Skip to content

Commit cda21ba

Browse files
everettravenshanemcd
everettraven
authored and
shanemcd
committed
(scorecard): Add new images for default untar and storage options (operator-framework#6335)
* add images for scorecard untar and storage Signed-off-by: Bryce Palmer <[email protected]> * Add new images for scorecard and use them as the default untar and storage images to ensure that scorecard pods are fully compliant with restricted PSA. This is done by making the images run as non-root by default (sets the user to non-root in the Dockerfile) fixes operator-framework#6295 Signed-off-by: Bryce Palmer <[email protected]> * update images & docs;add changelog Signed-off-by: Bryce Palmer <[email protected]> * add missing newline Signed-off-by: Bryce Palmer <[email protected]> --------- Signed-off-by: Bryce Palmer <[email protected]>
1 parent e3c5dd8 commit cda21ba

File tree

12 files changed

+121
-79
lines changed

12 files changed

+121
-79
lines changed

‎.github/workflows/deploy-manual.yml‎

Lines changed: 64 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,13 @@ jobs:
1717
environment: deploy
1818
steps:
1919

20+
# https://github.com/orgs/community/discussions/47863
21+
- name: update packages
22+
run: |
23+
# sudo apt-mark hold grub-efi-amd64-signed
24+
sudo apt-get update --fix-missing
25+
sudo apt upgrade -y
26+
2027
- name: set up qemu
2128
uses: docker/setup-qemu-action@v2
2229

@@ -48,7 +55,7 @@ jobs:
4855
fi
4956
echo "tag=${IMG}:${TAG}" >> $GITHUB_OUTPUT
5057
echo "git_commit=${GIT_COMMIT}" >> $GITHUB_OUTPUT
51-
58+
5259
- name: create 2.11-base tag
5360
id: base_tag_211
5461
run: |
@@ -67,65 +74,65 @@ jobs:
6774
with:
6875
file: ./images/ansible-operator/base.Dockerfile
6976
context: ./images/ansible-operator
70-
platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
77+
platforms: linux/s390x
7178
push: true
7279
tags: ${{ steps.base_tag_29.outputs.tag }}
7380
build-args: |
7481
GIT_COMMIT=${{ steps.base_tag_29.outputs.git_commit }}
7582
76-
- name: build and push ansible 2.11 dep image
77-
uses: docker/build-push-action@v3
78-
with:
79-
file: ./images/ansible-operator-2.11-preview/base.Dockerfile
80-
context: ./images/ansible-operator-2.11-preview
81-
platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
82-
push: true
83-
tags: ${{ steps.base_tag_211.outputs.tag }}
84-
build-args: |
85-
GIT_COMMIT=${{ steps.base_tag_211.outputs.git_commit }}
83+
# - name: build and push ansible 2.11 dep image
84+
# uses: docker/build-push-action@v3
85+
# with:
86+
# file: ./images/ansible-operator-2.11-preview/base.Dockerfile
87+
# context: ./images/ansible-operator-2.11-preview
88+
# platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
89+
# push: true
90+
# tags: ${{ steps.base_tag_211.outputs.tag }}
91+
# build-args: |
92+
# GIT_COMMIT=${{ steps.base_tag_211.outputs.git_commit }}
8693

87-
# This change will be staged and committed in the PR pushed below.
88-
# The script below will fail if no change was made.
89-
- name: update base of ansible-operator 2.9
90-
id: update_29
91-
run: |
92-
set -ex
93-
sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-base:.+|FROM ${{ steps.base_tag_29.outputs.tag }}|g' images/ansible-operator/Dockerfile
94-
git diff --exit-code --quiet && echo "Failed to update images/ansible-operator/Dockerfile" && exit 1
95-
REF="${{ github.event.ref }}"
96-
echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
97-
98-
- name: create PR for ansible-operator 2.9 Dockerfile
99-
uses: peter-evans/create-pull-request@v3
100-
with:
101-
title: "[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}"
102-
commit-message: |
103-
[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}
104-
105-
Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
106-
body: "New ansible-operator-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
107-
delete-branch: true
108-
branch-suffix: short-commit-hash
109-
110-
# This change will be staged and committed in the PR pushed below.
111-
# The script below will fail if no change was made.
112-
- name: update base of ansible-operator-2.11-preview
113-
id: update_211
114-
run: |
115-
set -ex
116-
sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-2.11-preview-base:.+|FROM ${{ steps.base_tag_211.outputs.tag }}|g' images/ansible-operator-2.11-preview/Dockerfile
117-
git diff --exit-code --quiet && echo "Failed to update images/ansible-operator-11-preview-base/Dockerfile" && exit 1
118-
REF="${{ github.event.ref }}"
119-
echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
120-
121-
- name: create PR for ansible-operator-2.11-preview Dockerfile
122-
uses: peter-evans/create-pull-request@v3
123-
with:
124-
title: "[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}"
125-
commit-message: |
126-
[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}
127-
128-
Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
129-
body: "New ansible-operator-2.11-preview-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
130-
delete-branch: true
131-
branch-suffix: short-commit-hash
94+
# # This change will be staged and committed in the PR pushed below.
95+
# # The script below will fail if no change was made.
96+
# - name: update base of ansible-operator 2.9
97+
# id: update_29
98+
# run: |
99+
# set -ex
100+
# sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-base:.+|FROM ${{ steps.base_tag_29.outputs.tag }}|g' images/ansible-operator/Dockerfile
101+
# git diff --exit-code --quiet && echo "Failed to update images/ansible-operator/Dockerfile" && exit 1
102+
# REF="${{ github.event.ref }}"
103+
# echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
104+
105+
# - name: create PR for ansible-operator 2.9 Dockerfile
106+
# uses: peter-evans/create-pull-request@v3
107+
# with:
108+
# title: "[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}"
109+
# commit-message: |
110+
# [${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}
111+
112+
# Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
113+
# body: "New ansible-operator-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
114+
# delete-branch: true
115+
# branch-suffix: short-commit-hash
116+
117+
# # This change will be staged and committed in the PR pushed below.
118+
# # The script below will fail if no change was made.
119+
# - name: update base of ansible-operator-2.11-preview
120+
# id: update_211
121+
# run: |
122+
# set -ex
123+
# sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-2.11-preview-base:.+|FROM ${{ steps.base_tag_211.outputs.tag }}|g' images/ansible-operator-2.11-preview/Dockerfile
124+
# git diff --exit-code --quiet && echo "Failed to update images/ansible-operator-11-preview-base/Dockerfile" && exit 1
125+
# REF="${{ github.event.ref }}"
126+
# echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
127+
128+
# - name: create PR for ansible-operator-2.11-preview Dockerfile
129+
# uses: peter-evans/create-pull-request@v3
130+
# with:
131+
# title: "[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}"
132+
# commit-message: |
133+
# [${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}
134+
135+
# Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
136+
# body: "New ansible-operator-2.11-preview-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
137+
# delete-branch: true
138+
# branch-suffix: short-commit-hash

‎.github/workflows/deploy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ jobs:
7272
environment: deploy
7373
strategy:
7474
matrix:
75-
id: ["operator-sdk", "helm-operator", "scorecard-test", "ansible-operator", "ansible-operator-2.11-preview"]
75+
id: ["operator-sdk", "helm-operator", "scorecard-test", "ansible-operator", "ansible-operator-2.11-preview", "scorecard-storage", "scorecard-untar"]
7676
steps:
7777

7878
- name: set up qemu

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ build/scorecard-test build/scorecard-test-kuttl build/custom-scorecard-tests:
9292

9393
# Convenience wrapper for building all remotely hosted images.
9494
.PHONY: image-build
95-
IMAGE_TARGET_LIST = operator-sdk helm-operator ansible-operator ansible-operator-2.11-preview scorecard-test scorecard-test-kuttl
95+
IMAGE_TARGET_LIST = operator-sdk helm-operator ansible-operator ansible-operator-2.11-preview scorecard-test scorecard-test-kuttl scorecard-untar scorecard-storage
9696
image-build: $(foreach i,$(IMAGE_TARGET_LIST),image/$(i)) ## Build all images.
9797

9898
# Convenience wrapper for building dependency base images.

‎changelog/fragments/03-scorecard-image-psa.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# entries is a list of entries to include in
2+
# release notes and/or the migration guide
3+
entries:
4+
- description: >
5+
(scorecard): update default storage and untar images to images
6+
that run as non-root users by default. This ensures full compliance
7+
with restricted PSA guidelines when using `--pod-security=restricted`.
8+
9+
# kind is one of:
10+
# - addition
11+
# - change
12+
# - deprecation
13+
# - removal
14+
# - bugfix
15+
kind: "bugfix"
16+
17+
# Is this a breaking change?
18+
breaking: false

‎images/ansible-operator/base.Dockerfile‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ENV PATH="/root/.cargo/bin:${PATH}"
1010
RUN rustc --version
1111

1212
# Copy python dependencies (including ansible) to be installed using Pipenv
13-
COPY Pipfile* ./
13+
COPY requirements.txt ./
1414
# Instruct pip(env) not to keep a cache of installed packages,
1515
# to install into the global site-packages and
1616
# to clear the pipenv cache as well
@@ -22,14 +22,9 @@ ENV PIP_NO_CACHE_DIR=1 \
2222
# pip3~=21.1 fixes a vulnerability described in https://github.com/pypa/pip/pull/9827.
2323
RUN set -e && yum clean all && rm -rf /var/cache/yum/* \
2424
&& yum update -y \
25-
&& yum install -y libffi-devel openssl-devel python38-devel gcc python38-pip python38-setuptools \
26-
&& pip3 install --upgrade pip~=23.0.1 \
27-
&& pip3 install pipenv==2023.2.18 \
28-
&& pipenv install --deploy \
29-
&& pipenv check -i 42926 -i 42923 -i 45114 \
30-
&& yum remove -y gcc libffi-devel openssl-devel python38-devel \
31-
&& yum clean all \
32-
&& rm -rf /var/cache/yum
25+
&& yum install -y libffi-devel openssl-devel python38-devel gcc python38-pip \
26+
&& pip3 install --upgrade --force-reinstall pip setuptools \
27+
&& pip3 install -r requirements.txt
3328

3429
FROM registry.access.redhat.com/ubi8/ubi:8.7
3530
ARG TARGETARCH
@@ -46,9 +41,8 @@ RUN mkdir -p /etc/ansible \
4641

4742
RUN set -e && yum clean all && rm -rf /var/cache/yum/* \
4843
&& yum update -y \
49-
&& yum install -y python38-pip python38-setuptools \
50-
&& pip3 install --upgrade pip~=23.0.1 \
51-
&& pip3 install pipenv==2023.2.18 \
44+
&& yum install -y python38-pip \
45+
&& pip3 install --upgrade --force-reinstall pip setuptools \
5246
&& yum clean all \
5347
&& rm -rf /var/cache/yum
5448

‎images/ansible-operator/requirements.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
cryptography

‎images/scorecard-storage/Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM docker.io/busybox:1.36
2+
3+
## Create a new non-root user to run as
4+
ENV HOME=/opt/scorecard-untar \
5+
USER_NAME=scorecard-untar \
6+
USER_UID=1001
7+
8+
RUN echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
9+
10+
WORKDIR ${HOME}
11+
12+
USER ${USER_UID}

‎images/scorecard-untar/Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM registry.access.redhat.com/ubi8:8.7
2+
3+
## Create a new non-root user to run as
4+
ENV HOME=/opt/scorecard-untar \
5+
USER_NAME=scorecard-untar \
6+
USER_UID=1001
7+
8+
RUN echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
9+
10+
WORKDIR ${HOME}
11+
12+
USER ${USER_UID}

‎internal/cmd/operator-sdk/scorecard/cmd.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,10 +91,10 @@ If the argument holds an image tag, it must be present remotely.`,
9191
scorecardCmd.Flags().DurationVarP(&c.waitTime, "wait-time", "w", 30*time.Second,
9292
"seconds to wait for tests to complete. Example: 35s")
9393
scorecardCmd.Flags().StringVarP(&c.storageImage, "storage-image", "b",
94-
"docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af",
94+
"quay.io/operator-framework/scorecard-storage:latest",
9595
"Storage image to be used by the Scorecard pod")
9696
scorecardCmd.Flags().StringVarP(&c.untarImage, "untar-image", "u",
97-
"registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7",
97+
"quay.io/operator-framework/scorecard-untar:latest",
9898
"Untar image to be used by the Scorecard pod")
9999
scorecardCmd.Flags().StringVarP(&c.testOutput, "test-output", "t", "test-output",
100100
"Test output directory.")

‎internal/cmd/operator-sdk/scorecard/cmd_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,12 +69,12 @@ var _ = Describe("Running the scorecard command", func() {
6969
flag = cmd.Flags().Lookup("storage-image")
7070
Expect(flag).NotTo(BeNil())
7171
Expect(flag.Shorthand).To(Equal("b"))
72-
Expect(flag.DefValue).To(Equal("docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af"))
72+
Expect(flag.DefValue).To(Equal("quay.io/operator-framework/scorecard-storage:latest"))
7373

7474
flag = cmd.Flags().Lookup("untar-image")
7575
Expect(flag).NotTo(BeNil())
7676
Expect(flag.Shorthand).To(Equal("u"))
77-
Expect(flag.DefValue).To(Equal("registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7"))
77+
Expect(flag.DefValue).To(Equal("quay.io/operator-framework/scorecard-untar:latest"))
7878
})
7979
})
8080

0 commit comments

Comments
 (0)