Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Pod Security Standards #266

Closed
jmesnil opened this issue Mar 13, 2023 · 0 comments · Fixed by #268
Closed

Update Pod Security Standards #266

jmesnil opened this issue Mar 13, 2023 · 0 comments · Fixed by #268
Milestone
1.0.0

Comments

@jmesnil
Copy link
Member

jmesnil commented Mar 13, 2023 •
edited
Loading

Kubernetes Pod Security Standards are being updated (as explained in https://sdk.operatorframework.io/docs/best-practices/pod-security-standards/) and the WildFly Operator lags behind these changes.

In the mainbranch, the user can specify the SecurityContext on the deployed Pod templates to control the behaviour (#238).

However, it is missing a seccompProfile to comply with the security standards.

In addition, we can provide a good default value for this security context and do not need to ask the user to specify it.
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Mar 13, 2023
@jmesnil
[wildfly#266] Update Pods Security Standards
0abc84a 
Configure the statefulset's pods to run in non-root mode.
It drops all security capabilities and does not allow priviledge
escalation.

This fixes wildfly#266 WIP add security context to statefulset

Signed-off-by: Jeff Mesnil <[email protected]>
@jmesnil jmesnil mentioned this issue Mar 13, 2023
Closed
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Mar 13, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
a809ab9 
* Add a default Security Context if the user does not specify one from the
WildFlyServerSpec.
* In the CSV, updates the operator's own deployment to comply with the
  security standards.

This fixes wildfly#266

Signed-off-by: Jeff Mesnil <[email protected]>
@jmesnil jmesnil mentioned this issue Mar 13, 2023
Merged
@jmesnil jmesnil linked a pull request Mar 13, 2023 that will close this issue
[#266] [0.5.7] Update Pods Security Standards #267
Closed
@jmesnil jmesnil added this to the 0.5.7 milestone Mar 13, 2023
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Mar 14, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
57ed5e0 
* Add a default Security Context if the user does not specify one from the
WildFlyServerSpec.
* In the CSV, updates the operator's own deployment to comply with the
  security standards.

This fixes wildfly#266

Signed-off-by: Jeff Mesnil <[email protected]>
@jmesnil jmesnil modified the milestones: 0.5.7, 1.0.0 Mar 14, 2023
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Mar 14, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
b441a9e 
* Add a default Security Context if the user does not specify one from the
WildFlyServerSpec.
* In the CSV, updates the operator's own deployment to comply with the
  security standards.

This fixes wildfly#266

Signed-off-by: Jeff Mesnil <[email protected]>
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Mar 14, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
4982f64 
* Add a default Security Context if the user does not specify one from the
WildFlyServerSpec.
* In the CSV, updates the operator's own deployment to comply with the
  security standards.

This fixes wildfly#266

Signed-off-by: Jeff Mesnil <[email protected]>
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Mar 14, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
32ccffe 
* Add a default Security Context if the user does not specify one from the
WildFlyServerSpec.
* In the CSV, updates the operator's own deployment to comply with the
  security standards.

This fixes wildfly#266

Signed-off-by: Jeff Mesnil <[email protected]>
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Mar 29, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
a591440 
* Add a default Security Context if the user does not specify one from the
WildFlyServerSpec.
* In the CSV, updates the operator's own deployment to comply with the
  security standards.

This fixes wildfly#266

Signed-off-by: Jeff Mesnil <[email protected]>
jmesnil added a commit that referenced this issue Mar 29, 2023
@jmesnil
Merge pull request #268 from jmesnil/266_security-context
e7bd2a4 
[#266] Updated Pod security standards
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Apr 11, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
c0e5dfa 
* Do not specify the 185 (jboss) user by default

Signed-off-by: Jeff Mesnil <[email protected]>
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue Apr 12, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
fee17ee 
* Revert the default security context

Signed-off-by: Jeff Mesnil <[email protected]>
jmesnil added a commit that referenced this issue Apr 25, 2023
@jmesnil
Merge pull request #271 from jmesnil/266_security-context
4ec0412 
[#266] Updated Pod security standards
jmesnil added a commit to jmesnil/wildfly-operator that referenced this issue May 31, 2023
@jmesnil
[wildfly#266] Updated Pod security standards
65a7445 
Add security context settings to Kustomized resources.

Signed-off-by: Jeff Mesnil <[email protected]>
yersan added a commit that referenced this issue Jun 21, 2023
@yersan
Merge pull request #272 from jmesnil/266_security-context_kustomize
82e0d4d 
[#266] Updated Pod security standards
@jmesnil jmesnil mentioned this issue Sep 15, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
1.0.0
1 participant
@jmesnil