Skip to content

Commit e9414cc

Browse files
everettravenshanemcd
everettraven
authored and
shanemcd
committed
(scorecard): Add new images for default untar and storage options (operator-framework#6335)
* add images for scorecard untar and storage Signed-off-by: Bryce Palmer <[email protected]> * Add new images for scorecard and use them as the default untar and storage images to ensure that scorecard pods are fully compliant with restricted PSA. This is done by making the images run as non-root by default (sets the user to non-root in the Dockerfile) fixes operator-framework#6295 Signed-off-by: Bryce Palmer <[email protected]> * update images & docs;add changelog Signed-off-by: Bryce Palmer <[email protected]> * add missing newline Signed-off-by: Bryce Palmer <[email protected]> --------- Signed-off-by: Bryce Palmer <[email protected]>
1 parent e3c5dd8 commit e9414cc

File tree

10 files changed

+112
-67
lines changed

10 files changed

+112
-67
lines changed

‎.github/workflows/deploy-manual.yml‎

Lines changed: 62 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ jobs:
1717
environment: deploy
1818
steps:
1919

20+
- name: update qemu
21+
run: |
22+
sudo apt update
23+
sudo apt install -y qemu
24+
2025
- name: set up qemu
2126
uses: docker/setup-qemu-action@v2
2227

@@ -48,7 +53,7 @@ jobs:
4853
fi
4954
echo "tag=${IMG}:${TAG}" >> $GITHUB_OUTPUT
5055
echo "git_commit=${GIT_COMMIT}" >> $GITHUB_OUTPUT
51-
56+
5257
- name: create 2.11-base tag
5358
id: base_tag_211
5459
run: |
@@ -67,65 +72,65 @@ jobs:
6772
with:
6873
file: ./images/ansible-operator/base.Dockerfile
6974
context: ./images/ansible-operator
70-
platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
75+
platforms: linux/s390x
7176
push: true
7277
tags: ${{ steps.base_tag_29.outputs.tag }}
7378
build-args: |
7479
GIT_COMMIT=${{ steps.base_tag_29.outputs.git_commit }}
7580
76-
- name: build and push ansible 2.11 dep image
77-
uses: docker/build-push-action@v3
78-
with:
79-
file: ./images/ansible-operator-2.11-preview/base.Dockerfile
80-
context: ./images/ansible-operator-2.11-preview
81-
platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
82-
push: true
83-
tags: ${{ steps.base_tag_211.outputs.tag }}
84-
build-args: |
85-
GIT_COMMIT=${{ steps.base_tag_211.outputs.git_commit }}
81+
# - name: build and push ansible 2.11 dep image
82+
# uses: docker/build-push-action@v3
83+
# with:
84+
# file: ./images/ansible-operator-2.11-preview/base.Dockerfile
85+
# context: ./images/ansible-operator-2.11-preview
86+
# platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
87+
# push: true
88+
# tags: ${{ steps.base_tag_211.outputs.tag }}
89+
# build-args: |
90+
# GIT_COMMIT=${{ steps.base_tag_211.outputs.git_commit }}
8691

87-
# This change will be staged and committed in the PR pushed below.
88-
# The script below will fail if no change was made.
89-
- name: update base of ansible-operator 2.9
90-
id: update_29
91-
run: |
92-
set -ex
93-
sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-base:.+|FROM ${{ steps.base_tag_29.outputs.tag }}|g' images/ansible-operator/Dockerfile
94-
git diff --exit-code --quiet && echo "Failed to update images/ansible-operator/Dockerfile" && exit 1
95-
REF="${{ github.event.ref }}"
96-
echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
97-
98-
- name: create PR for ansible-operator 2.9 Dockerfile
99-
uses: peter-evans/create-pull-request@v3
100-
with:
101-
title: "[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}"
102-
commit-message: |
103-
[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}
104-
105-
Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
106-
body: "New ansible-operator-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
107-
delete-branch: true
108-
branch-suffix: short-commit-hash
109-
110-
# This change will be staged and committed in the PR pushed below.
111-
# The script below will fail if no change was made.
112-
- name: update base of ansible-operator-2.11-preview
113-
id: update_211
114-
run: |
115-
set -ex
116-
sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-2.11-preview-base:.+|FROM ${{ steps.base_tag_211.outputs.tag }}|g' images/ansible-operator-2.11-preview/Dockerfile
117-
git diff --exit-code --quiet && echo "Failed to update images/ansible-operator-11-preview-base/Dockerfile" && exit 1
118-
REF="${{ github.event.ref }}"
119-
echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
120-
121-
- name: create PR for ansible-operator-2.11-preview Dockerfile
122-
uses: peter-evans/create-pull-request@v3
123-
with:
124-
title: "[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}"
125-
commit-message: |
126-
[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}
127-
128-
Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
129-
body: "New ansible-operator-2.11-preview-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
130-
delete-branch: true
131-
branch-suffix: short-commit-hash
92+
# # This change will be staged and committed in the PR pushed below.
93+
# # The script below will fail if no change was made.
94+
# - name: update base of ansible-operator 2.9
95+
# id: update_29
96+
# run: |
97+
# set -ex
98+
# sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-base:.+|FROM ${{ steps.base_tag_29.outputs.tag }}|g' images/ansible-operator/Dockerfile
99+
# git diff --exit-code --quiet && echo "Failed to update images/ansible-operator/Dockerfile" && exit 1
100+
# REF="${{ github.event.ref }}"
101+
# echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
102+
103+
# - name: create PR for ansible-operator 2.9 Dockerfile
104+
# uses: peter-evans/create-pull-request@v3
105+
# with:
106+
# title: "[${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}"
107+
# commit-message: |
108+
# [${{ steps.update_29.outputs.branch_name }}] image(ansible-operator): bump base to ${{ steps.base_tag_29.outputs.tag }}
109+
110+
# Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
111+
# body: "New ansible-operator-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
112+
# delete-branch: true
113+
# branch-suffix: short-commit-hash
114+
115+
# # This change will be staged and committed in the PR pushed below.
116+
# # The script below will fail if no change was made.
117+
# - name: update base of ansible-operator-2.11-preview
118+
# id: update_211
119+
# run: |
120+
# set -ex
121+
# sed -i -E 's|FROM quay\.io/operator-framework/ansible-operator-2.11-preview-base:.+|FROM ${{ steps.base_tag_211.outputs.tag }}|g' images/ansible-operator-2.11-preview/Dockerfile
122+
# git diff --exit-code --quiet && echo "Failed to update images/ansible-operator-11-preview-base/Dockerfile" && exit 1
123+
# REF="${{ github.event.ref }}"
124+
# echo "branch_name=${REF##*/}" >> $GITHUB_OUTPUT
125+
126+
# - name: create PR for ansible-operator-2.11-preview Dockerfile
127+
# uses: peter-evans/create-pull-request@v3
128+
# with:
129+
# title: "[${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}"
130+
# commit-message: |
131+
# [${{ steps.update_211.outputs.branch_name }}] image(ansible-operator-2.11-preview): bump base to ${{ steps.base_tag_211.outputs.tag }}
132+
133+
# Signed-off-by: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
134+
# body: "New ansible-operator-2.11-preview-base image built by https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
135+
# delete-branch: true
136+
# branch-suffix: short-commit-hash

‎.github/workflows/deploy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ jobs:
7272
environment: deploy
7373
strategy:
7474
matrix:
75-
id: ["operator-sdk", "helm-operator", "scorecard-test", "ansible-operator", "ansible-operator-2.11-preview"]
75+
id: ["operator-sdk", "helm-operator", "scorecard-test", "ansible-operator", "ansible-operator-2.11-preview", "scorecard-storage", "scorecard-untar"]
7676
steps:
7777

7878
- name: set up qemu

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ build/scorecard-test build/scorecard-test-kuttl build/custom-scorecard-tests:
9292

9393
# Convenience wrapper for building all remotely hosted images.
9494
.PHONY: image-build
95-
IMAGE_TARGET_LIST = operator-sdk helm-operator ansible-operator ansible-operator-2.11-preview scorecard-test scorecard-test-kuttl
95+
IMAGE_TARGET_LIST = operator-sdk helm-operator ansible-operator ansible-operator-2.11-preview scorecard-test scorecard-test-kuttl scorecard-untar scorecard-storage
9696
image-build: $(foreach i,$(IMAGE_TARGET_LIST),image/$(i)) ## Build all images.
9797

9898
# Convenience wrapper for building dependency base images.

‎changelog/fragments/03-scorecard-image-psa.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# entries is a list of entries to include in
2+
# release notes and/or the migration guide
3+
entries:
4+
- description: >
5+
(scorecard): update default storage and untar images to images
6+
that run as non-root users by default. This ensures full compliance
7+
with restricted PSA guidelines when using `--pod-security=restricted`.
8+
9+
# kind is one of:
10+
# - addition
11+
# - change
12+
# - deprecation
13+
# - removal
14+
# - bugfix
15+
kind: "bugfix"
16+
17+
# Is this a breaking change?
18+
breaking: false

‎images/scorecard-storage/Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM docker.io/busybox:1.36
2+
3+
## Create a new non-root user to run as
4+
ENV HOME=/opt/scorecard-untar \
5+
USER_NAME=scorecard-untar \
6+
USER_UID=1001
7+
8+
RUN echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
9+
10+
WORKDIR ${HOME}
11+
12+
USER ${USER_UID}

‎images/scorecard-untar/Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM registry.access.redhat.com/ubi8:8.7
2+
3+
## Create a new non-root user to run as
4+
ENV HOME=/opt/scorecard-untar \
5+
USER_NAME=scorecard-untar \
6+
USER_UID=1001
7+
8+
RUN echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
9+
10+
WORKDIR ${HOME}
11+
12+
USER ${USER_UID}

‎internal/cmd/operator-sdk/scorecard/cmd.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,10 +91,10 @@ If the argument holds an image tag, it must be present remotely.`,
9191
scorecardCmd.Flags().DurationVarP(&c.waitTime, "wait-time", "w", 30*time.Second,
9292
"seconds to wait for tests to complete. Example: 35s")
9393
scorecardCmd.Flags().StringVarP(&c.storageImage, "storage-image", "b",
94-
"docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af",
94+
"quay.io/operator-framework/scorecard-storage:latest",
9595
"Storage image to be used by the Scorecard pod")
9696
scorecardCmd.Flags().StringVarP(&c.untarImage, "untar-image", "u",
97-
"registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7",
97+
"quay.io/operator-framework/scorecard-untar:latest",
9898
"Untar image to be used by the Scorecard pod")
9999
scorecardCmd.Flags().StringVarP(&c.testOutput, "test-output", "t", "test-output",
100100
"Test output directory.")

‎internal/cmd/operator-sdk/scorecard/cmd_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,12 +69,12 @@ var _ = Describe("Running the scorecard command", func() {
6969
flag = cmd.Flags().Lookup("storage-image")
7070
Expect(flag).NotTo(BeNil())
7171
Expect(flag.Shorthand).To(Equal("b"))
72-
Expect(flag.DefValue).To(Equal("docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af"))
72+
Expect(flag.DefValue).To(Equal("quay.io/operator-framework/scorecard-storage:latest"))
7373

7474
flag = cmd.Flags().Lookup("untar-image")
7575
Expect(flag).NotTo(BeNil())
7676
Expect(flag.Shorthand).To(Equal("u"))
77-
Expect(flag.DefValue).To(Equal("registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7"))
77+
Expect(flag.DefValue).To(Equal("quay.io/operator-framework/scorecard-untar:latest"))
7878
})
7979
})
8080

‎internal/scorecard/scorecard.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -227,8 +227,6 @@ func (r PodTestRunner) RunTest(ctx context.Context, test v1alpha3.TestConfigurat
227227
// creating a pod security context to support running in default namespace
228228
podSecCtx := v1.PodSecurityContext{}
229229
podSecCtx.RunAsNonRoot = &podSec
230-
podSecCtx.RunAsUser = &[]int64{1000}[0]
231-
podSecCtx.RunAsGroup = &[]int64{1000}[0]
232230
podSecCtx.SeccompProfile = &v1.SeccompProfile{
233231
Type: v1.SeccompProfileTypeRuntimeDefault,
234232
}

‎website/content/en/docs/cli/operator-sdk_scorecard.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@ operator-sdk scorecard [flags]
2828
-l, --selector string label selector to determine which tests are run
2929
-s, --service-account string Service account to use for tests (default "default")
3030
-x, --skip-cleanup Disable resource cleanup after tests are run
31-
-b, --storage-image string Storage image to be used by the Scorecard pod (default "docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af")
31+
-b, --storage-image string Storage image to be used by the Scorecard pod (default "quay.io/operator-framework/scorecard-storage:latest")
3232
-t, --test-output string Test output directory. (default "test-output")
33-
-u, --untar-image string Untar image to be used by the Scorecard pod (default "registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7")
33+
-u, --untar-image string Untar image to be used by the Scorecard pod (default "quay.io/operator-framework/scorecard-untar:latest")
3434
-w, --wait-time duration seconds to wait for tests to complete. Example: 35s (default 30s)
3535
```
3636

0 commit comments

Comments
 (0)