Repository: kubernetes-sigs/security-profiles-operator
Pull request #202 (2021-01-18 10:12:47)

Re-add runtime/default seccomp profile to operator deployment
#### What type of PR is this?

/kind bug

#### What this PR does / why we need it:
We now re-add the runtime seccomp profile for the deployments to
increase its security footprint.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
Refers to https://github.com/kubernetes-sigs/security-profiles-operator/issues/201
#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/202#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 47bb7b1bd88d13b899c464807ddaf44aae819bf2 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/202/pull-security-profiles-operator-test-e2e/1351110282906177536) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=202). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /test pull-security-profiles-operator-test-e2e
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 47bb7b1bd88d13b899c464807ddaf44aae819bf2 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/202/pull-security-profiles-operator-test-e2e/1351113290490580992) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=202). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/202#pullrequestreview-570370318" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/202#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
JAORMX: /lgtm
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 367580ac9ef93168732601288a9d4032f36f8409 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/202/pull-security-profiles-operator-verify/1351529277568323584) | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=202). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 367580ac9ef93168732601288a9d4032f36f8409 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/202/pull-security-profiles-operator-verify/1351529277568323584) | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-e2e | 367580ac9ef93168732601288a9d4032f36f8409 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/202/pull-security-profiles-operator-test-e2e/1351529277689958400) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=202). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: New changes are detected. LGTM label has been removed.
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | ce47b3d0798f320a8ef9dbc838fa5e5e4e422cad | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/202/pull-security-profiles-operator-test-e2e/1351534564752756736) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=202). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 5ba08c74f..6524e846d 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -38,7 +38,6 @@ import (
 
 const (
 	jsonFlag               string = "json"
-	restrictNSKey          string = "RESTRICT_TO_NAMESPACE"
 	operatorImageKey       string = "RELATED_IMAGE_OPERATOR"
 	nonRootEnablerImageKey string = "RELATED_IMAGE_NON_ROOT_ENABLER"
 )
@@ -168,22 +167,21 @@ func runManager(ctx *cli.Context) error {
 	return nil
 }
 
-func getTunables() (spod.DaemonTunables, error) {
-	var dt spod.DaemonTunables
-	restrictNS := os.Getenv(restrictNSKey)
+func getTunables() (dt spod.DaemonTunables, err error) {
+	dt.WatchNamespace = os.Getenv(config.RestrictNamespaceEnvKey)
+
 	operatorImage := os.Getenv(operatorImageKey)
 	if operatorImage == "" {
 		return dt, errors.New("invalid operator image")
 	}
+	dt.DaemonImage = operatorImage
 
 	nonRootEnableImage := os.Getenv(nonRootEnablerImageKey)
 	if nonRootEnableImage == "" {
 		return dt, errors.New("invalid non-root enabler image")
 	}
-
-	dt.DaemonImage = operatorImage
 	dt.NonRootEnablerImage = nonRootEnableImage
-	dt.WatchNamespace = restrictNS
+
 	return dt, nil
 }
 
@@ -201,8 +199,8 @@ func runDaemon(ctx *cli.Context) error {
 		SyncPeriod: &sync,
 	}
 
-	if os.Getenv(restrictNSKey) != "" {
-		ctrlOpts.Namespace = os.Getenv(restrictNSKey)
+	if os.Getenv(config.RestrictNamespaceEnvKey) != "" {
+		ctrlOpts.Namespace = os.Getenv(config.RestrictNamespaceEnvKey)
 	}
 
 	mgr, err := ctrl.NewManager(cfg, ctrlOpts)
diff --git a/deploy/base/operator.yaml b/deploy/base/operator.yaml
index 11553d206..87c050ec1 100644
--- a/deploy/base/operator.yaml
+++ b/deploy/base/operator.yaml
@@ -11,6 +11,8 @@ spec:
       name: security-profiles-operator
   template:
     metadata:
+      annotations:
+        seccomp.security.alpha.kubernetes.io/pod: runtime/default
       labels:
         name: security-profiles-operator
     spec:
@@ -40,4 +42,4 @@ spec:
           effect: "NoSchedule"
         - key: "node.kubernetes.io/not-ready"
           operator: "Exists"
-          effect: "NoExecute"
\ No newline at end of file
+          effect: "NoExecute"
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 82ef97884..29a6f67a0 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -489,6 +489,8 @@ spec:
       name: security-profiles-operator
   template:
     metadata:
+      annotations:
+        seccomp.security.alpha.kubernetes.io/pod: runtime/default
       labels:
         app: security-profiles-operator
         name: security-profiles-operator
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index a9197c736..becc1f98f 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -489,6 +489,8 @@ spec:
       name: security-profiles-operator
   template:
     metadata:
+      annotations:
+        seccomp.security.alpha.kubernetes.io/pod: runtime/default
       labels:
         app: security-profiles-operator
         name: security-profiles-operator
diff --git a/internal/pkg/config/config.go b/internal/pkg/config/config.go
index 0c6cbe2ce..b8601b912 100644
--- a/internal/pkg/config/config.go
+++ b/internal/pkg/config/config.go
@@ -31,6 +31,10 @@ const (
 	// NodeNameEnvKey is the default environment variable key for retrieving
 	// the name of the current node.
 	NodeNameEnvKey = "NODE_NAME"
+
+	// RestrictNamespaceEnvKey is the environment variable key for restricting
+	// the operator to work on only a single Kubernetes namespace.
+	RestrictNamespaceEnvKey = "RESTRICT_TO_NAMESPACE"
 )
 
 // GetOperatorNamespace gets the namespace that the operator is currently running on.
diff --git a/internal/pkg/controllers/spod/bindata/spod.go b/internal/pkg/controllers/spod/bindata/spod.go
index dc2bc4b4f..976dc786a 100644
--- a/internal/pkg/controllers/spod/bindata/spod.go
+++ b/internal/pkg/controllers/spod/bindata/spod.go
@@ -34,6 +34,8 @@ var (
 	hostPathDirectoryOrCreate       = v1.HostPathDirectoryOrCreate
 )
 
+const operatorRoot = "/var/lib/security-profiles-operator"
+
 var Manifest = &appsv1.DaemonSet{
 	ObjectMeta: metav1.ObjectMeta{
 		Name:      config.OperatorName,
@@ -46,9 +48,9 @@ var Manifest = &appsv1.DaemonSet{
 		Template: v1.PodTemplateSpec{
 			ObjectMeta: metav1.ObjectMeta{
 				Annotations: map[string]string{
-					"openshift.io/scc":                         "privileged",
-					"seccomp.security.alpha.kubernetes.io/pod": "runtime/default",
-					"container.seccomp.security.alpha.kubernetes.io/security-profiles-operator": "localhost/security-profiles-operator.json", // nolint: lll
+					"openshift.io/scc":         "privileged",
+					v1.SeccompPodAnnotationKey: v1.SeccompProfileRuntimeDefault,
+					v1.SeccompContainerAnnotationKeyPrefix + config.OperatorName: "localhost/security-profiles-operator.json",
 				},
 				Labels: map[string]string{
 					"app": "spod",
@@ -57,8 +59,7 @@ var Manifest = &appsv1.DaemonSet{
 			Spec: v1.PodSpec{
 				ServiceAccountName: config.OperatorName,
 				InitContainers: []v1.Container{{
-					Name:  "non-root-enabler",
-					Image: "bash:5.0",
+					Name: "non-root-enabler",
 					// Creates directory /var/lib/security-profiles-operator,
 					// sets 2000:2000 as its owner and symlink it to
 					// /var/lib/kubelet/seccomp/operator. This is required
@@ -67,34 +68,20 @@ var Manifest = &appsv1.DaemonSet{
 					Args: []string{`
 						set -euo pipefail
 
-						if [ ! -d $KUBELET_SECCOMP_ROOT ]; then
-							/bin/mkdir -m 0744 -p $KUBELET_SECCOMP_ROOT
+						if [ ! -d ` + config.KubeletSeccompRootPath + ` ]; then
+							/bin/mkdir -m 0744 -p ` + config.KubeletSeccompRootPath + `
 						fi
 
-						/bin/mkdir -p $OPERATOR_ROOT
-						/bin/chmod 0744 $OPERATOR_ROOT
+						/bin/mkdir -p ` + operatorRoot + `
+						/bin/chmod 0744 ` + operatorRoot + `
 
-						if [ ! -L $OPERATOR_SYMLINK ]; then
-							/bin/ln -s $OPERATOR_ROOT $OPERATOR_SYMLINK
+						if [ ! -L ` + config.ProfilesRootPath + ` ]; then
+							/bin/ln -s ` + operatorRoot + ` ` + config.ProfilesRootPath + `
 						fi
 
-						/bin/chown -R 2000:2000 $OPERATOR_ROOT
-						cp -f -v /opt/seccomp-profiles/* $KUBELET_SECCOMP_ROOT
+						/bin/chown -R 2000:2000 ` + operatorRoot + `
+						cp -f -v /opt/seccomp-profiles/* ` + config.KubeletSeccompRootPath + `
 					`},
-					Env: []v1.EnvVar{
-						{
-							Name:  "KUBELET_SECCOMP_ROOT",
-							Value: config.KubeletSeccompRootPath,
-						},
-						{
-							Name:  "OPERATOR_SYMLINK",
-							Value: "$(KUBELET_SECCOMP_ROOT)/operator",
-						},
-						{
-							Name:  "OPERATOR_ROOT",
-							Value: "/var/lib/security-profiles-operator",
-						},
-					},
 					VolumeMounts: []v1.VolumeMount{
 						{
 							Name:      "host-varlib-volume",
@@ -134,7 +121,6 @@ var Manifest = &appsv1.DaemonSet{
 				}},
 				Containers: []v1.Container{{
 					Name:            config.OperatorName,
-					Image:           config.OperatorName,
 					Args:            []string{"daemon"},
 					ImagePullPolicy: v1.PullAlways,
 					VolumeMounts: []v1.VolumeMount{
diff --git a/internal/pkg/controllers/spod/setup.go b/internal/pkg/controllers/spod/setup.go
index cddb36d05..2d83bf53d 100644
--- a/internal/pkg/controllers/spod/setup.go
+++ b/internal/pkg/controllers/spod/setup.go
@@ -62,9 +62,10 @@ func getEffectiveSPOd(dt DaemonTunables) *appsv1.DaemonSet {
 	refSPOd := bindata.Manifest.DeepCopy()
 	cnt := &refSPOd.Spec.Template.Spec.Containers[0]
 	cnt.Image = dt.DaemonImage
+
 	if dt.WatchNamespace != "" {
 		cnt.Env = append(cnt.Env, corev1.EnvVar{
-			Name:  "RESTRICT_TO_NAMESPACE",
+			Name:  config.RestrictNamespaceEnvKey,
 			Value: dt.WatchNamespace,
 		})
 	}


Test patch:
diff --git a/internal/pkg/controllers/spod/setup_test.go b/internal/pkg/controllers/spod/setup_test.go
index 56d4246d6..572ae2f77 100644
--- a/internal/pkg/controllers/spod/setup_test.go
+++ b/internal/pkg/controllers/spod/setup_test.go
@@ -20,6 +20,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+
+	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
 )
 
 func Test_getEffectiveSPOd(t *testing.T) {
@@ -49,14 +51,14 @@ func Test_getEffectiveSPOd(t *testing.T) {
 			require.Equal(t, tt.dt.NonRootEnablerImage, got.Spec.Template.Spec.InitContainers[0].Image)
 			var found bool
 			for _, env := range got.Spec.Template.Spec.Containers[0].Env {
-				if env.Name == "RESTRICT_TO_NAMESPACE" {
+				if env.Name == config.RestrictNamespaceEnvKey {
 					require.Equal(t, tt.dt.WatchNamespace, env.Value)
 					found = true
 					break
 				}
 			}
 			if tt.nsIsSet && !found {
-				t.Errorf("RESTRICT_TO_NAMESPACE env variable wasn't set")
+				t.Errorf("%s env variable wasn't set", config.RestrictNamespaceEnvKey)
 			}
 		})
 	}
diff --git a/test/suite_test.go b/test/suite_test.go
index 663d39da1..7d97c0b7c 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -37,7 +37,7 @@ import (
 const (
 	kindVersion = "v0.9.0"
 	kindSHA512  = "e7152acf5fd7a4a56af825bda64b1b8343a1f91588f9b3ddd5420ae5c5a95577d87431f2e417a7e03dd23914e1da9bed855ec19d0c4602729b311baccb30bd7f" // nolint: lll
-	kindImage   = "kindest/node:v1.19.1"
+	kindImage   = "kindest/node:v1.20.0"
 )
 
 var (