(manifests) configure manifests to comply to PSA restricted profile

Author: anik120

manifests/0000_50_olm_00-namespace.yaml

@@ -2,23 +2,25 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: openshift-operator-lifecycle-manager
+ labels:
+ openshift.io/scc: "anyuid"
+ openshift.io/cluster-monitoring: "true"
  annotations:
  openshift.io/node-selector: ""
  workload.openshift.io/allowed: "management"
  include.release.openshift.io/ibm-cloud-managed: "true"
  include.release.openshift.io/self-managed-high-availability: "true"
- labels:
- openshift.io/scc: "anyuid"
- openshift.io/cluster-monitoring: "true"
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: openshift-operators
+ labels:
+ pod-security.kubernetes.io/enforce: baseline
+ pod-security.kubernetes.io/enforce-version: "v1.24"
+ openshift.io/scc: "anyuid"
  annotations:
  openshift.io/node-selector: ""
  workload.openshift.io/allowed: "management"
  include.release.openshift.io/ibm-cloud-managed: "true"
  include.release.openshift.io/self-managed-high-availability: "true"
- labels:
- openshift.io/scc: "anyuid"

manifests/0000_50_olm_06-psm-operator.deployment.ibm-cloud-managed.yaml

@@ -23,7 +23,6 @@ spec:
  spec:
  securityContext:
  runAsNonRoot: true
- runAsUser: 65534
  seccompProfile:
  type: RuntimeDefault
  serviceAccountName: olm-operator-serviceaccount

manifests/0000_50_olm_06-psm-operator.deployment.yaml

@@ -23,7 +23,6 @@ spec:
  spec:
  securityContext:
  runAsNonRoot: true
- runAsUser: 65534
  seccompProfile:
  type: RuntimeDefault
  serviceAccountName: olm-operator-serviceaccount

manifests/0000_50_olm_07-olm-operator.deployment.ibm-cloud-managed.yaml

@@ -21,6 +21,10 @@ spec:
  annotations:
  target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
  spec:
+ securityContext:
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
  serviceAccountName: olm-operator-serviceaccount
  volumes:
  - name: srv-cert
@@ -31,6 +35,10 @@ spec:
  secretName: pprof-cert
  containers:
  - name: olm-operator
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop: ["ALL"]
  volumeMounts:
  - name: srv-cert
  mountPath: "/srv-cert"
@@ -82,10 +90,6 @@ spec:
  requests:
  cpu: 10m
  memory: 160Mi
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop: ["ALL"]
  nodeSelector:
  kubernetes.io/os: linux
  tolerations:
@@ -101,8 +105,3 @@ spec:
  operator: Exists
  tolerationSeconds: 120
  priorityClassName: system-cluster-critical
- securityContext:
- runAsNonRoot: true
- runAsUser: 65534
- seccompProfile:
- type: RuntimeDefault

manifests/0000_50_olm_07-olm-operator.deployment.yaml

@@ -21,6 +21,10 @@ spec:
  annotations:
  target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
  spec:
+ securityContext:
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
  serviceAccountName: olm-operator-serviceaccount
  volumes:
  - name: srv-cert
@@ -31,6 +35,10 @@ spec:
  secretName: pprof-cert
  containers:
  - name: olm-operator
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop: ["ALL"]
  volumeMounts:
  - name: srv-cert
  mountPath: "/srv-cert"
@@ -82,10 +90,6 @@ spec:
  requests:
  cpu: 10m
  memory: 160Mi
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop: ["ALL"]
  nodeSelector:
  kubernetes.io/os: linux
  node-role.kubernetes.io/master: ""
@@ -102,8 +106,3 @@ spec:
  operator: Exists
  tolerationSeconds: 120
  priorityClassName: system-cluster-critical
- securityContext:
- runAsNonRoot: true
- runAsUser: 65534
- seccompProfile:
- type: RuntimeDefault

manifests/0000_50_olm_08-catalog-operator.deployment.ibm-cloud-managed.yaml

@@ -21,6 +21,10 @@ spec:
  annotations:
  target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
  spec:
+ securityContext:
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
  serviceAccountName: olm-operator-serviceaccount
  volumes:
  - name: srv-cert
@@ -31,6 +35,10 @@ spec:
  secretName: pprof-cert
  containers:
  - name: catalog-operator
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop: ["ALL"]
  volumeMounts:
  - name: srv-cert
  mountPath: "/srv-cert"
@@ -55,6 +63,7 @@ spec:
  - /srv-cert/tls.key
  - --client-ca
  - /profile-collector-cert/tls.crt
+ - --set-workload-user-id=false
  image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
  imagePullPolicy: IfNotPresent
  ports:
@@ -78,10 +87,6 @@ spec:
  env:
  - name: RELEASE_VERSION
  value: "0.0.1-snapshot"
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop: ["ALL"]
  nodeSelector:
  kubernetes.io/os: linux
  tolerations:
@@ -97,8 +102,3 @@ spec:
  operator: Exists
  tolerationSeconds: 120
  priorityClassName: system-cluster-critical
- securityContext:
- runAsNonRoot: true
- runAsUser: 65534
- seccompProfile:
- type: RuntimeDefault

manifests/0000_50_olm_08-catalog-operator.deployment.yaml

@@ -21,6 +21,10 @@ spec:
  annotations:
  target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
  spec:
+ securityContext:
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
  serviceAccountName: olm-operator-serviceaccount
  volumes:
  - name: srv-cert
@@ -31,6 +35,10 @@ spec:
  secretName: pprof-cert
  containers:
  - name: catalog-operator
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop: ["ALL"]
  volumeMounts:
  - name: srv-cert
  mountPath: "/srv-cert"
@@ -55,6 +63,7 @@ spec:
  - /srv-cert/tls.key
  - --client-ca
  - /profile-collector-cert/tls.crt
+ - --set-workload-user-id=false
  image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
  imagePullPolicy: IfNotPresent
  ports:
@@ -78,10 +87,6 @@ spec:
  env:
  - name: RELEASE_VERSION
  value: "0.0.1-snapshot"
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop: ["ALL"]
  nodeSelector:
  kubernetes.io/os: linux
  node-role.kubernetes.io/master: ""
@@ -98,8 +103,3 @@ spec:
  operator: Exists
  tolerationSeconds: 120
  priorityClassName: system-cluster-critical
- securityContext:
- runAsNonRoot: true
- runAsUser: 65534
- seccompProfile:
- type: RuntimeDefault

pkg/manifests/csv.yaml

@@ -88,6 +88,10 @@ spec:
  target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
  creationTimestamp: null
  spec:
+ securityContext:
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
  serviceAccountName: olm-operator-serviceaccount
  nodeSelector:
  kubernetes.io/os: linux
@@ -106,6 +110,10 @@ spec:
  tolerationSeconds: 120
  containers:
  - name: packageserver
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop: ["ALL"]
  command:
  - /bin/package-server
  - -v=4
@@ -136,10 +144,6 @@ spec:
  volumeMounts:
  - name: tmpfs
  mountPath: /tmp
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop: ["ALL"]
  volumes:
  - name: tmpfs
  emptyDir: {}
@@ -154,11 +158,6 @@ spec:
  values:
  - packageserver
  topologyKey: "kubernetes.io/hostname"
- securityContext:
- runAsNonRoot: true
- runAsUser: 65534
- seccompProfile:
- type: RuntimeDefault
  maturity: alpha
  version: 0.19.0
  apiservicedefinitions:

scripts/catalog-deployment.patch.yaml

@@ -19,6 +19,5 @@
  path: spec.template.spec.securityContext
  value:
  runAsNonRoot: true
- runAsUser: 65534
  seccompProfile:
  type: RuntimeDefault

scripts/generate_crds_manifests.sh

@@ -133,7 +133,6 @@ spec:
  spec:
  securityContext:
  runAsNonRoot: true
- runAsUser: 65534
  seccompProfile:
  type: RuntimeDefault
  serviceAccountName: olm-operator-serviceaccount
@@ -367,3 +366,5 @@ add_ibm_managed_cloud_annotations "${ROOT_DIR}/manifests"
 
 find "${ROOT_DIR}/manifests" -type f -exec $SED -i "/^#/d" {} \;
 find "${ROOT_DIR}/manifests" -type f -exec $SED -i "1{/---/d}" {} \;
+
+${YQ} delete --inplace -d'0' manifests/0000_50_olm_00-namespace.yaml 'metadata.labels."pod-security.kubernetes.io/enforce*"'