Skip to content

Commit c57ebf9

Browse files
everettraveneverettraven
authored
(scorecard): Add new images for default untar and storage options (#6335)
* add images for scorecard untar and storage Signed-off-by: Bryce Palmer <bpalmer@redhat.com> * Add new images for scorecard and use them as the default untar and storage images to ensure that scorecard pods are fully compliant with restricted PSA. This is done by making the images run as non-root by default (sets the user to non-root in the Dockerfile) fixes #6295 Signed-off-by: Bryce Palmer <bpalmer@redhat.com> * update images & docs;add changelog Signed-off-by: Bryce Palmer <bpalmer@redhat.com> * add missing newline Signed-off-by: Bryce Palmer <bpalmer@redhat.com> --------- Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
1 parent e3c5dd8 commit c57ebf9

File tree

9 files changed

+50
-10
lines changed

9 files changed

+50
-10
lines changed

‎.github/workflows/deploy.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ jobs:
7272
environment: deploy
7373
strategy:
7474
matrix:
75-
id: ["operator-sdk", "helm-operator", "scorecard-test", "ansible-operator", "ansible-operator-2.11-preview"]
75+
id: ["operator-sdk", "helm-operator", "scorecard-test", "ansible-operator", "ansible-operator-2.11-preview", "scorecard-storage", "scorecard-untar"]
7676
steps:
7777

7878
- name: set up qemu

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ build/scorecard-test build/scorecard-test-kuttl build/custom-scorecard-tests:
9292

9393
# Convenience wrapper for building all remotely hosted images.
9494
.PHONY: image-build
95-
IMAGE_TARGET_LIST = operator-sdk helm-operator ansible-operator ansible-operator-2.11-preview scorecard-test scorecard-test-kuttl
95+
IMAGE_TARGET_LIST = operator-sdk helm-operator ansible-operator ansible-operator-2.11-preview scorecard-test scorecard-test-kuttl scorecard-untar scorecard-storage
9696
image-build: $(foreach i,$(IMAGE_TARGET_LIST),image/$(i)) ## Build all images.
9797

9898
# Convenience wrapper for building dependency base images.

‎changelog/fragments/03-scorecard-image-psa.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# entries is a list of entries to include in
2+
# release notes and/or the migration guide
3+
entries:
4+
- description: >
5+
(scorecard): update default storage and untar images to images
6+
that run as non-root users by default. This ensures full compliance
7+
with restricted PSA guidelines when using `--pod-security=restricted`.
8+
9+
# kind is one of:
10+
# - addition
11+
# - change
12+
# - deprecation
13+
# - removal
14+
# - bugfix
15+
kind: "bugfix"
16+
17+
# Is this a breaking change?
18+
breaking: false

‎images/scorecard-storage/Dockerfile

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM docker.io/busybox:1.36
2+
3+
## Create a new non-root user to run as
4+
ENV HOME=/opt/scorecard-untar \
5+
USER_NAME=scorecard-untar \
6+
USER_UID=1001
7+
8+
RUN echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
9+
10+
WORKDIR ${HOME}
11+
12+
USER ${USER_UID}

‎images/scorecard-untar/Dockerfile

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM registry.access.redhat.com/ubi8:8.7
2+
3+
## Create a new non-root user to run as
4+
ENV HOME=/opt/scorecard-untar \
5+
USER_NAME=scorecard-untar \
6+
USER_UID=1001
7+
8+
RUN echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
9+
10+
WORKDIR ${HOME}
11+
12+
USER ${USER_UID}

‎internal/cmd/operator-sdk/scorecard/cmd.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,10 +91,10 @@ If the argument holds an image tag, it must be present remotely.`,
9191
scorecardCmd.Flags().DurationVarP(&c.waitTime, "wait-time", "w", 30*time.Second,
9292
"seconds to wait for tests to complete. Example: 35s")
9393
scorecardCmd.Flags().StringVarP(&c.storageImage, "storage-image", "b",
94-
"docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af",
94+
"quay.io/operator-framework/scorecard-storage:latest",
9595
"Storage image to be used by the Scorecard pod")
9696
scorecardCmd.Flags().StringVarP(&c.untarImage, "untar-image", "u",
97-
"registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7",
97+
"quay.io/operator-framework/scorecard-untar:latest",
9898
"Untar image to be used by the Scorecard pod")
9999
scorecardCmd.Flags().StringVarP(&c.testOutput, "test-output", "t", "test-output",
100100
"Test output directory.")

‎internal/cmd/operator-sdk/scorecard/cmd_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,12 +69,12 @@ var _ = Describe("Running the scorecard command", func() {
6969
flag = cmd.Flags().Lookup("storage-image")
7070
Expect(flag).NotTo(BeNil())
7171
Expect(flag.Shorthand).To(Equal("b"))
72-
Expect(flag.DefValue).To(Equal("docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af"))
72+
Expect(flag.DefValue).To(Equal("quay.io/operator-framework/scorecard-storage:latest"))
7373

7474
flag = cmd.Flags().Lookup("untar-image")
7575
Expect(flag).NotTo(BeNil())
7676
Expect(flag.Shorthand).To(Equal("u"))
77-
Expect(flag.DefValue).To(Equal("registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7"))
77+
Expect(flag.DefValue).To(Equal("quay.io/operator-framework/scorecard-untar:latest"))
7878
})
7979
})
8080

‎internal/scorecard/scorecard.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -227,8 +227,6 @@ func (r PodTestRunner) RunTest(ctx context.Context, test v1alpha3.TestConfigurat
227227
// creating a pod security context to support running in default namespace
228228
podSecCtx := v1.PodSecurityContext{}
229229
podSecCtx.RunAsNonRoot = &podSec
230-
podSecCtx.RunAsUser = &[]int64{1000}[0]
231-
podSecCtx.RunAsGroup = &[]int64{1000}[0]
232230
podSecCtx.SeccompProfile = &v1.SeccompProfile{
233231
Type: v1.SeccompProfileTypeRuntimeDefault,
234232
}

‎website/content/en/docs/cli/operator-sdk_scorecard.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@ operator-sdk scorecard [flags]
2828
-l, --selector string label selector to determine which tests are run
2929
-s, --service-account string Service account to use for tests (default "default")
3030
-x, --skip-cleanup Disable resource cleanup after tests are run
31-
-b, --storage-image string Storage image to be used by the Scorecard pod (default "docker.io/library/busybox@sha256:c71cb4f7e8ececaffb34037c2637dc86820e4185100e18b4d02d613a9bd772af")
31+
-b, --storage-image string Storage image to be used by the Scorecard pod (default "quay.io/operator-framework/scorecard-storage:latest")
3232
-t, --test-output string Test output directory. (default "test-output")
33-
-u, --untar-image string Untar image to be used by the Scorecard pod (default "registry.access.redhat.com/ubi8@sha256:910f6bc0b5ae9b555eb91b88d28d568099b060088616eba2867b07ab6ea457c7")
33+
-u, --untar-image string Untar image to be used by the Scorecard pod (default "quay.io/operator-framework/scorecard-untar:latest")
3434
-w, --wait-time duration seconds to wait for tests to complete. Example: 35s (default 30s)
3535
```
3636

0 commit comments

Comments
 (0)