Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Prevent containers from running as root by removing unnecessary anyuid SCC bindings #1460

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix: Prevent containers from running as root by removing unnecessary anyuid SCC bindings #1460

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
65af897
Removed Dashboard ServiceAccount from default RoleBinding granting an…
ugiordan Dec 18, 2024
08d2f5f
Removed ModelController ServiceAccount from default RoleBinding grant…
ugiordan Dec 18, 2024
4d1f0d5
Removed ModelMesh ServiceAccounts from default RoleBinding granting a…
ugiordan Dec 18, 2024
7af1f90
Removed Notebook ServiceAccount from default RoleBinding granting any…
ugiordan Dec 18, 2024
4380c8a
Merge branch 'main' into bug/RHOAIENG-7916
ugiordan Dec 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions controllers/components/dashboard/dashboard_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ import (
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/deploy"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/gc"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/render/kustomize"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/security"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/updatestatus"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/handlers"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/predicates/component"
Expand Down Expand Up @@ -91,7 +90,6 @@ func (s *componentHandler) NewComponentReconciler(ctx context.Context, mgr ctrl.
WithAction(initialize).
WithAction(devFlags).
WithAction(configureDependencies).
WithAction(security.NewUpdatePodSecurityRoleBindingAction(serviceAccounts)).
WithAction(kustomize.NewAction(
kustomize.WithCache(),
// Those are the default labels added by the legacy deploy method
Expand Down
7 changes: 0 additions & 7 deletions controllers/components/dashboard/dashboard_support.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,13 +57,6 @@ var (
cluster.Unknown: "/odh",
}

serviceAccounts = map[cluster.Platform][]string{
cluster.SelfManagedRhoai: {"rhods-dashboard"},
cluster.ManagedRhoai: {"rhods-dashboard"},
cluster.OpenDataHub: {"odh-dashboard"},
cluster.Unknown: {"odh-dashboard"},
}

imagesMap = map[string]string{
"odh-dashboard-image": "RELATED_IMAGE_ODH_DASHBOARD_IMAGE",
}
Expand Down
2 changes: 0 additions & 2 deletions controllers/components/modelcontroller/modelcontroller_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ import (
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/deploy"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/gc"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/render/kustomize"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/security"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/updatestatus"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/handlers"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/predicates/component"
Expand Down Expand Up @@ -70,7 +69,6 @@ func (s *componentHandler) NewComponentReconciler(ctx context.Context, mgr ctrl.
// Add ModelController specific actions
WithAction(initialize).
WithAction(devFlags). // devFlags triggerd by changes in DSC kserve and ModelMeshServing, also update .status.devflagurl
WithAction(security.NewUpdatePodSecurityRoleBindingAction(serviceAccounts)).
WithAction(kustomize.NewAction(
kustomize.WithCache(),
kustomize.WithLabel(labels.ODH.Component(LegacyComponentName), labels.True),
Expand Down
8 changes: 0 additions & 8 deletions controllers/components/modelcontroller/modelcontroller_support.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ import (

componentApi "github.com/opendatahub-io/opendatahub-operator/v2/apis/components/v1alpha1"
"github.com/opendatahub-io/opendatahub-operator/v2/controllers/status"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/cluster"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/types"
odhdeploy "github.com/opendatahub-io/opendatahub-operator/v2/pkg/deploy"
)
Expand All @@ -25,13 +24,6 @@ var (
imageParamMap = map[string]string{
"odh-model-controller": "RELATED_IMAGE_ODH_MODEL_CONTROLLER_IMAGE",
}

serviceAccounts = map[cluster.Platform][]string{
cluster.SelfManagedRhoai: {LegacyComponentName},
cluster.ManagedRhoai: {LegacyComponentName},
cluster.OpenDataHub: {LegacyComponentName},
cluster.Unknown: {LegacyComponentName},
}
)

func manifestsPath() types.ManifestInfo {
Expand Down
2 changes: 0 additions & 2 deletions controllers/components/modelmeshserving/modelmeshserving_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,6 @@ import (
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/deploy"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/gc"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/render/kustomize"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/security"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/updatestatus"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/handlers"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/predicates/clusterrole"
Expand Down Expand Up @@ -69,7 +68,6 @@ func (s *componentHandler) NewComponentReconciler(ctx context.Context, mgr ctrl.
// Add ModelMeshServing specific actions
WithAction(initialize).
WithAction(devFlags).
WithAction(security.NewUpdatePodSecurityRoleBindingAction(serviceAccounts)).
WithAction(kustomize.NewAction(
kustomize.WithCache(),
kustomize.WithLabel(labels.ODH.Component(LegacyComponentName), labels.True),
Expand Down
8 changes: 0 additions & 8 deletions controllers/components/modelmeshserving/modelmeshserving_support.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ import (

componentApi "github.com/opendatahub-io/opendatahub-operator/v2/apis/components/v1alpha1"
"github.com/opendatahub-io/opendatahub-operator/v2/controllers/status"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/cluster"
odhtypes "github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/types"
odhdeploy "github.com/opendatahub-io/opendatahub-operator/v2/pkg/deploy"
)
Expand All @@ -28,13 +27,6 @@ var (
"odh-modelmesh": "RELATED_IMAGE_ODH_MODELMESH_IMAGE",
"odh-modelmesh-controller": "RELATED_IMAGE_ODH_MODELMESH_CONTROLLER_IMAGE",
}

serviceAccounts = map[cluster.Platform][]string{
cluster.SelfManagedRhoai: {"modelmesh", "modelmesh-controller"},
cluster.ManagedRhoai: {"modelmesh", "modelmesh-controller"},
cluster.OpenDataHub: {"modelmesh", "modelmesh-controller"},
cluster.Unknown: {"modelmesh", "modelmesh-controller"},
}
)

func manifestsPath() odhtypes.ManifestInfo {
Expand Down
2 changes: 0 additions & 2 deletions controllers/components/workbenches/workbenches_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ import (
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/deploy"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/gc"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/render/kustomize"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/security"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/actions/updatestatus"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/handlers"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/predicates/component"
Expand Down Expand Up @@ -62,7 +61,6 @@ func (s *componentHandler) NewComponentReconciler(ctx context.Context, mgr ctrl.
WithAction(initialize).
WithAction(devFlags).
WithAction(configureDependencies).
WithAction(security.NewUpdatePodSecurityRoleBindingAction(serviceAccounts)).
WithAction(kustomize.NewAction(
kustomize.WithCache(),
kustomize.WithLabel(labels.ODH.Component(LegacyComponentName), labels.True),
Expand Down
10 changes: 0 additions & 10 deletions controllers/components/workbenches/workbenches_support.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ import (

componentApi "github.com/opendatahub-io/opendatahub-operator/v2/apis/components/v1alpha1"
"github.com/opendatahub-io/opendatahub-operator/v2/controllers/status"
"github.com/opendatahub-io/opendatahub-operator/v2/pkg/cluster"
odhtypes "github.com/opendatahub-io/opendatahub-operator/v2/pkg/controller/types"
odhdeploy "github.com/opendatahub-io/opendatahub-operator/v2/pkg/deploy"
)
Expand All @@ -26,8 +25,6 @@ const (
kfNotebookControllerPath = "kf-notebook-controller"
kfNotebookControllerManifestSourcePath = "overlays/openshift"

nbcServiceAccountName = "notebook-controller-service-account"

// LegacyComponentName is the name of the component that is assigned to deployments
// via Kustomize. Since a deployment selector is immutable, we can't upgrade existing
// deployment to the new component name, so keep it around till we figure out a solution.
Expand All @@ -38,13 +35,6 @@ var (
notebookControllerContextDir = path.Join(ComponentName, notebookControllerPath)
kfNotebookControllerContextDir = path.Join(ComponentName, kfNotebookControllerPath)
notebookContextDir = path.Join(ComponentName, notebooksPath)

serviceAccounts = map[cluster.Platform][]string{
cluster.SelfManagedRhoai: {nbcServiceAccountName},
cluster.ManagedRhoai: {nbcServiceAccountName},
cluster.OpenDataHub: {nbcServiceAccountName},
cluster.Unknown: {nbcServiceAccountName},
}
)

// manifests for nbc in ODH and RHOAI + downstream use it for imageparams.
Expand Down
Loading