Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix e2e test when pod runs in openshift with correct security configuration #5558

Closed
wants to merge 1 commit into from

Conversation

claudio4j
Copy link
Contributor

The e2e test sets the namespace to a restricted PSA.
When the integration is run in openshift, it sets the correct securityContext to run with no privileges:

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL
  runAsNonRoot: true
  runAsUser: 1000650000
  seccompProfile:
    type: RuntimeDefault

The pod runs just fine with no errors.
So, this is just to disable this test in openshift.

Release Note

NONE

…he correct security configuration and there is no errors
Copy link
Contributor

@squakez squakez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test was done on purpose to fix a wrong behavior in Openshift, see #4974 - it would be good to understand if/how to rewrite it in order to simulate the failing conditions in OC instead of skipping.

@claudio4j claudio4j marked this pull request as draft May 29, 2024 10:11
@claudio4j
Copy link
Contributor Author

Thanks for pointing the original issue, I will further investigate it.

@claudio4j
Copy link
Contributor Author

I could reproduce the error in #4974 by installing camel-k 2.1.0 from operator hub in openshift 4.15.14.
Updated to Camel K 2.2.0 from operator hub.
Then there is no error anymore.
The fix was provided by #4932
The problem was in 2.1.0, the runAsUser field of securityContext was set from the platform namespace, while the correct one should be from the integration namespace.

The proposal of the test is to run an integration in a restricted namespace, whereas the restricted policy is the more secured one by the policy definition.
However when running in openshift the operator correctly sets the securityContext in compliance with the restricted policy, whereas when running not on openshift profile, the securityContext is not applied, so that results in error when the namespace is set with the restricted policy.
I will open an issue to set the securityContext policy regardless if it's running in openshift, this way the integration can correctly run in a restricted policy in any kubernetes cluster.

@squakez
Copy link
Contributor

squakez commented May 29, 2024

Thanks for looking at it. This is something we'll be already enforcing from version 2.4 onward: #5461

@claudio4j claudio4j closed this May 29, 2024
@claudio4j claudio4j deleted the upstream/main_fix_test_sec branch June 3, 2024 18:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants