Skip to content

Commit 921ba04

Browse files
camilamacedo86camilamacedo86
committed
Enable seccompProfile.type: RuntimeDefault by default in scaffolded projects
- Removed the comment about `seccompProfile` as `type: RuntimeDefault` is now set by default. - Updated to reflect that Kubebuilder only tests and supports the latest three Kubernetes releases. - Given that we’re currently using Kubernetes 1.31, there’s no longer a reason to keep this line commented, ensuring projects adhere to `restricted` Pod Security Standards by default.
1 parent f7a02ad commit 921ba04

File tree

12 files changed

+46
-95
lines changed

12 files changed

+46
-95
lines changed

‎docs/book/src/cronjob-tutorial/testdata/project/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

‎docs/book/src/getting-started/testdata/project/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

‎docs/book/src/multiversion-tutorial/testdata/project/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -95,14 +95,12 @@ spec:
9595
# values:
9696
# - linux
9797
securityContext:
98+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
99+
# This ensures that deployments meet the highest security requirements for Kubernetes.
100+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
98101
runAsNonRoot: true
99-
# TODO(user): For common cases that do not require escalating privileges
100-
# it is recommended to ensure that all your Pods/Containers are restrictive.
101-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
102-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
103-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
104-
# seccompProfile:
105-
# type: RuntimeDefault
102+
seccompProfile:
103+
type: RuntimeDefault
106104
containers:
107105
- command:
108106
- /manager

‎test/e2e/v4/generate_test.go‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -63,11 +63,6 @@ func GenerateV4(kbc *utils.TestContext) {
6363
"#- ../prometheus", "#")).To(Succeed())
6464
ExpectWithOffset(1, pluginutil.UncommentCode(filepath.Join(kbc.Dir, "config", "default", "kustomization.yaml"),
6565
certManagerTarget, "#")).To(Succeed())
66-
67-
if kbc.IsRestricted {
68-
By("uncomment kustomize files to ensure that pods are restricted")
69-
uncommentPodStandards(kbc)
70-
}
7166
}
7267

7368
// GenerateV4WithoutMetrics implements a go/v4 plugin project defined by a TestContext.
@@ -107,11 +102,6 @@ func GenerateV4WithoutMetrics(kbc *utils.TestContext) {
107102
ExpectWithOffset(1, pluginutil.CommentCode(
108103
filepath.Join(kbc.Dir, "config", "default", "kustomization.yaml"),
109104
metricsTarget, "#")).To(Succeed())
110-
111-
if kbc.IsRestricted {
112-
By("uncomment kustomize files to ensure that pods are restricted")
113-
uncommentPodStandards(kbc)
114-
}
115105
}
116106

117107
// GenerateV4WithoutMetrics implements a go/v4 plugin project defined by a TestContext.
@@ -179,11 +169,6 @@ func GenerateV4WithoutWebhooks(kbc *utils.TestContext) {
179169
ExpectWithOffset(1, pluginutil.UncommentCode(
180170
filepath.Join(kbc.Dir, "config", "default", "kustomization.yaml"),
181171
"#- ../prometheus", "#")).To(Succeed())
182-
183-
if kbc.IsRestricted {
184-
By("uncomment kustomize files to ensure that pods are restricted")
185-
uncommentPodStandards(kbc)
186-
}
187172
}
188173

189174
func creatingAPI(kbc *utils.TestContext) {
@@ -352,19 +337,3 @@ const certManagerTarget = `#replacements:
352337
# delimiter: '.'
353338
# index: 1
354339
# create: true`
355-
356-
func uncommentPodStandards(kbc *utils.TestContext) {
357-
configManager := filepath.Join(kbc.Dir, "config", "manager", "manager.yaml")
358-
359-
//nolint:lll
360-
if err := pluginutil.ReplaceInFile(configManager, `# TODO(user): For common cases that do not require escalating privileges
361-
# it is recommended to ensure that all your Pods/Containers are restrictive.
362-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
363-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
364-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
365-
# seccompProfile:
366-
# type: RuntimeDefault`, `seccompProfile:
367-
type: RuntimeDefault`); err == nil {
368-
ExpectWithOffset(1, err).NotTo(HaveOccurred())
369-
}
370-
}

‎test/e2e/v4/plugin_cluster_test.go‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -67,33 +67,27 @@ var _ = Describe("kubebuilder", func() {
6767
kbc.Destroy()
6868
})
6969
It("should generate a runnable project", func() {
70-
kbc.IsRestricted = false
7170
GenerateV4(kbc)
7271
Run(kbc, true, false, true, false)
7372
})
7473
It("should generate a runnable project with the Installer", func() {
75-
kbc.IsRestricted = false
7674
GenerateV4(kbc)
7775
Run(kbc, true, true, true, false)
7876
})
7977
It("should generate a runnable project without metrics exposed", func() {
80-
kbc.IsRestricted = false
8178
GenerateV4WithoutMetrics(kbc)
8279
Run(kbc, true, false, false, false)
8380
})
8481
It("should generate a runnable project with metrics protected by network policies", func() {
85-
kbc.IsRestricted = false
8682
GenerateV4WithNetworkPoliciesWithoutWebhooks(kbc)
8783
Run(kbc, false, false, true, true)
8884
})
8985
It("should generate a runnable project with webhooks and metrics protected by network policies", func() {
90-
kbc.IsRestricted = false
9186
GenerateV4WithNetworkPolicies(kbc)
9287
Run(kbc, true, false, true, true)
9388
})
9489
It("should generate a runnable project with the manager running "+
9590
"as restricted and without webhooks", func() {
96-
kbc.IsRestricted = true
9791
GenerateV4WithoutWebhooks(kbc)
9892
Run(kbc, false, false, true, false)
9993
})
@@ -110,11 +104,9 @@ func Run(kbc *utils.TestContext, hasWebhook, isToUseInstaller, hasMetrics bool,
110104
err = kbc.CreateManagerNamespace()
111105
ExpectWithOffset(1, err).NotTo(HaveOccurred())
112106

113-
if kbc.IsRestricted {
114-
By("labeling all namespaces to warn about restricted")
115-
err = kbc.LabelNamespacesToWarnAboutRestricted()
116-
ExpectWithOffset(1, err).NotTo(HaveOccurred())
117-
}
107+
By("labeling all namespaces to warn about restricted")
108+
err = kbc.LabelNamespacesToWarnAboutRestricted()
109+
ExpectWithOffset(1, err).NotTo(HaveOccurred())
118110

119111
By("updating the go.mod")
120112
err = kbc.Tidy()
@@ -149,10 +141,8 @@ func Run(kbc *utils.TestContext, hasWebhook, isToUseInstaller, hasMetrics bool,
149141
ExpectWithOffset(1, err).NotTo(HaveOccurred())
150142
}
151143

152-
if kbc.IsRestricted {
153-
By("validating that manager Pod/container(s) are restricted")
154-
ExpectWithOffset(1, output).NotTo(ContainSubstring("Warning: would violate PodSecurity"))
155-
}
144+
By("validating that manager Pod/container(s) are restricted")
145+
ExpectWithOffset(1, output).NotTo(ContainSubstring("Warning: would violate PodSecurity"))
156146

157147
By("Checking controllerManager and getting the name of the Pod")
158148
controllerPodName = getControllerName(kbc)

‎testdata/project-v4-multigroup/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

‎testdata/project-v4-multigroup/dist/install.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1801,6 +1801,8 @@ spec:
18011801
readOnly: true
18021802
securityContext:
18031803
runAsNonRoot: true
1804+
seccompProfile:
1805+
type: RuntimeDefault
18041806
serviceAccountName: project-v4-multigroup-controller-manager
18051807
terminationGracePeriodSeconds: 10
18061808
volumes:

‎testdata/project-v4-with-plugins/config/manager/manager.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,12 @@ spec:
4949
# values:
5050
# - linux
5151
securityContext:
52+
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
53+
# This ensures that deployments meet the highest security requirements for Kubernetes.
54+
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
5255
runAsNonRoot: true
53-
# TODO(user): For common cases that do not require escalating privileges
54-
# it is recommended to ensure that all your Pods/Containers are restrictive.
55-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
56-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
57-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
58-
# seccompProfile:
59-
# type: RuntimeDefault
56+
seccompProfile:
57+
type: RuntimeDefault
6058
containers:
6159
- command:
6260
- /manager

‎testdata/project-v4-with-plugins/dist/install.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -643,6 +643,8 @@ spec:
643643
readOnly: true
644644
securityContext:
645645
runAsNonRoot: true
646+
seccompProfile:
647+
type: RuntimeDefault
646648
serviceAccountName: project-v4-with-plugins-controller-manager
647649
terminationGracePeriodSeconds: 10
648650
volumes:

0 commit comments

Comments
 (0)