Skip to content

Commit 75ac2fb

Browse files
camilamacedo86camilamacedo86
committed
Enable seccompProfile.type: RuntimeDefault by default in scaffolded projects
- Removed the comment about `seccompProfile` as `type: RuntimeDefault` is now set by default. - Updated to reflect that Kubebuilder only tests and supports the latest three Kubernetes releases. - Given that we’re currently using Kubernetes 1.31, there’s no longer a reason to keep this line commented, ensuring projects adhere to `restricted` Pod Security Standards by default.
1 parent 57892ba commit 75ac2fb

File tree

15 files changed

+52
-95
lines changed

15 files changed

+52
-95
lines changed

‎docs/book/src/cronjob-tutorial/testdata/project/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

‎docs/book/src/cronjob-tutorial/testdata/project/dist/install.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4135,6 +4135,8 @@ spec:
41354135
readOnly: true
41364136
securityContext:
41374137
runAsNonRoot: true
4138+
seccompProfile:
4139+
type: RuntimeDefault
41384140
serviceAccountName: project-controller-manager
41394141
terminationGracePeriodSeconds: 10
41404142
volumes:

‎docs/book/src/getting-started/testdata/project/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

‎docs/book/src/getting-started/testdata/project/dist/install.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -430,6 +430,8 @@ spec:
430430
- ALL
431431
securityContext:
432432
runAsNonRoot: true
433+
seccompProfile:
434+
type: RuntimeDefault
433435
serviceAccountName: project-controller-manager
434436
terminationGracePeriodSeconds: 10
435437
---

‎docs/book/src/multiversion-tutorial/testdata/project/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

‎docs/book/src/multiversion-tutorial/testdata/project/dist/install.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7949,6 +7949,8 @@ spec:
79497949
readOnly: true
79507950
securityContext:
79517951
runAsNonRoot: true
7952+
seccompProfile:
7953+
type: RuntimeDefault
79527954
serviceAccountName: project-controller-manager
79537955
terminationGracePeriodSeconds: 10
79547956
volumes:

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -95,14 +95,12 @@ spec:
9595
# values:
9696
# - linux
9797
securityContext:
98+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
99+
# This ensures that deployments meet the highest security requirements for Kubernetes.
100+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
98101
runAsNonRoot: true
99-
# TODO(user): For common cases that do not require escalating privileges
100-
# it is recommended to ensure that all your Pods/Containers are restrictive.
101-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
102-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
103-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
104-
# seccompProfile:
105-
# type: RuntimeDefault
102+
seccompProfile:
103+
type: RuntimeDefault
106104
containers:
107105
- command:
108106
- /manager

‎test/e2e/v4/generate_test.go‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -75,11 +75,6 @@ func GenerateV4(kbc *utils.TestContext) {
7575
ExpectWithOffset(1, pluginutil.UncommentCode(
7676
filepath.Join(kbc.Dir, "cmd", "main.go"),
7777
tlsConfigManager, "// ")).To(Succeed())
78-
79-
if kbc.IsRestricted {
80-
By("uncomment kustomize files to ensure that pods are restricted")
81-
uncommentPodStandards(kbc)
82-
}
8378
}
8479

8580
// GenerateV4WithoutMetrics implements a go/v4 plugin project defined by a TestContext.
@@ -121,11 +116,6 @@ func GenerateV4WithoutMetrics(kbc *utils.TestContext) {
121116
ExpectWithOffset(1, pluginutil.CommentCode(
122117
filepath.Join(kbc.Dir, "config", "default", "kustomization.yaml"),
123118
metricsTarget, "#")).To(Succeed())
124-
125-
if kbc.IsRestricted {
126-
By("uncomment kustomize files to ensure that pods are restricted")
127-
uncommentPodStandards(kbc)
128-
}
129119
}
130120

131121
// GenerateV4WithoutMetrics implements a go/v4 plugin project defined by a TestContext.
@@ -204,11 +194,6 @@ func GenerateV4WithoutWebhooks(kbc *utils.TestContext) {
204194
ExpectWithOffset(1, pluginutil.UncommentCode(
205195
filepath.Join(kbc.Dir, "config", "default", "kustomization.yaml"),
206196
"#- ../prometheus", "#")).To(Succeed())
207-
208-
if kbc.IsRestricted {
209-
By("uncomment kustomize files to ensure that pods are restricted")
210-
uncommentPodStandards(kbc)
211-
}
212197
}
213198

214199
func creatingAPI(kbc *utils.TestContext) {
@@ -378,22 +363,6 @@ const certManagerTarget = `#replacements:
378363
# index: 1
379364
# create: true`
380365

381-
func uncommentPodStandards(kbc *utils.TestContext) {
382-
configManager := filepath.Join(kbc.Dir, "config", "manager", "manager.yaml")
383-
384-
//nolint:lll
385-
if err := pluginutil.ReplaceInFile(configManager, `# TODO(user): For common cases that do not require escalating privileges
386-
# it is recommended to ensure that all your Pods/Containers are restrictive.
387-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
388-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
389-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
390-
# seccompProfile:
391-
# type: RuntimeDefault`, `seccompProfile:
392-
type: RuntimeDefault`); err == nil {
393-
ExpectWithOffset(1, err).NotTo(HaveOccurred())
394-
}
395-
}
396-
397366
// scaffoldConversionWebhook sets up conversion webhooks for testing the ConversionTest API
398367
func scaffoldConversionWebhook(kbc *utils.TestContext) {
399368
By("scaffolding conversion webhooks for testing ConversionTest v1 to v2 conversion")

‎test/e2e/v4/plugin_cluster_test.go‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -67,33 +67,27 @@ var _ = Describe("kubebuilder", func() {
6767
kbc.Destroy()
6868
})
6969
It("should generate a runnable project", func() {
70-
kbc.IsRestricted = false
7170
GenerateV4(kbc)
7271
Run(kbc, true, false, true, false)
7372
})
7473
It("should generate a runnable project with the Installer", func() {
75-
kbc.IsRestricted = false
7674
GenerateV4(kbc)
7775
Run(kbc, true, true, true, false)
7876
})
7977
It("should generate a runnable project without metrics exposed", func() {
80-
kbc.IsRestricted = false
8178
GenerateV4WithoutMetrics(kbc)
8279
Run(kbc, true, false, false, false)
8380
})
8481
It("should generate a runnable project with metrics protected by network policies", func() {
85-
kbc.IsRestricted = false
8682
GenerateV4WithNetworkPoliciesWithoutWebhooks(kbc)
8783
Run(kbc, false, false, true, true)
8884
})
8985
It("should generate a runnable project with webhooks and metrics protected by network policies", func() {
90-
kbc.IsRestricted = false
9186
GenerateV4WithNetworkPolicies(kbc)
9287
Run(kbc, true, false, true, true)
9388
})
9489
It("should generate a runnable project with the manager running "+
9590
"as restricted and without webhooks", func() {
96-
kbc.IsRestricted = true
9791
GenerateV4WithoutWebhooks(kbc)
9892
Run(kbc, false, false, true, false)
9993
})
@@ -110,11 +104,9 @@ func Run(kbc *utils.TestContext, hasWebhook, isToUseInstaller, hasMetrics bool,
110104
err = kbc.CreateManagerNamespace()
111105
ExpectWithOffset(1, err).NotTo(HaveOccurred())
112106

113-
if kbc.IsRestricted {
114-
By("labeling all namespaces to warn about restricted")
115-
err = kbc.LabelNamespacesToWarnAboutRestricted()
116-
ExpectWithOffset(1, err).NotTo(HaveOccurred())
117-
}
107+
By("labeling all namespaces to warn about restricted")
108+
err = kbc.LabelNamespacesToWarnAboutRestricted()
109+
ExpectWithOffset(1, err).NotTo(HaveOccurred())
118110

119111
By("updating the go.mod")
120112
err = kbc.Tidy()
@@ -149,10 +141,8 @@ func Run(kbc *utils.TestContext, hasWebhook, isToUseInstaller, hasMetrics bool,
149141
ExpectWithOffset(1, err).NotTo(HaveOccurred())
150142
}
151143

152-
if kbc.IsRestricted {
153-
By("validating that manager Pod/container(s) are restricted")
154-
ExpectWithOffset(1, output).NotTo(ContainSubstring("Warning: would violate PodSecurity"))
155-
}
144+
By("validating that manager Pod/container(s) are restricted")
145+
ExpectWithOffset(1, output).NotTo(ContainSubstring("Warning: would violate PodSecurity"))
156146

157147
By("Checking controllerManager and getting the name of the Pod")
158148
controllerPodName = getControllerName(kbc)

‎testdata/project-v4-multigroup/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

0 commit comments

Comments
 (0)