Repository: kubernetes-sigs/security-profiles-operator
Pull request #1304 (2022-11-16 09:57:21)

OLM: Add an OpenShift-specific annotation
<!--  Thanks for sending a pull request!  Here are some tips for you:

- If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
- Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
- If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
- If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?
/kind cleanup

<!--
Add one of the following kinds:
/kind bug
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

#### What this PR does / why we need it:
Adds an OpenShift-specific annotation that aids the OLM in showing the
operator for the correct OpenShift subscriptions.

#### Which issue(s) this PR fixes:
None

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

-->

#### Does this PR have test?
Will be tested implicitly by OLM tests. Otherwise no, this is an OCP-specific
annotation that will be tested in the OCP container verification pipeline.

<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
N/A

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
NONE
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1304#" title="Author self-approved">jhrozek</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [jhrozek]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1304#pullrequestreview-1182263235" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1304#" title="Author self-approved">jhrozek</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX,jhrozek]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: New changes are detected. LGTM label has been removed.
jhrozek: oops sorry I only committed the result of the `make bundle` command not the actual CSV change *facepalm*
jhrozek: @JAORMX sorry,can you re-add the lgtm tag if you still are OK with the patch? The OLM tests passed now

Patch:
diff --git a/Dockerfile.ubi b/Dockerfile.ubi
index 925139212..5f7a8930e 100644
--- a/Dockerfile.ubi
+++ b/Dockerfile.ubi
@@ -12,17 +12,18 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# hash below referred to `:36` tag
-FROM registry.fedoraproject.org/fedora-minimal@sha256:b676cdd0fdefe33124325082d070c39558f1966a63dfd1193681a7900707d332 AS build
+# go-toolset uses RH's Go fork which uses OpenSSL for FIPS-certified crypto
+# if this is not desirable, pass -tags no_openssl to SPO build
+# see https://access.redhat.com/documentation/en-us/red_hat_developer_tools/2018.4/html/using_go_toolset/chap-changes
+# for more details
+
+# hash below referred to latest
+FROM registry.access.redhat.com/ubi8/go-toolset@sha256:5c33798716db98ce485d606451bef1dd7a6eb3b1422a67cbd10eacc870eb2de5 as build
 USER root
 WORKDIR /work
 
-RUN microdnf install -y \
-        git \
-        glibc-static \
-        golang-bin \
-        make \
-        libseccomp-static
+RUN dnf install -y \
+        libseccomp-devel
 
 ADD . /work
 RUN mkdir -p build
@@ -30,6 +31,9 @@ RUN mkdir -p build
 ARG APPARMOR_ENABLED=0
 ARG BPF_ENABLED=0
 
+# OCP in FIPS mode doesn't like statically linked SPO
+ARG STATIC_LINK=no
+
 RUN make
 
 # hash below referred to latest
@@ -37,6 +41,9 @@ FROM registry.access.redhat.com/ubi8/ubi-minimal@sha256:33931dce809712888d1a8061
 ARG version
 USER root
 
+RUN microdnf install -y \
+        libseccomp
+
 LABEL name="Security Profiles Operator" \
       version=$version \
       description="The Security Profiles Operator makes it easier for cluster admins to manage their seccomp, SELinux or AppArmor profiles and apply them to Kubernetes' workloads."
diff --git a/Makefile b/Makefile
index 6901004c3..dbb9d7226 100644
--- a/Makefile
+++ b/Makefile
@@ -91,11 +91,18 @@ GO_PROJECT := sigs.k8s.io/$(PROJECT)
 LDVARS := \
 	-X $(GO_PROJECT)/internal/pkg/version.buildDate=$(BUILD_DATE) \
 	-X $(GO_PROJECT)/internal/pkg/version.version=$(VERSION)
+STATIC_LINK ?= yes
+ifeq ($(STATIC_LINK), yes)
+  EXTLDFLAGS := -extldflags "-static"
+else
+  EXTLDFLAGS :=
+endif
+
 LINKMODE_EXTERNAL ?= yes
 ifeq ($(LINKMODE_EXTERNAL), yes)
-  LDFLAGS := -s -w -linkmode external -extldflags "-static" $(LDVARS)
+  LDFLAGS := -s -w -linkmode external $(EXTLDFLAGS) $(LDVARS)
 else
-  LDFLAGS := -s -w -extldflags "-static" $(LDVARS)
+  LDFLAGS := -s -w $(EXTLDFLAGS) $(LDVARS)
 endif
 
 export CONTAINER_RUNTIME ?= $(if $(shell which podman 2>/dev/null),podman,docker)
diff --git a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
index cbb3e74cf..f0e95eafb 100644
--- a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
+++ b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
@@ -100,6 +100,8 @@ metadata:
     categories: Security
     olm.skipRange: '>=0.4.1 <0.5.1-dev'
     operatorframework.io/suggested-namespace: security-profiles-operator
+    operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift
+      Container Platform", "OpenShift Platform Plus"]'
     operators.operatorframework.io/builder: operator-sdk-v1.25.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
   name: security-profiles-operator.v0.5.1-dev
diff --git a/deploy/base/clusterserviceversion.yaml b/deploy/base/clusterserviceversion.yaml
index df46ac7ce..987fef96b 100644
--- a/deploy/base/clusterserviceversion.yaml
+++ b/deploy/base/clusterserviceversion.yaml
@@ -8,6 +8,7 @@ metadata:
     categories: Security
     olm.skipRange: '>=0.4.1 <0.4.2-dev'
     operatorframework.io/suggested-namespace: security-profiles-operator
+    operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift Container Platform", "OpenShift Platform Plus"]'
   name: security-profiles-operator.v0.0.0
   namespace: placeholder
 spec:
diff --git a/examples/apparmorprofile-flux-controllers.yaml b/examples/apparmorprofile-flux-controllers.yaml
new file mode 100644
index 000000000..b85c26d8e
--- /dev/null
+++ b/examples/apparmorprofile-flux-controllers.yaml
@@ -0,0 +1,75 @@
+---
+apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
+kind: AppArmorProfile
+metadata:
+  name: flux-controllers
+  namespace: security-profiles-operator
+  annotations:
+    description: AppArmor profile for the Flux Controllers.
+spec:
+  policy: |
+    #include <tunables/global>
+
+    profile flux-controllers flags=(attach_disconnected, mediate_deleted) {
+      include <abstractions/base>
+      include <abstractions/ssl_certs>
+      include <abstractions/gnupg>
+      include <abstractions/user-tmp>
+
+      # Allow udp/tcp, ipv4 and ipv6.
+      network inet stream,
+      network inet6 stream,
+      network tcp,
+      network udp, 
+
+      # Controller binaries.
+      /usr/local/bin/{source,helm,kustomize,image-automation,image-reflector,notification}-controller mrix,
+
+      # gpg is needed by kustomize-controller when using GPG decryption.
+      /usr/bin/gpg{,-agent} mrix,
+
+      # Some controllers are started via tini.
+      /sbin/tini mrix,
+
+      # git is needed by kustomize-controller when using remote bases.
+      /usr/bin/git mrix,
+
+      # Data storage locations.
+      # /data is used as artifact storage and base for File Server.
+      /data/ rwk,
+      /data/** rwk,
+
+      # Access to Kubernetes service account tokens.
+      /run/secrets/kubernetes.io/serviceaccount/** r,
+
+      /etc/{group,passwd,hosts} r,
+      /etc/{nsswitch,resolv}.conf r,
+
+      /proc/sys/net/core/somaxconn r,
+      /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
+
+      # Deny raw and packet level network access.
+      deny network raw,
+      deny network packet,
+
+      # Allow read access to its own process files.
+      @{PROC}/@{pid}/ r,
+      @{PROC}/@{pid}/** r,
+
+      # The denied capabilities below will take precedence over any capabilities
+      # given at pod-level or by default from the container runtime.
+      deny capability net_bind_service, # not needed for ports above 1024.
+      deny capability audit_control,
+      deny capability dac_override,
+      deny capability sys_chroot,
+      deny capability sys_boot,
+      deny capability sys_module,
+      deny capability sys_admin,
+      deny capability sys_ptrace,
+      deny capability syslog,
+      deny capability net_raw,
+      deny capability net_admin,
+      deny capability mac_admin,
+      deny capability mac_override,
+      deny capability mknod,
+    }


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3f7c0c82a..71adbe1f8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,11 +29,11 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v3
-      - uses: github/codeql-action/init@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898
+      - uses: github/codeql-action/init@678fc3afe258fb2e0cdc165ccf77b85719de7b3c
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898
-      - uses: github/codeql-action/analyze@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898
+      - uses: github/codeql-action/autobuild@678fc3afe258fb2e0cdc165ccf77b85719de7b3c
+      - uses: github/codeql-action/analyze@678fc3afe258fb2e0cdc165ccf77b85719de7b3c
 
   coverage:
     runs-on: ubuntu-22.04