Skip to content

Commit 0006fb8

Browse files
everettravenshanemcd
everettraven
authored and
shanemcd
committed
(scorecard): Add new images for default untar and storage options (operator-framework#6335)
* add images for scorecard untar and storage Signed-off-by: Bryce Palmer <[email protected]> * Add new images for scorecard and use them as the default untar and storage images to ensure that scorecard pods are fully compliant with restricted PSA. This is done by making the images run as non-root by default (sets the user to non-root in the Dockerfile) fixes operator-framework#6295 Signed-off-by: Bryce Palmer <[email protected]> * update images & docs;add changelog Signed-off-by: Bryce Palmer <[email protected]> * add missing newline Signed-off-by: Bryce Palmer <[email protected]> --------- Signed-off-by: Bryce Palmer <[email protected]>
1 parent e3c5dd8 commit 0006fb8

File tree

10 files changed

+114
-67
lines changed

10 files changed

+114
-67
lines changed

‎.github/workflows/deploy-manual.yml‎

Lines changed: 64 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,13 @@ jobs:
1717
environment: deploy
1818
steps:
1919

20+
# https://github.com/orgs/community/discussions/47863
21+
- name: update packages
22+
run: |
23+
sudo apt-mark hold grub-efi-amd64-signed
24+
sudo apt-get update --fix-missing
25+
sudo apt upgrade -y
26+
2027
- name: set up qemu
2128
uses: docker/setup-qemu-action@v2
2229

@@ -48,7 +55,7 @@ jobs:
4855
fi
4956
echo "tag=${IMG}:${TAG}" >> $GITHUB_OUTPUT
5057
echo "git_commit=${GIT_COMMIT}" >> $GITHUB_OUTPUT
51-
58+
5259
- name: create 2.11-base tag
5360
id: base_tag_211
5461
run: |
@@ -67,65 +74,65 @@ jobs:
6774
with:
6875
file: ./images/ansible-operator/base.Dockerfile
6976
context: ./images/ansible-operator
70-
platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
77+
platforms: linux/s390x
7178
push: true
7279
tags: ${{ steps.base_tag_29.outputs.tag }}
7380
build-args: |
7481
GIT_COMMIT=${{ steps.base_tag_29.outputs.git_commit }}
7582
76-
- name: build and push ansible 2.11 dep image
77-
uses: docker/build-push-action@v3
78-
with:
79-
file: ./images/ansible-operator-2.11-preview/base.Dockerfile
80-
context: ./images/ansible-operator-2.11-preview
81-
platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
82-
push: true
83-
tags: ${{ steps.base_tag_211.outputs.tag }}
84-
build-args: |
85-
GIT_COMMIT=${{ steps.base_tag_211.outputs.git_commit }}
83+
# - name: build and push ansible 2.11 dep image
84+
# uses: docker/build-push-action@v3
85+
# with:
86+
# file: ./images/ansible-operator-2.11-preview/base.Dockerfile
87+
# context: ./images/ansible-operator-2.11-preview
88+
# platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
89+
# push: true
90+
# tags: ${{ steps.base_tag_211.outputs.tag }}
91+
# build-args: |
92+
# GIT_COMMIT=${{ steps.base_tag_211.outputs.git_commit }}
8693

87-
# This change will be staged and committed in the PR pushed below.
88-
# The script below will fail if no change was made.
89-
- name: update base of ansible-operator 2.9
90-
id: update_29
91-
run: |
92-
set -ex
93-
sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-base:.+|FROM ${{ steps.base_tag_29.outputs.tag }}|g' images/ansible-operator/Dockerfile
94-
git diff --exit-code --quiet && echo "Failed to update images/ansible-operator/Dockerfile" && exit 1
95-
REF="${{ github.event.ref }}"
96-
echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
97-
98-
- name: create PR for ansible-operator 2.9 Dockerfile
99-
uses: peter-evans/create-pull-request@v3
100-
with:
101-
title: "[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}"
102-
commit-message: |
103-
[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}
104-
105-
Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
106-
body: "New ansible-operator-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
107-
delete-branch: true
108-
branch-suffix: short-commit-hash
109-
110-
# This change will be staged and committed in the PR pushed below.
111-
# The script below will fail if no change was made.
112-
- name: update base of ansible-operator-2.11-preview
113-
id: update_211
114-
run: |
115-
set -ex
116-
sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-2.11-preview-base:.+|FROM ${{ steps.base_tag_211.outputs.tag }}|g' images/ansible-operator-2.11-preview/Dockerfile
117-
git diff --exit-code --quiet && echo "Failed to update images/ansible-operator-11-preview-base/Dockerfile" && exit 1
118-
REF="${{ github.event.ref }}"
119-
echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
120-
121-
- name: create PR for ansible-operator-2.11-preview Dockerfile
122-
uses: peter-evans/create-pull-request@v3
123-
with:
124-
title: "[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}"
125-
commit-message: |
126-
[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}
127-
128-
Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
129-
body: "New ansible-operator-2.11-preview-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
130-
delete-branch: true
131-
branch-suffix: short-commit-hash
94+
# # This change will be staged and committed in the PR pushed below.
95+
# # The script below will fail if no change was made.
96+
# - name: update base of ansible-operator 2.9
97+
# id: update_29
98+
# run: |
99+
# set -ex
100+
# sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-base:.+|FROM ${{ steps.base_tag_29.outputs.tag }}|g' images/ansible-operator/Dockerfile
101+
# git diff --exit-code --quiet && echo "Failed to update images/ansible-operator/Dockerfile" && exit 1
102+
# REF="${{ github.event.ref }}"
103+
# echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
104+
105+
# - name: create PR for ansible-operator 2.9 Dockerfile
106+
# uses: peter-evans/create-pull-request@v3
107+
# with:
108+
# title: "[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}"
109+
# commit-message: |
110+
# [${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}
111+
112+
# Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
113+
# body: "New ansible-operator-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
114+
# delete-branch: true
115+
# branch-suffix: short-commit-hash
116+
117+
# # This change will be staged and committed in the PR pushed below.
118+
# # The script below will fail if no change was made.
119+
# - name: update base of ansible-operator-2.11-preview
120+
# id: update_211
121+
# run: |
122+
# set -ex
123+
# sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-2.11-preview-base:.+|FROM ${{ steps.base_tag_211.outputs.tag }}|g' images/ansible-operator-2.11-preview/Dockerfile
124+
# git diff --exit-code --quiet && echo "Failed to update images/ansible-operator-11-preview-base/Dockerfile" && exit 1
125+
# REF="${{ github.event.ref }}"
126+
# echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
127+
128+
# - name: create PR for ansible-operator-2.11-preview Dockerfile
129+
# uses: peter-evans/create-pull-request@v3
130+
# with:
131+
# title: "[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}"
132+
# commit-message: |
133+
# [${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}
134+
135+
# Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
136+
# body: "New ansible-operator-2.11-preview-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
137+
# delete-branch: true
138+
# branch-suffix: short-commit-hash

‎.github/workflows/deploy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ jobs:
7272
environment: deploy
7373
strategy:
7474
matrix:
75-
id: ["operator-sdk", "helm-operator", "scorecard-test", "ansible-operator", "ansible-operator-2.11-preview"]
75+
id: ["operator-sdk", "helm-operator", "scorecard-test", "ansible-operator", "ansible-operator-2.11-preview", "scorecard-storage", "scorecard-untar"]
7676
steps:
7777

7878
- name: set up qemu

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ build/scorecard-test build/scorecard-test-kuttl build/custom-scorecard-tests:
9292

9393
# Convenience wrapper for building all remotely hosted images.
9494
.PHONY: image-build
95-
IMAGE_TARGET_LIST = operator-sdk helm-operator ansible-operator ansible-operator-2.11-preview scorecard-test scorecard-test-kuttl
95+
IMAGE_TARGET_LIST = operator-sdk helm-operator ansible-operator ansible-operator-2.11-preview scorecard-test scorecard-test-kuttl scorecard-untar scorecard-storage
9696
image-build: $(foreach i,$(IMAGE_TARGET_LIST),image/$(i)) ## Build all images.
9797

9898
# Convenience wrapper for building dependency base images.

‎changelog/fragments/03-scorecard-image-psa.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# entries is a list of entries to include in
2+
# release notes and/or the migration guide
3+
entries:
4+
- description: >
5+
(scorecard): update default storage and untar images to images
6+
that run as non-root users by default. This ensures full compliance
7+
with restricted PSA guidelines when using `--pod-security=restricted`.
8+
9+
# kind is one of:
10+
# - addition
11+
# - change
12+
# - deprecation
13+
# - removal
14+
# - bugfix
15+
kind: "bugfix"
16+
17+
# Is this a breaking change?
18+
breaking: false

‎images/scorecard-storage/Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM docker.io/busybox:1.36
2+
3+
## Create a new non-root user to run as
4+
ENV HOME=/opt/scorecard-untar \
5+
USER_NAME=scorecard-untar \
6+
USER_UID=1001
7+
8+
RUN echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
9+
10+
WORKDIR ${HOME}
11+
12+
USER ${USER_UID}

‎images/scorecard-untar/Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM registry.access.redhat.com/ubi8:8.7
2+
3+
## Create a new non-root user to run as
4+
ENV HOME=/opt/scorecard-untar \
5+
USER_NAME=scorecard-untar \
6+
USER_UID=1001
7+
8+
RUN echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
9+
10+
WORKDIR ${HOME}
11+
12+
USER ${USER_UID}

‎internal/cmd/operator-sdk/scorecard/cmd.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,10 +91,10 @@ If the argument holds an image tag, it must be present remotely.`,
9191
scorecardCmd.Flags().DurationVarP(&c.waitTime, "wait-time", "w", 30*time.Second,
9292
"seconds to wait for tests to complete. Example: 35s")
9393
scorecardCmd.Flags().StringVarP(&c.storageImage, "storage-image", "b",
94-
"docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af",
94+
"quay.io/operator-framework/scorecard-storage:latest",
9595
"Storage image to be used by the Scorecard pod")
9696
scorecardCmd.Flags().StringVarP(&c.untarImage, "untar-image", "u",
97-
"registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7",
97+
"quay.io/operator-framework/scorecard-untar:latest",
9898
"Untar image to be used by the Scorecard pod")
9999
scorecardCmd.Flags().StringVarP(&c.testOutput, "test-output", "t", "test-output",
100100
"Test output directory.")

‎internal/cmd/operator-sdk/scorecard/cmd_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,12 +69,12 @@ var _ = Describe("Running the scorecard command", func() {
6969
flag = cmd.Flags().Lookup("storage-image")
7070
Expect(flag).NotTo(BeNil())
7171
Expect(flag.Shorthand).To(Equal("b"))
72-
Expect(flag.DefValue).To(Equal("docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af"))
72+
Expect(flag.DefValue).To(Equal("quay.io/operator-framework/scorecard-storage:latest"))
7373

7474
flag = cmd.Flags().Lookup("untar-image")
7575
Expect(flag).NotTo(BeNil())
7676
Expect(flag.Shorthand).To(Equal("u"))
77-
Expect(flag.DefValue).To(Equal("registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7"))
77+
Expect(flag.DefValue).To(Equal("quay.io/operator-framework/scorecard-untar:latest"))
7878
})
7979
})
8080

‎internal/scorecard/scorecard.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -227,8 +227,6 @@ func (r PodTestRunner) RunTest(ctx context.Context, test v1alpha3.TestConfigurat
227227
// creating a pod security context to support running in default namespace
228228
podSecCtx := v1.PodSecurityContext{}
229229
podSecCtx.RunAsNonRoot = &podSec
230-
podSecCtx.RunAsUser = &[]int64{1000}[0]
231-
podSecCtx.RunAsGroup = &[]int64{1000}[0]
232230
podSecCtx.SeccompProfile = &v1.SeccompProfile{
233231
Type: v1.SeccompProfileTypeRuntimeDefault,
234232
}

‎website/content/en/docs/cli/operator-sdk_scorecard.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@ operator-sdk scorecard [flags]
2828
-l, --selector string label selector to determine which tests are run
2929
-s, --service-account string Service account to use for tests (default "default")
3030
-x, --skip-cleanup Disable resource cleanup after tests are run
31-
-b, --storage-image string Storage image to be used by the Scorecard pod (default "docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af")
31+
-b, --storage-image string Storage image to be used by the Scorecard pod (default "quay.io/operator-framework/scorecard-storage:latest")
3232
-t, --test-output string Test output directory. (default "test-output")
33-
-u, --untar-image string Untar image to be used by the Scorecard pod (default "registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7")
33+
-u, --untar-image string Untar image to be used by the Scorecard pod (default "quay.io/operator-framework/scorecard-untar:latest")
3434
-w, --wait-time duration seconds to wait for tests to complete. Example: 35s (default 30s)
3535
```
3636

0 commit comments

Comments
 (0)