Allow setting seccompProfile to enable using restricted security profile - #13401

Merged
knative-prow[bot] merged 1 commit into
knative:mainfrom
evankanderson:allow-seccomp-profile
Oct 18, 2022
Merged

Allow setting seccompProfile to enable using restricted security profile#13401
knative-prow[bot] merged 1 commit into
knative:mainfrom
evankanderson:allow-seccomp-profile

Conversation

@evankanderson

@evankandersonevankanderson commented Oct 16, 2022

Copy link
Copy Markdown
Member

Fixes#13398

seccompProfile.type should only be set to RuntimeDefault or Localhost in the restricted Pod Security Standard.
Allow users to set the seccompProfile so that they can run Knative user-containers in restricted mode.

Relates to #13376

Proposed Changes

  • Allow users to set seccompProfile in PodSecurityContext and SecurityContext

Release Note

Services may now set `seccompProfile` in SecurityContext to allow users to comply with the `restricted` Pod Security Standards best-practice

@knative-prow

knative-prowBot commented Oct 16, 2022

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: evankanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@knative-prowknative-prowBot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. area/API API objects and controllers labels Oct 16, 2022
@evankandersonevankanderson mentioned this pull request Oct 16, 2022
Merged
@codecov

codecovBot commented Oct 16, 2022•
edited
Loading

Copy link
Copy Markdown

Codecov Report

Base: 86.52% // Head: 86.45% // Decreases project coverage by -0.06%⚠️

Coverage data is based on head (630c08d) compared to base (a18077c).
Patch coverage: 100.00% of modified lines in pull request are covered.

Additional details and impacted files
@@ Coverage Diff @@## main #13401 +/- ##
==========================================
- Coverage 86.52% 86.45% -0.07% 
==========================================
Files 196 196 Lines 14551 14556 +5 ==========================================
- Hits 12590 12585 -5 - Misses 1662 1671 +9 - Partials 299 300 +1
Impacted FilesCoverage Δ
pkg/apis/serving/fieldmask.go95.61% <100.00%> (+0.04%)⬆️
pkg/http/handler/timeout.go84.76% <0.00%> (-6.63%)⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

@evankanderson

evankanderson commented Oct 16, 2022

Copy link
Copy Markdown
MemberAuthor

/assign @psschwei@skonto

@evankandersonevankanderson mentioned this pull request Oct 16, 2022
Merged
psschwei
psschwei reviewed Oct 18, 2022
View reviewed changes

@psschweipsschwei left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor nit: we should also edit the features configmap to include this as one of the fields that can be set when the gate is on. Otherwise, looks good to me

psschwei
psschwei reviewed Oct 18, 2022
View reviewed changes

@psschweipsschwei left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@knative-prowknative-prowBot added the lgtm Indicates that a PR is ready to be merged. label Oct 18, 2022
@psschweipsschwei mentioned this pull request Oct 18, 2022
Merged
@knative-prow
knative-prowBot merged commit d108ba9 into knative:mainOct 18, 2022
skonto pushed a commit to skonto/serving that referenced this pull request Oct 19, 2022
@evankandersonStavros Kontopoulos
Allow setting seccompProfile to enable using restricted security prof…
775acb8
…ile (knative#13401)
openshift-merge-robot pushed a commit to openshift/knative-serving that referenced this pull request Oct 24, 2022
Stavros Kontopoulos@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
772dc55
…restricted security profile (#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
skonto pushed a commit to skonto/serving that referenced this pull request Nov 15, 2022
Stavros Kontopoulos@evankanderson@skonto
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
23703c0
…restricted security profile (knative#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
openshift-merge-robot pushed a commit to openshift-knative/serving that referenced this pull request Nov 15, 2022
@skonto@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
384b91e
…restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
@dprotasodprotaso added this to the v1.8.0 milestone Nov 24, 2022
openshift-merge-robot pushed a commit to openshift-knative/serving that referenced this pull request Dec 22, 2022
@ReToCode@skonto@evankanderson
[RELEASE-1.7][BACKPORT] Allow setting seccompProfile to enable using … (
28d0934
#91)
* [RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
* Update checksum
Co-authored-by: Stavros Kontopoulos <st.kontopoulos@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
wmfgerrit pushed a commit to wikimedia/operations-docker-images-production-images that referenced this pull request Feb 3, 2025
@elukey
knative: backport patches from 1.8.x release
d8ddf8e
The commit knative/serving#13401 allows
pods scheduled/created via knative-serving to be set with a
seccomp profile, required by the PSS migration to allow running
pods in the "restricted" security realm.
The commit knative/serving#13398 adds
a config-map flag to inject secure defaults for pods not running
with specific settings, to allow the PSS restricted profile.
Bug: T369493
Change-Id: Ib2ec22d4ccdeebda3ba775bdcd3d4e1be520f7ed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@psschweipsschweipsschwei left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@skontoskonto

@psschweipsschwei

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.area/APIAPI objects and controllerslgtmIndicates that a PR is ready to be merged.size/SDenotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

4 participants

@evankanderson@psschwei@dprotaso@skonto
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Allow setting seccompProfile to enable using restricted security profile - #13401
Merged
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Oct 18, 2022
Merged
Allow setting seccompProfile to enable using restricted security profile#13401
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Conversation
@evankanderson
@evankandersonevankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

Member
Fixes#13398
seccompProfile.type should only be set to RuntimeDefault or Localhost in the restricted Pod Security Standard.

Allow users to set the seccompProfile so that they can run Knative user-containers in restricted mode.
Relates to #13376
Proposed Changes
  • Allow users to set seccompProfile in PodSecurityContext and SecurityContext
Release Note
Services may now set `seccompProfile` in SecurityContext to allow users to comply with the `restricted` Pod Security Standards best-practice

@knative-prow
knative-prowBot
commented
Oct 16, 2022

Copy link


Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: evankanderson
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Details
Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment

Approvers can cancel approval by writing /approve cancel in a comment
@knative-prowknative-prowBot
added

approved
Indicates a PR has been approved by an approver from all required OWNERS files.
size/S
Denotes a PR that changes 10-29 lines, ignoring generated files.
area/API
API objects and controllers
labels
Oct 16, 2022
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

@codecov
codecovBot
commented
Oct 16, 2022•

edited

Loading

Copy link


Copy Markdown

Codecov Report
Base: 86.52% // Head: 86.45% // Decreases project coverage by -0.06%⚠️
Coverage data is based on head (630c08d) compared to base (a18077c).

Patch coverage: 100.00% of modified lines in pull request are covered.
Additional details and impacted files
@@ Coverage Diff @@## main #13401 +/- ##
==========================================
- Coverage 86.52% 86.45% -0.07% 
==========================================
Files 196 196 Lines 14551 14556 +5 ==========================================
- Hits 12590 12585 -5 - Misses 1662 1671 +9 - Partials 299 300 +1 
Impacted FilesCoverage Δ
pkg/apis/serving/fieldmask.go95.61% <100.00%> (+0.04%)⬆️
pkg/http/handler/timeout.go84.76% <0.00%> (-6.63%)⬇️
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.
☔ View full report at Codecov.

📢 Do you have feedback about the report comment? Let us know in this issue.
@evankanderson
evankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

MemberAuthor
/assign @psschwei@skonto
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor nit: we should also edit the features configmap to include this as one of the fields that can be set when the gate is on. Otherwise, looks good to me
psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
@knative-prowknative-prowBot
added
the 
lgtm
Indicates that a PR is ready to be merged.
label
Oct 18, 2022
@psschweipsschwei
mentioned this pull request
Oct 18, 2022
 Merged

@knative-prow
knative-prowBot
merged commit d108ba9
into
knative:mainOct 18, 2022
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Oct 19, 2022
@evankandersonStavros Kontopoulos
Allow setting seccompProfile to enable using restricted security prof…
775acb8
…ile (knative#13401)
openshift-merge-robot pushed a commit
to openshift/knative-serving
that referenced
this pull request
Oct 24, 2022
Stavros Kontopoulos@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
772dc55
…restricted security profile (#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Nov 15, 2022
Stavros Kontopoulos@evankanderson@skonto
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
23703c0
…restricted security profile (knative#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Nov 15, 2022
@skonto@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
384b91e
…restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
@dprotasodprotaso
added this to the v1.8.0 milestone
Nov 24, 2022
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Dec 22, 2022
@ReToCode@skonto@evankanderson
[RELEASE-1.7][BACKPORT] Allow setting seccompProfile to enable using … (
28d0934
#91)
* [RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
* Update checksum
Co-authored-by: Stavros Kontopoulos <st.kontopoulos@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
wmfgerrit pushed a commit
to wikimedia/operations-docker-images-production-images
that referenced
this pull request
Feb 3, 2025
@elukey
knative: backport patches from 1.8.x release
d8ddf8e
The commit knative/serving#13401 allows
pods scheduled/created via knative-serving to be set with a
seccomp profile, required by the PSS migration to allow running
pods in the "restricted" security realm.
The commit knative/serving#13398 adds
a config-map flag to inject secure defaults for pods not running
with specific settings, to allow the PSS restricted profile.
Bug: T369493
Change-Id: Ib2ec22d4ccdeebda3ba775bdcd3d4e1be520f7ed
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@psschweipsschweipsschwei left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@skontoskonto
@psschweipsschwei

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.area/APIAPI objects and controllerslgtmIndicates that a PR is ready to be merged.size/SDenotes a PR that changes 10-29 lines, ignoring generated files.

Projects


None yet


Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

4 participants

@evankanderson@psschwei@dprotaso@skonto

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Allow setting seccompProfile to enable using restricted security profile - #13401
Merged
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Oct 18, 2022
Merged
Allow setting seccompProfile to enable using restricted security profile#13401
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Conversation
@evankanderson
@evankandersonevankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

Member
Fixes#13398
seccompProfile.type should only be set to RuntimeDefault or Localhost in the restricted Pod Security Standard.

Allow users to set the seccompProfile so that they can run Knative user-containers in restricted mode.
Relates to #13376
Proposed Changes
  • Allow users to set seccompProfile in PodSecurityContext and SecurityContext
Release Note
Services may now set `seccompProfile` in SecurityContext to allow users to comply with the `restricted` Pod Security Standards best-practice

@knative-prow
knative-prowBot
commented
Oct 16, 2022

Copy link


Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: evankanderson
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Details
Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment

Approvers can cancel approval by writing /approve cancel in a comment
@knative-prowknative-prowBot
added

approved
Indicates a PR has been approved by an approver from all required OWNERS files.
size/S
Denotes a PR that changes 10-29 lines, ignoring generated files.
area/API
API objects and controllers
labels
Oct 16, 2022
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

@codecov
codecovBot
commented
Oct 16, 2022•

edited

Loading

Copy link


Copy Markdown

Codecov Report
Base: 86.52% // Head: 86.45% // Decreases project coverage by -0.06%⚠️
Coverage data is based on head (630c08d) compared to base (a18077c).

Patch coverage: 100.00% of modified lines in pull request are covered.
Additional details and impacted files
@@ Coverage Diff @@## main #13401 +/- ##
==========================================
- Coverage 86.52% 86.45% -0.07% 
==========================================
Files 196 196 Lines 14551 14556 +5 ==========================================
- Hits 12590 12585 -5 - Misses 1662 1671 +9 - Partials 299 300 +1 
Impacted FilesCoverage Δ
pkg/apis/serving/fieldmask.go95.61% <100.00%> (+0.04%)⬆️
pkg/http/handler/timeout.go84.76% <0.00%> (-6.63%)⬇️
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.
☔ View full report at Codecov.

📢 Do you have feedback about the report comment? Let us know in this issue.
@evankanderson
evankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

MemberAuthor
/assign @psschwei@skonto
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor nit: we should also edit the features configmap to include this as one of the fields that can be set when the gate is on. Otherwise, looks good to me
psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
@knative-prowknative-prowBot
added
the 
lgtm
Indicates that a PR is ready to be merged.
label
Oct 18, 2022
@psschweipsschwei
mentioned this pull request
Oct 18, 2022
 Merged

@knative-prow
knative-prowBot
merged commit d108ba9
into
knative:mainOct 18, 2022
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Oct 19, 2022
@evankandersonStavros Kontopoulos
Allow setting seccompProfile to enable using restricted security prof…
775acb8
…ile (knative#13401)
openshift-merge-robot pushed a commit
to openshift/knative-serving
that referenced
this pull request
Oct 24, 2022
Stavros Kontopoulos@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
772dc55
…restricted security profile (#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Nov 15, 2022
Stavros Kontopoulos@evankanderson@skonto
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
23703c0
…restricted security profile (knative#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Nov 15, 2022
@skonto@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
384b91e
…restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
@dprotasodprotaso
added this to the v1.8.0 milestone
Nov 24, 2022
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Dec 22, 2022
@ReToCode@skonto@evankanderson
[RELEASE-1.7][BACKPORT] Allow setting seccompProfile to enable using … (
28d0934
#91)
* [RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
* Update checksum
Co-authored-by: Stavros Kontopoulos <st.kontopoulos@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
wmfgerrit pushed a commit
to wikimedia/operations-docker-images-production-images
that referenced
this pull request
Feb 3, 2025
@elukey
knative: backport patches from 1.8.x release
d8ddf8e
The commit knative/serving#13401 allows
pods scheduled/created via knative-serving to be set with a
seccomp profile, required by the PSS migration to allow running
pods in the "restricted" security realm.
The commit knative/serving#13398 adds
a config-map flag to inject secure defaults for pods not running
with specific settings, to allow the PSS restricted profile.
Bug: T369493
Change-Id: Ib2ec22d4ccdeebda3ba775bdcd3d4e1be520f7ed
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@psschweipsschweipsschwei left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@skontoskonto
@psschweipsschwei

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.area/APIAPI objects and controllerslgtmIndicates that a PR is ready to be merged.size/SDenotes a PR that changes 10-29 lines, ignoring generated files.

Projects


None yet


Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

4 participants

@evankanderson@psschwei@dprotaso@skonto

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Allow setting seccompProfile to enable using restricted security profile - #13401
Merged
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Oct 18, 2022
Merged
Allow setting seccompProfile to enable using restricted security profile#13401
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Conversation
@evankanderson
@evankandersonevankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

Member
Fixes#13398
seccompProfile.type should only be set to RuntimeDefault or Localhost in the restricted Pod Security Standard.

Allow users to set the seccompProfile so that they can run Knative user-containers in restricted mode.
Relates to #13376
Proposed Changes
  • Allow users to set seccompProfile in PodSecurityContext and SecurityContext
Release Note
Services may now set `seccompProfile` in SecurityContext to allow users to comply with the `restricted` Pod Security Standards best-practice

@knative-prow
knative-prowBot
commented
Oct 16, 2022

Copy link


Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: evankanderson
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Details
Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment

Approvers can cancel approval by writing /approve cancel in a comment
@knative-prowknative-prowBot
added

approved
Indicates a PR has been approved by an approver from all required OWNERS files.
size/S
Denotes a PR that changes 10-29 lines, ignoring generated files.
area/API
API objects and controllers
labels
Oct 16, 2022
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

@codecov
codecovBot
commented
Oct 16, 2022•

edited

Loading

Copy link


Copy Markdown

Codecov Report
Base: 86.52% // Head: 86.45% // Decreases project coverage by -0.06%⚠️
Coverage data is based on head (630c08d) compared to base (a18077c).

Patch coverage: 100.00% of modified lines in pull request are covered.
Additional details and impacted files
@@ Coverage Diff @@## main #13401 +/- ##
==========================================
- Coverage 86.52% 86.45% -0.07% 
==========================================
Files 196 196 Lines 14551 14556 +5 ==========================================
- Hits 12590 12585 -5 - Misses 1662 1671 +9 - Partials 299 300 +1 
Impacted FilesCoverage Δ
pkg/apis/serving/fieldmask.go95.61% <100.00%> (+0.04%)⬆️
pkg/http/handler/timeout.go84.76% <0.00%> (-6.63%)⬇️
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.
☔ View full report at Codecov.

📢 Do you have feedback about the report comment? Let us know in this issue.
@evankanderson
evankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

MemberAuthor
/assign @psschwei@skonto
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor nit: we should also edit the features configmap to include this as one of the fields that can be set when the gate is on. Otherwise, looks good to me
psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
@knative-prowknative-prowBot
added
the 
lgtm
Indicates that a PR is ready to be merged.
label
Oct 18, 2022
@psschweipsschwei
mentioned this pull request
Oct 18, 2022
 Merged

@knative-prow
knative-prowBot
merged commit d108ba9
into
knative:mainOct 18, 2022
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Oct 19, 2022
@evankandersonStavros Kontopoulos
Allow setting seccompProfile to enable using restricted security prof…
775acb8
…ile (knative#13401)
openshift-merge-robot pushed a commit
to openshift/knative-serving
that referenced
this pull request
Oct 24, 2022
Stavros Kontopoulos@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
772dc55
…restricted security profile (#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Nov 15, 2022
Stavros Kontopoulos@evankanderson@skonto
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
23703c0
…restricted security profile (knative#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Nov 15, 2022
@skonto@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
384b91e
…restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
@dprotasodprotaso
added this to the v1.8.0 milestone
Nov 24, 2022
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Dec 22, 2022
@ReToCode@skonto@evankanderson
[RELEASE-1.7][BACKPORT] Allow setting seccompProfile to enable using … (
28d0934
#91)
* [RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
* Update checksum
Co-authored-by: Stavros Kontopoulos <st.kontopoulos@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
wmfgerrit pushed a commit
to wikimedia/operations-docker-images-production-images
that referenced
this pull request
Feb 3, 2025
@elukey
knative: backport patches from 1.8.x release
d8ddf8e
The commit knative/serving#13401 allows
pods scheduled/created via knative-serving to be set with a
seccomp profile, required by the PSS migration to allow running
pods in the "restricted" security realm.
The commit knative/serving#13398 adds
a config-map flag to inject secure defaults for pods not running
with specific settings, to allow the PSS restricted profile.
Bug: T369493
Change-Id: Ib2ec22d4ccdeebda3ba775bdcd3d4e1be520f7ed
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@psschweipsschweipsschwei left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@skontoskonto
@psschweipsschwei

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.area/APIAPI objects and controllerslgtmIndicates that a PR is ready to be merged.size/SDenotes a PR that changes 10-29 lines, ignoring generated files.

Projects


None yet


Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

4 participants

@evankanderson@psschwei@dprotaso@skonto

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Allow setting seccompProfile to enable using restricted security profile - #13401
Merged
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Oct 18, 2022
Merged
Allow setting seccompProfile to enable using restricted security profile#13401
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Conversation
@evankanderson
@evankandersonevankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

Member
Fixes#13398
seccompProfile.type should only be set to RuntimeDefault or Localhost in the restricted Pod Security Standard.

Allow users to set the seccompProfile so that they can run Knative user-containers in restricted mode.
Relates to #13376
Proposed Changes
  • Allow users to set seccompProfile in PodSecurityContext and SecurityContext
Release Note
Services may now set `seccompProfile` in SecurityContext to allow users to comply with the `restricted` Pod Security Standards best-practice

@knative-prow
knative-prowBot
commented
Oct 16, 2022

Copy link


Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: evankanderson
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Details
Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment

Approvers can cancel approval by writing /approve cancel in a comment
@knative-prowknative-prowBot
added

approved
Indicates a PR has been approved by an approver from all required OWNERS files.
size/S
Denotes a PR that changes 10-29 lines, ignoring generated files.
area/API
API objects and controllers
labels
Oct 16, 2022
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

@codecov
codecovBot
commented
Oct 16, 2022•

edited

Loading

Copy link


Copy Markdown

Codecov Report
Base: 86.52% // Head: 86.45% // Decreases project coverage by -0.06%⚠️
Coverage data is based on head (630c08d) compared to base (a18077c).

Patch coverage: 100.00% of modified lines in pull request are covered.
Additional details and impacted files
@@ Coverage Diff @@## main #13401 +/- ##
==========================================
- Coverage 86.52% 86.45% -0.07% 
==========================================
Files 196 196 Lines 14551 14556 +5 ==========================================
- Hits 12590 12585 -5 - Misses 1662 1671 +9 - Partials 299 300 +1 
Impacted FilesCoverage Δ
pkg/apis/serving/fieldmask.go95.61% <100.00%> (+0.04%)⬆️
pkg/http/handler/timeout.go84.76% <0.00%> (-6.63%)⬇️
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.
☔ View full report at Codecov.

📢 Do you have feedback about the report comment? Let us know in this issue.
@evankanderson
evankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

MemberAuthor
/assign @psschwei@skonto
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor nit: we should also edit the features configmap to include this as one of the fields that can be set when the gate is on. Otherwise, looks good to me
psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
@knative-prowknative-prowBot
added
the 
lgtm
Indicates that a PR is ready to be merged.
label
Oct 18, 2022
@psschweipsschwei
mentioned this pull request
Oct 18, 2022
 Merged

@knative-prow
knative-prowBot
merged commit d108ba9
into
knative:mainOct 18, 2022
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Oct 19, 2022
@evankandersonStavros Kontopoulos
Allow setting seccompProfile to enable using restricted security prof…
775acb8
…ile (knative#13401)
openshift-merge-robot pushed a commit
to openshift/knative-serving
that referenced
this pull request
Oct 24, 2022
Stavros Kontopoulos@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
772dc55
…restricted security profile (#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Nov 15, 2022
Stavros Kontopoulos@evankanderson@skonto
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
23703c0
…restricted security profile (knative#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Nov 15, 2022
@skonto@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
384b91e
…restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
@dprotasodprotaso
added this to the v1.8.0 milestone
Nov 24, 2022
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Dec 22, 2022
@ReToCode@skonto@evankanderson
[RELEASE-1.7][BACKPORT] Allow setting seccompProfile to enable using … (
28d0934
#91)
* [RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
* Update checksum
Co-authored-by: Stavros Kontopoulos <st.kontopoulos@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
wmfgerrit pushed a commit
to wikimedia/operations-docker-images-production-images
that referenced
this pull request
Feb 3, 2025
@elukey
knative: backport patches from 1.8.x release
d8ddf8e
The commit knative/serving#13401 allows
pods scheduled/created via knative-serving to be set with a
seccomp profile, required by the PSS migration to allow running
pods in the "restricted" security realm.
The commit knative/serving#13398 adds
a config-map flag to inject secure defaults for pods not running
with specific settings, to allow the PSS restricted profile.
Bug: T369493
Change-Id: Ib2ec22d4ccdeebda3ba775bdcd3d4e1be520f7ed
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@psschweipsschweipsschwei left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@skontoskonto
@psschweipsschwei

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.area/APIAPI objects and controllerslgtmIndicates that a PR is ready to be merged.size/SDenotes a PR that changes 10-29 lines, ignoring generated files.

Projects


None yet


Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

4 participants

@evankanderson@psschwei@dprotaso@skonto

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Allow setting seccompProfile to enable using restricted security profile - #13401
Merged
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Oct 18, 2022
Merged
Allow setting seccompProfile to enable using restricted security profile#13401
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Conversation
@evankanderson
@evankandersonevankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

Member
Fixes#13398
seccompProfile.type should only be set to RuntimeDefault or Localhost in the restricted Pod Security Standard.

Allow users to set the seccompProfile so that they can run Knative user-containers in restricted mode.
Relates to #13376
Proposed Changes
  • Allow users to set seccompProfile in PodSecurityContext and SecurityContext
Release Note
Services may now set `seccompProfile` in SecurityContext to allow users to comply with the `restricted` Pod Security Standards best-practice

@knative-prow
knative-prowBot
commented
Oct 16, 2022

Copy link


Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: evankanderson
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Details
Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment

Approvers can cancel approval by writing /approve cancel in a comment
@knative-prowknative-prowBot
added

approved
Indicates a PR has been approved by an approver from all required OWNERS files.
size/S
Denotes a PR that changes 10-29 lines, ignoring generated files.
area/API
API objects and controllers
labels
Oct 16, 2022
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

@codecov
codecovBot
commented
Oct 16, 2022•

edited

Loading

Copy link


Copy Markdown

Codecov Report
Base: 86.52% // Head: 86.45% // Decreases project coverage by -0.06%⚠️
Coverage data is based on head (630c08d) compared to base (a18077c).

Patch coverage: 100.00% of modified lines in pull request are covered.
Additional details and impacted files
@@ Coverage Diff @@## main #13401 +/- ##
==========================================
- Coverage 86.52% 86.45% -0.07% 
==========================================
Files 196 196 Lines 14551 14556 +5 ==========================================
- Hits 12590 12585 -5 - Misses 1662 1671 +9 - Partials 299 300 +1 
Impacted FilesCoverage Δ
pkg/apis/serving/fieldmask.go95.61% <100.00%> (+0.04%)⬆️
pkg/http/handler/timeout.go84.76% <0.00%> (-6.63%)⬇️
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.
☔ View full report at Codecov.

📢 Do you have feedback about the report comment? Let us know in this issue.
@evankanderson
evankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

MemberAuthor
/assign @psschwei@skonto
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor nit: we should also edit the features configmap to include this as one of the fields that can be set when the gate is on. Otherwise, looks good to me
psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
@knative-prowknative-prowBot
added
the 
lgtm
Indicates that a PR is ready to be merged.
label
Oct 18, 2022
@psschweipsschwei
mentioned this pull request
Oct 18, 2022
 Merged

@knative-prow
knative-prowBot
merged commit d108ba9
into
knative:mainOct 18, 2022
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Oct 19, 2022
@evankandersonStavros Kontopoulos
Allow setting seccompProfile to enable using restricted security prof…
775acb8
…ile (knative#13401)
openshift-merge-robot pushed a commit
to openshift/knative-serving
that referenced
this pull request
Oct 24, 2022
Stavros Kontopoulos@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
772dc55
…restricted security profile (#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Nov 15, 2022
Stavros Kontopoulos@evankanderson@skonto
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
23703c0
…restricted security profile (knative#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Nov 15, 2022
@skonto@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
384b91e
…restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
@dprotasodprotaso
added this to the v1.8.0 milestone
Nov 24, 2022
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Dec 22, 2022
@ReToCode@skonto@evankanderson
[RELEASE-1.7][BACKPORT] Allow setting seccompProfile to enable using … (
28d0934
#91)
* [RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
* Update checksum
Co-authored-by: Stavros Kontopoulos <st.kontopoulos@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
wmfgerrit pushed a commit
to wikimedia/operations-docker-images-production-images
that referenced
this pull request
Feb 3, 2025
@elukey
knative: backport patches from 1.8.x release
d8ddf8e
The commit knative/serving#13401 allows
pods scheduled/created via knative-serving to be set with a
seccomp profile, required by the PSS migration to allow running
pods in the "restricted" security realm.
The commit knative/serving#13398 adds
a config-map flag to inject secure defaults for pods not running
with specific settings, to allow the PSS restricted profile.
Bug: T369493
Change-Id: Ib2ec22d4ccdeebda3ba775bdcd3d4e1be520f7ed
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@psschweipsschweipsschwei left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@skontoskonto
@psschweipsschwei

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.area/APIAPI objects and controllerslgtmIndicates that a PR is ready to be merged.size/SDenotes a PR that changes 10-29 lines, ignoring generated files.

Projects


None yet


Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

4 participants

@evankanderson@psschwei@dprotaso@skonto

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Allow setting seccompProfile to enable using restricted security profile - #13401
Merged
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Oct 18, 2022
Merged
Allow setting seccompProfile to enable using restricted security profile#13401
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Conversation
@evankanderson
@evankandersonevankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

Member
Fixes#13398
seccompProfile.type should only be set to RuntimeDefault or Localhost in the restricted Pod Security Standard.

Allow users to set the seccompProfile so that they can run Knative user-containers in restricted mode.
Relates to #13376
Proposed Changes
  • Allow users to set seccompProfile in PodSecurityContext and SecurityContext
Release Note
Services may now set `seccompProfile` in SecurityContext to allow users to comply with the `restricted` Pod Security Standards best-practice

@knative-prow
knative-prowBot
commented
Oct 16, 2022

Copy link


Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: evankanderson
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Details
Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment

Approvers can cancel approval by writing /approve cancel in a comment
@knative-prowknative-prowBot
added

approved
Indicates a PR has been approved by an approver from all required OWNERS files.
size/S
Denotes a PR that changes 10-29 lines, ignoring generated files.
area/API
API objects and controllers
labels
Oct 16, 2022
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

@codecov
codecovBot
commented
Oct 16, 2022•

edited

Loading

Copy link


Copy Markdown

Codecov Report
Base: 86.52% // Head: 86.45% // Decreases project coverage by -0.06%⚠️
Coverage data is based on head (630c08d) compared to base (a18077c).

Patch coverage: 100.00% of modified lines in pull request are covered.
Additional details and impacted files
@@ Coverage Diff @@## main #13401 +/- ##
==========================================
- Coverage 86.52% 86.45% -0.07% 
==========================================
Files 196 196 Lines 14551 14556 +5 ==========================================
- Hits 12590 12585 -5 - Misses 1662 1671 +9 - Partials 299 300 +1 
Impacted FilesCoverage Δ
pkg/apis/serving/fieldmask.go95.61% <100.00%> (+0.04%)⬆️
pkg/http/handler/timeout.go84.76% <0.00%> (-6.63%)⬇️
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.
☔ View full report at Codecov.

📢 Do you have feedback about the report comment? Let us know in this issue.
@evankanderson
evankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

MemberAuthor
/assign @psschwei@skonto
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor nit: we should also edit the features configmap to include this as one of the fields that can be set when the gate is on. Otherwise, looks good to me
psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
@knative-prowknative-prowBot
added
the 
lgtm
Indicates that a PR is ready to be merged.
label
Oct 18, 2022
@psschweipsschwei
mentioned this pull request
Oct 18, 2022
 Merged

@knative-prow
knative-prowBot
merged commit d108ba9
into
knative:mainOct 18, 2022
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Oct 19, 2022
@evankandersonStavros Kontopoulos
Allow setting seccompProfile to enable using restricted security prof…
775acb8
…ile (knative#13401)
openshift-merge-robot pushed a commit
to openshift/knative-serving
that referenced
this pull request
Oct 24, 2022
Stavros Kontopoulos@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
772dc55
…restricted security profile (#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Nov 15, 2022
Stavros Kontopoulos@evankanderson@skonto
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
23703c0
…restricted security profile (knative#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Nov 15, 2022
@skonto@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
384b91e
…restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
@dprotasodprotaso
added this to the v1.8.0 milestone
Nov 24, 2022
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Dec 22, 2022
@ReToCode@skonto@evankanderson
[RELEASE-1.7][BACKPORT] Allow setting seccompProfile to enable using … (
28d0934
#91)
* [RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
* Update checksum
Co-authored-by: Stavros Kontopoulos <st.kontopoulos@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
wmfgerrit pushed a commit
to wikimedia/operations-docker-images-production-images
that referenced
this pull request
Feb 3, 2025
@elukey
knative: backport patches from 1.8.x release
d8ddf8e
The commit knative/serving#13401 allows
pods scheduled/created via knative-serving to be set with a
seccomp profile, required by the PSS migration to allow running
pods in the "restricted" security realm.
The commit knative/serving#13398 adds
a config-map flag to inject secure defaults for pods not running
with specific settings, to allow the PSS restricted profile.
Bug: T369493
Change-Id: Ib2ec22d4ccdeebda3ba775bdcd3d4e1be520f7ed
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@psschweipsschweipsschwei left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@skontoskonto
@psschweipsschwei

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.area/APIAPI objects and controllerslgtmIndicates that a PR is ready to be merged.size/SDenotes a PR that changes 10-29 lines, ignoring generated files.

Projects


None yet


Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

4 participants

@evankanderson@psschwei@dprotaso@skonto

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Allow setting seccompProfile to enable using restricted security profile - #13401
Merged
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Oct 18, 2022
Merged
Allow setting seccompProfile to enable using restricted security profile#13401
knative-prow[bot] merged 1 commit into
knative:mainfrom 
evankanderson:allow-seccomp-profile
Conversation
@evankanderson
@evankandersonevankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

Member
Fixes#13398
seccompProfile.type should only be set to RuntimeDefault or Localhost in the restricted Pod Security Standard.

Allow users to set the seccompProfile so that they can run Knative user-containers in restricted mode.
Relates to #13376
Proposed Changes
  • Allow users to set seccompProfile in PodSecurityContext and SecurityContext
Release Note
Services may now set `seccompProfile` in SecurityContext to allow users to comply with the `restricted` Pod Security Standards best-practice

@knative-prow
knative-prowBot
commented
Oct 16, 2022

Copy link


Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: evankanderson
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Details
Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment

Approvers can cancel approval by writing /approve cancel in a comment
@knative-prowknative-prowBot
added

approved
Indicates a PR has been approved by an approver from all required OWNERS files.
size/S
Denotes a PR that changes 10-29 lines, ignoring generated files.
area/API
API objects and controllers
labels
Oct 16, 2022
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

@codecov
codecovBot
commented
Oct 16, 2022•

edited

Loading

Copy link


Copy Markdown

Codecov Report
Base: 86.52% // Head: 86.45% // Decreases project coverage by -0.06%⚠️
Coverage data is based on head (630c08d) compared to base (a18077c).

Patch coverage: 100.00% of modified lines in pull request are covered.
Additional details and impacted files
@@ Coverage Diff @@## main #13401 +/- ##
==========================================
- Coverage 86.52% 86.45% -0.07% 
==========================================
Files 196 196 Lines 14551 14556 +5 ==========================================
- Hits 12590 12585 -5 - Misses 1662 1671 +9 - Partials 299 300 +1 
Impacted FilesCoverage Δ
pkg/apis/serving/fieldmask.go95.61% <100.00%> (+0.04%)⬆️
pkg/http/handler/timeout.go84.76% <0.00%> (-6.63%)⬇️
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.
☔ View full report at Codecov.

📢 Do you have feedback about the report comment? Let us know in this issue.
@evankanderson
evankanderson
commented
Oct 16, 2022

Copy link


Copy Markdown

MemberAuthor
/assign @psschwei@skonto
@evankandersonevankanderson
mentioned this pull request
Oct 16, 2022
 Merged

psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor nit: we should also edit the features configmap to include this as one of the fields that can be set when the gate is on. Otherwise, looks good to me
psschwei
psschwei
reviewed
Oct 18, 2022
View reviewed changes
@psschweipsschwei
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
@knative-prowknative-prowBot
added
the 
lgtm
Indicates that a PR is ready to be merged.
label
Oct 18, 2022
@psschweipsschwei
mentioned this pull request
Oct 18, 2022
 Merged

@knative-prow
knative-prowBot
merged commit d108ba9
into
knative:mainOct 18, 2022
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Oct 19, 2022
@evankandersonStavros Kontopoulos
Allow setting seccompProfile to enable using restricted security prof…
775acb8
…ile (knative#13401)
openshift-merge-robot pushed a commit
to openshift/knative-serving
that referenced
this pull request
Oct 24, 2022
Stavros Kontopoulos@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
772dc55
…restricted security profile (#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
skonto pushed a commit
to skonto/serving
that referenced
this pull request
Nov 15, 2022
Stavros Kontopoulos@evankanderson@skonto
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
23703c0
…restricted security profile (knative#1284)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Nov 15, 2022
@skonto@evankanderson
[RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using …
384b91e
…restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
@dprotasodprotaso
added this to the v1.8.0 milestone
Nov 24, 2022
openshift-merge-robot pushed a commit
to openshift-knative/serving
that referenced
this pull request
Dec 22, 2022
@ReToCode@skonto@evankanderson
[RELEASE-1.7][BACKPORT] Allow setting seccompProfile to enable using … (
28d0934
#91)
* [RELEASE-1.5][BACKPORT] Allow setting seccompProfile to enable using restricted security profile (#1284) (#9)
* Allow setting seccompProfile to enable using restricted security profile (knative#13401)
* fix features cm
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
* Update checksum
Co-authored-by: Stavros Kontopoulos <st.kontopoulos@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>
wmfgerrit pushed a commit
to wikimedia/operations-docker-images-production-images
that referenced
this pull request
Feb 3, 2025
@elukey
knative: backport patches from 1.8.x release
d8ddf8e
The commit knative/serving#13401 allows
pods scheduled/created via knative-serving to be set with a
seccomp profile, required by the PSS migration to allow running
pods in the "restricted" security realm.
The commit knative/serving#13398 adds
a config-map flag to inject secure defaults for pods not running
with specific settings, to allow the PSS restricted profile.
Bug: T369493
Change-Id: Ib2ec22d4ccdeebda3ba775bdcd3d4e1be520f7ed
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@psschweipsschweipsschwei left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@skontoskonto
@psschweipsschwei

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.area/APIAPI objects and controllerslgtmIndicates that a PR is ready to be merged.size/SDenotes a PR that changes 10-29 lines, ignoring generated files.

Projects


None yet


Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

4 participants

@evankanderson@psschwei@dprotaso@skonto