PodSecurity warnings from fleetmanager when deploying to OpenShift 4.11.18
k-wall opened this issue · 6 comments
I'm noticing when deploying to ROSA (OpenShift 4.11.18), I'm seeing a deprecation warning.
serviceaccount/kas-fleet-manager configured
Warning: would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (containers "migration", "service", "envoy-sidecar" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "migration", "service", "envoy-sidecar" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "migration", "service", "envoy-sidecar" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "migration", "service", "envoy-sidecar" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
deployment.apps/kas-fleet-manager created
I will take a look
I am currently investigating this warnings and tracking the progress in https://issues.redhat.com/browse/MGDSTRM-10307
I've been investigating the issue and I opened a PR that mitigates most of the warnings reported in here: bf2fc6cc711aee1a0c2a/kas-fleet-manager#1465
However. It is not possible to fully remove all the warnings due to we currently need to support OCP versions older than OCP 4.11. Please see the linked PR on details about the problematic and why we can't fully remove all the warnings.
cc @k-wall I also recommend the data plane team to review the deployments in the data plane side as the same warnings would be shown for them too if the deployments don't specify any security context, or even worse, if they specify a security context that is not compatible with the updated policies in OCP >= 4.11 for new clusters
thanks @miguelsorianod
re. I also recommend the data plane team to review the deployments in the data plane side
@MikeEdgar is this something already being address from a fleetshard pov?
I finished and merged the changes for KFM in the PR mentioned in the previous comment.
At the end we have been able to remove all warnings on KFM/control plane side by requiring OCP 4.11 as the minimum required version for KFM/control plane.