube-apiserver-operator-main-e2e-aws-ovn-single-node/1922666852689907712) | false | `/test e2e-aws-ovn-single-node`
ci/prow/e2e-aws-operator-disruptive-single-node | 8ecdca3bc7c84c4d1e23023bf8ec25e4d78ea7ea | [link](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-kube-apiserver-operator/1834/pull-ci-openshift-cluster-kube-apiserver-operator-main-e2e-aws-operator-disruptive-single-node/1922666852580855809) | false | `/test e2e-aws-operator-disruptive-single-node`

[Full PR test history](https://prow.ci.openshift.org/pr-history?org=openshift&repo=cluster-kube-apiserver-operator&pr=1834). [Your PR dashboard](https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:haircommander).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
author_association: CONTRIBUTOR
user: login: Prashanth684
created_at: 2025-05-15T16:08:59Z
body: thanks @ibihim . @vrutkovs could you approve please?
author_association: NONE
user: login: vrutkovs
created_at: 2025-05-15T16:29:39Z
body: /approve
/lgtm
author_association: CONTRIBUTOR
user: login: openshift-ci[bot]
created_at: 2025-05-15T16:30:39Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/openshift/cluster-kube-apiserver-operator/pull/1834#" title="Author self-approved">haircommander</a>*, *<a href="https://github.com/openshift/cluster-kube-apiserver-operator/pull/1834#pullrequestreview-2843090673" title="Approved">ibihim-unsafe</a>*, *<a href="https://github.com/openshift/cluster-kube-apiserver-operator/pull/1834#issuecomment-2884421962" title="LGTM">vrutkovs</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=openshift%2Fcluster-kube-apiserver-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/openshift/cluster-kube-apiserver-operator/blob/main/OWNERS)~~ [vrutkovs]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR
user: login: openshift-ci-robot
created_at: 2025-05-15T16:35:41Z
body: @haircommander: [Jira Issue OCPBUGS-55013](https://issues.redhat.com//browse/OCPBUGS-55013): All pull requests linked via external trackers have merged:
 * [openshift/cluster-kube-apiserver-operator#1834](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1834)

[Jira Issue OCPBUGS-55013](https://issues.redhat.com//browse/OCPBUGS-55013) has been moved to the MODIFIED state.

<details>

In response to [this](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1834):

>the intent of hostmount-anyuid is to allow a pod access to paths on the host. The problem is, hostPath volumes aren't selinux relabeled, and there are paths that the default selinux type `container_t` cannot access.
>
>This breaks expectation, and makes pods that rely on hostmount-anyuid brittle to selinux changes on the host (see https://issues.redhat.com/browse/OCPBUGS-55013)
>
>Instead of relaxing permissions of all paths on the host, or increasing the ability of container_t, we should trust pods that are granted access to this already powerful SCC to use its power fully.


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcluster-kube-apiserver-operator).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: Prashanth684
created_at: 2025-05-15T17:13:48Z
body: /cherry-pick release-4.19
author_association: NONE
user: login: openshift-cherrypick-robot
created_at: 2025-05-15T17:14:36Z
body: @Prashanth684: new pull request created: #1844

<details>

In response to [this](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1834#issuecomment-2884531541):

>/cherry-pick release-4.19


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-bot
created_at: 2025-05-15T19:05:38Z
body: **[ART PR BUILD NOTIFIER]**

Distgit: ose-cluster-kube-apiserver-operator
This PR has been included in build [ose-cluster-kube-apiserver-operator-container-v4.20.0-202505151814.p0.g438e1f6.assembly.stream.el9](https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=3649675).
All builds following this will include this PR.
author_association: CONTRIBUTOR