Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add seccompProfile #3562

Merged
merged 2 commits into from
Sep 2, 2022
Merged

feat: add seccompProfile #3562

merged 2 commits into from
Sep 2, 2022

Conversation

joebowbeer
Copy link
Contributor

@joebowbeer joebowbeer commented Aug 17, 2022 •
edited
Loading

Add/update securityContext configs:

  • seccompProfile.type RuntimeDefault is needed for compliance with restricted policies in Kubernetes 1.19+
  • Updated comment in metrics Deployment regarding readOnlyRootFilesystem

Checklist

Fixes #3561

@joebowbeer joebowbeer requested a review from a team as a code owner August 17, 2022 17:43
@zroubalik
Copy link
Member

zroubalik commented Aug 18, 2022 •
edited by github-actions bot
Loading

/run-e2e
Update: You can check the progress here

@joebowbeer
Copy link
Contributor Author

joebowbeer commented Aug 19, 2022 •
edited
Loading

@zroubalik I can't find any details about e2e failure

One thing to be aware of: seccompProfile is only supported in Kubernetes 1.19+

@zroubalik
Copy link
Member

@joebowbeer that failure is transient, unrelated :)

@zroubalik
Copy link
Member

Could you please update Changelog to reflect this addition?

@joebowbeer joebowbeer force-pushed the seccomp-profile branch 2 times, most recently from f0bdd4f to 262c10f Compare August 20, 2022 05:08
@joebowbeer
Copy link
Contributor Author

joebowbeer commented Aug 20, 2022 •
edited
Loading

@zroubalik PTAL

Since seccompProfile requires Kubernetes 1.19+ (otherwise validation fails), I think this is the best that can be done until the minimum version is raised from 1.17 to 1.19.

@joebowbeer joebowbeer mentioned this pull request Aug 20, 2022
Merged
3 tasks
@tomkerkhove
Copy link
Member

tomkerkhove commented Aug 22, 2022 •
edited
Loading

As per https://github.com/kedacore/governance/blob/main/SUPPORT.md#kubernetes-support we should just add it given 1.19 has been out for a while.

Adding something that is documented doesn't add much value given end-users will not notice that so it will not be used

@joebowbeer
Copy link
Contributor Author

joebowbeer commented Aug 23, 2022 •
edited
Loading

@zroubalik @tomkerkhove PTAL

I restored the seccompProfile changes for Kubernetes 1.19+ that have already been merged into the helm chart.

/run-e2e ?

@JorTurFer
Copy link
Member

JorTurFer commented Aug 23, 2022 •
edited by github-actions bot
Loading

/run-e2e
Update: You can check the progress here

@joebowbeer
Copy link
Contributor Author

@JorTurFer @zroubalik the e2e tests failed in 0s - flake?

@JorTurFer
Copy link
Member

yes, it looks as flaky test, I have opened an issue to review them #3594

@JorTurFer
Copy link
Member

Thanks for your contribution!

@joebowbeer
Copy link
Contributor Author

/run-e2e ?

@JorTurFer
Copy link
Member

JorTurFer commented Aug 29, 2022 •
edited by github-actions bot
Loading

/run-e2e
Update: You can check the progress here

@JorTurFer
Copy link
Member

hey @joebowbeer
I think this PR is ready to merge but we are going to do a hotfix release soon with only some fixes. After the hotfix release is done, I'll continue with this PR. Sorry for the incovenient

@JorTurFer
Copy link
Member

Could you rebase your PR? 🙏 after the release there is a conflict with the changelog

@joebowbeer
feat: add seccompProfile
def1fda 
Signed-off-by: Joe Bowbeer <joe.bowbeer@gmail.com>
@joebowbeer
Copy link
Contributor Author

@JorTurFer rebased

@JorTurFer
Copy link
Member

JorTurFer commented Sep 1, 2022 •
edited by github-actions bot
Loading

/run-e2e
Update: You can check the progress here

@JorTurFer JorTurFer enabled auto-merge (squash) September 2, 2022 08:08
@JorTurFer JorTurFer merged commit 90d19d2 into kedacore:main Sep 2, 2022
@JorTurFer
Copy link
Member

Thanks a lot! ❤️

@joebowbeer joebowbeer deleted the seccomp-profile branch September 2, 2022 11:14
andyatwork pushed a commit to andyatwork/keda that referenced this pull request Oct 31, 2022
@joebowbeer @andyatwork
feat: add seccompProfile (kedacore#3562)
d51b9e1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@JorTurFer JorTurFer JorTurFer approved these changes

Assignees
No one assigned
Labels
skip-e2e
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add seccompProfile.type RuntimeDefault for secure-by-default
4 participants
@joebowbeer @zroubalik @tomkerkhove @JorTurFer