Skip to content

Commit a6725fc

Browse files
elukeyelukey
committed
knative-serving: backport knative/serving#14363
The pull request is needed to force Knative to set runAsNonRoot when secure-pod-defaults is true. The option forces knative to create the user pods with all the safest security options to pass the PSS restriction policy, but at the moment it is lacking runAsNonRoot forced to true. Note: I haven't backported the whole patch since part of it overlapped with a previous one for queue.go, where seccomp's defaults were set. The same code was committed in different pull requests, so I just removed the bit already there to allow patch to avoid error/warnings. Bug: T369493 Change-Id: Iceb1ac2d83f298ef2a834e24a8fdc8a6f1df4a28
1 parent cd0ba9b commit a6725fc

File tree

10 files changed

+137
-1
lines changed

10 files changed

+137
-1
lines changed

‎images/knative/serving/activator/changelog‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
knative-serving-activator (1.7.2-7) wikimedia; urgency=medium
2+
3+
* Backport https://github.com/knative/serving/pull/14363.
4+
5+
-- Luca Toscano <[email protected]> Wed, 26 Feb 2025 16:24:00 +0100
6+
17
knative-serving-activator (1.7.2-6-20250223) wikimedia; urgency=medium
28

39
* Weekly rebuild.

‎images/knative/serving/autoscaler/changelog‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
knative-serving-autoscaler (1.7.2-7) wikimedia; urgency=medium
2+
3+
* Backport https://github.com/knative/serving/pull/14363.
4+
5+
-- Luca Toscano <[email protected]> Wed, 26 Feb 2025 16:24:00 +0100
6+
17
knative-serving-autoscaler (1.7.2-6-20250223) wikimedia; urgency=medium
28

39
* Weekly rebuild.

‎images/knative/serving/build/Dockerfile.template‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ COPY pull_13395.patch /tmp/pull_13395.patch
1010
COPY pull_13398.patch /tmp/pull_13398.patch
1111
COPY pull_13401.patch /tmp/pull_13401.patch
1212
COPY pull_13402.patch /tmp/pull_13402.patch
13+
COPY pull_14363.patch /tmp/pull_14363.patch
1314
RUN chmod o+rx /bin/builder.sh
1415

1516
USER nobody
@@ -22,5 +23,6 @@ RUN mkdir -p {{ repo_base }} \
2223
&& patch -l -p1 < /tmp/pull_13395.patch \
2324
&& patch -l -p1 < /tmp/pull_13398.patch \
2425
&& patch -l -p1 < /tmp/pull_13401.patch \
25-
&& patch -l -p1 < /tmp/pull_13402.patch
26+
&& patch -l -p1 < /tmp/pull_13402.patch \
27+
&& patch -l -p1 < /tmp/pull_14363.patch
2628
RUN /bin/builder.sh {{ repo_base }} serving

‎images/knative/serving/build/changelog‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
knative-build (1.7.2-6) wikimedia; urgency=medium
2+
3+
* Backport https://github.com/knative/serving/pull/14363.
4+
5+
-- Luca Toscano <[email protected]> Wed, 26 Feb 2025 16:24:00 +0100
6+
17
knative-build (1.7.2-5-20250223) wikimedia; urgency=medium
28

39
* Weekly rebuild.

‎images/knative/serving/build/pull_14363.patch‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
From 72613d23483353ed27d8c40d0ae6ebf0ff986694 Mon Sep 17 00:00:00 2001
2+
From: Clay Kauzlaric <[email protected]>
3+
Date: Wed, 13 Sep 2023 12:57:30 -0400
4+
Subject: [PATCH 2/3] run as non root by default
5+
6+
---
7+
pkg/apis/serving/v1/revision_defaults.go | 4 ++++
8+
1 file changed, 4 insertions(+)
9+
10+
diff --git a/pkg/apis/serving/v1/revision_defaults.go b/pkg/apis/serving/v1/revision_defaults.go
11+
index 8acbf3446fd1..4805f5b1fe35 100644
12+
--- a/pkg/apis/serving/v1/revision_defaults.go
13+
+++ b/pkg/apis/serving/v1/revision_defaults.go
14+
@@ -208,6 +208,10 @@ func (rs *RevisionSpec) defaultSecurityContext(psc *corev1.PodSecurityContext, c
15+
}
16+
}
17+
18+
+ if psc.RunAsNonRoot == nil {
19+
+ updatedSC.RunAsNonRoot = ptr.Bool(true)
20+
+ }
21+
+
22+
if *updatedSC != (corev1.SecurityContext{}) {
23+
container.SecurityContext = updatedSC
24+
}
25+
26+
From 2cf6abf1cc3c884e13d4fab9dc03bbe8b7d3850e Mon Sep 17 00:00:00 2001
27+
From: Clay Kauzlaric <[email protected]>
28+
Date: Wed, 13 Sep 2023 16:26:53 -0400
29+
Subject: [PATCH 3/3] update tests to expect new default run as nonroot
30+
31+
---
32+
pkg/apis/serving/v1/revision_defaults_test.go | 6 ++++++
33+
1 file changed, 6 insertions(+)
34+
35+
diff --git a/pkg/apis/serving/v1/revision_defaults_test.go b/pkg/apis/serving/v1/revision_defaults_test.go
36+
index 332fecfb4d9d..0fe5e65079b7 100644
37+
--- a/pkg/apis/serving/v1/revision_defaults_test.go
38+
+++ b/pkg/apis/serving/v1/revision_defaults_test.go
39+
@@ -900,6 +900,7 @@ func TestRevisionDefaulting(t *testing.T) {
40+
ReadinessProbe: defaultProbe,
41+
Resources: defaultResources,
42+
SecurityContext: &corev1.SecurityContext{
43+
+ RunAsNonRoot: ptr.Bool(true),
44+
AllowPrivilegeEscalation: ptr.Bool(false),
45+
SeccompProfile: &corev1.SeccompProfile{
46+
Type: corev1.SeccompProfileTypeRuntimeDefault,
47+
@@ -913,6 +914,7 @@ func TestRevisionDefaulting(t *testing.T) {
48+
Name: "sidecar",
49+
Resources: defaultResources,
50+
SecurityContext: &corev1.SecurityContext{
51+
+ RunAsNonRoot: ptr.Bool(true),
52+
AllowPrivilegeEscalation: ptr.Bool(false),
53+
SeccompProfile: &corev1.SeccompProfile{
54+
Type: corev1.SeccompProfileTypeRuntimeDefault,
55+
@@ -925,6 +927,7 @@ func TestRevisionDefaulting(t *testing.T) {
56+
Name: "special-sidecar",
57+
Resources: defaultResources,
58+
SecurityContext: &corev1.SecurityContext{
59+
+ RunAsNonRoot: ptr.Bool(true),
60+
AllowPrivilegeEscalation: ptr.Bool(true),
61+
SeccompProfile: &corev1.SeccompProfile{
62+
Type: corev1.SeccompProfileTypeRuntimeDefault,
63+
@@ -938,6 +941,7 @@ func TestRevisionDefaulting(t *testing.T) {
64+
InitContainers: []corev1.Container{{
65+
Name: "special-init",
66+
SecurityContext: &corev1.SecurityContext{
67+
+ RunAsNonRoot: ptr.Bool(true),
68+
AllowPrivilegeEscalation: ptr.Bool(true),
69+
SeccompProfile: &corev1.SeccompProfile{
70+
Type: corev1.SeccompProfileTypeLocalhost,
71+
@@ -1000,6 +1004,7 @@ func TestRevisionDefaulting(t *testing.T) {
72+
ReadinessProbe: defaultProbe,
73+
Resources: defaultResources,
74+
SecurityContext: &corev1.SecurityContext{
75+
+ RunAsNonRoot: ptr.Bool(true),
76+
AllowPrivilegeEscalation: ptr.Bool(false),
77+
Capabilities: &corev1.Capabilities{
78+
Drop: []corev1.Capability{"ALL"},
79+
@@ -1009,6 +1014,7 @@ func TestRevisionDefaulting(t *testing.T) {
80+
InitContainers: []corev1.Container{{
81+
Name: "init",
82+
SecurityContext: &corev1.SecurityContext{
83+
+ RunAsNonRoot: ptr.Bool(true),
84+
AllowPrivilegeEscalation: ptr.Bool(false),
85+
Capabilities: &corev1.Capabilities{
86+
Drop: []corev1.Capability{"ALL"},

‎images/knative/serving/controller/changelog‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
knative-serving-controller (1.7.2-7) wikimedia; urgency=medium
2+
3+
* Backport https://github.com/knative/serving/pull/14363.
4+
5+
-- Luca Toscano <[email protected]> Wed, 26 Feb 2025 16:24:00 +0100
6+
17
knative-serving-controller (1.7.2-6-20250223) wikimedia; urgency=medium
28

39
* Weekly rebuild.

‎images/knative/serving/domain-mapping-webhook/changelog‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
knative-serving-domain-mapping-webhook (1.7.2-7) wikimedia; urgency=medium
2+
3+
* Backport https://github.com/knative/serving/pull/14363.
4+
5+
-- Luca Toscano <[email protected]> Wed, 26 Feb 2025 16:24:00 +0100
6+
17
knative-serving-domain-mapping-webhook (1.7.2-6-20250223) wikimedia; urgency=medium
28

39
* Weekly rebuild.

‎images/knative/serving/domain-mapping/changelog‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
knative-serving-domain-mapping (1.7.2-7) wikimedia; urgency=medium
2+
3+
* Backport https://github.com/knative/serving/pull/14364.
4+
5+
-- Luca Toscano <[email protected]> Wed, 26 Feb 2025 16:24:00 +0100
6+
17
knative-serving-domain-mapping (1.7.2-6-20250223) wikimedia; urgency=medium
28

39
* Weekly rebuild.

‎images/knative/serving/queue/changelog‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
knative-serving-queue (1.7.2-7) wikimedia; urgency=medium
2+
3+
* Backport https://github.com/knative/serving/pull/14363.
4+
5+
-- Luca Toscano <[email protected]> Wed, 26 Feb 2025 16:24:00 +0100
6+
17
knative-serving-queue (1.7.2-6-20250223) wikimedia; urgency=medium
28

39
* Weekly rebuild.

‎images/knative/serving/webhook/changelog‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
knative-serving-webhook (1.7.2-7) wikimedia; urgency=medium
2+
3+
* Backport https://github.com/knative/serving/pull/14363.
4+
5+
-- Luca Toscano <[email protected]> Wed, 26 Feb 2025 16:24:00 +0100
6+
17
knative-serving-webhook (1.7.2-6-20250223) wikimedia; urgency=medium
28

39
* Weekly rebuild.

0 commit comments

Comments
 (0)