feat: make zarf-agent pods comply with offical restricted pod security standard #3036

Ansible-man · 2024-09-26T03:08:29Z

Comply with k8s restricted pod security standard

Description

Adds security context to zarf-agent to ensure compliance with Kubernetes restricted pod security standard used in high security environments.
...

Related Issue

Fixes #2932

Relates to #

Checklist before merging

Test, docs, adr added or updated as needed
Contributor Guide Steps followed

netlify · 2024-09-26T03:08:48Z

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	`3c45873`
🔍 Latest deploy log	https://app.netlify.com/sites/zarf-docs/deploys/672454deb5820f00089992f5

Ansible-man · 2024-09-26T03:20:25Z

Made an non-impactful change to fix my commit not being verified as seen in commit #2

AustinAbro321 · 2024-09-26T13:25:23Z

@Ansible-man thanks for making this. Could you also fix the dco error by following these instructions

codecov · 2024-09-26T13:25:46Z

Codecov Report

All modified and coverable lines are covered by tests ✅

see 39 files with indirect coverage changes

Ansible-man · 2024-09-27T06:34:37Z

@AustinAbro321 I should be able to do that tomorrow at some point. Thank you and happy to help where I can!

Miaoxiang-philips · 2024-10-10T05:54:16Z

@AustinAbro321 I should be able to do that tomorrow at some point. Thank you and happy to help where I can!

Hi @AustinAbro321 It seems that the DCO problem has not been solved, do you need help?

Ansible-man · 2024-10-10T20:34:21Z

Is there still something I need to do here?

…

On Thu, Oct 10, 2024, 12:54 AM Miaoxiang ***@***.***> wrote: @AustinAbro321 <https://github.com/AustinAbro321> I should be able to do that tomorrow at some point. Thank you and happy to help where I can! Hi @AustinAbro321 <https://github.com/AustinAbro321> It seems that the DCO problem has not been solved, do you need help? — Reply to this email directly, view it on GitHub <#3036 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AWHLQRSPVOUNACN5EAYI5ELZ2YJB3AVCNFSM6AAAAABO4A5AKCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIMBUGA4TMOJUGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

phillebaba · 2024-10-11T16:43:36Z

@Ansible-man could you resolve DCO?

phillebaba · 2024-10-11T16:44:42Z

Part of #2757

Miaoxiang-philips · 2024-10-12T03:03:21Z

Is there still something I need to do here?

@Ansible-man You can follow the prompts to execute the commands

schristoff · 2024-10-17T17:44:44Z

Hey @Ansible-man - we really appreciate this PR. If you could follow the steps outlined above we can get this merged. If you're unable to do that within the next week, we will have to close this and merge this with a signed DCO under someone else.

Thanks!

Ansible-man · 2024-10-18T06:34:11Z

I will look into this tomorrow afternoon

…

On Thu, Oct 17, 2024, 12:45 PM schristoff ***@***.***> wrote: Hey @Ansible-man <https://github.com/Ansible-man> - we really appreciate this PR. If you could follow the steps outlined above we can get this merged. If you're unable to do that within the next week, we will have to close this and merge this with a signed DCO under someone else. Thanks! — Reply to this email directly, view it on GitHub <#3036 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AWHLQRVJF44EMZTD5OJGRNTZ37ZSJAVCNFSM6AAAAABO4A5AKCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIMRQGEZTKMZZG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

…stricted PSS Signed-off-by: Cade Thomas <[email protected]>

Signed-off-by: schristoff <[email protected]> Signed-off-by: Cade Thomas <[email protected]>

Ansible-man · 2024-10-19T05:54:24Z

Sorry that took so long @schristoff . I just got around to reading everything. If that did not fix it let me know and I will get right back on it. Looking forward to helping out more in the future

phillebaba · 2024-10-22T10:26:35Z

@Ansible-man could you rebase?

Ansible-man · 2024-10-22T11:40:50Z

I followed the instructions highlighted and the DCO errors seem to be gone. What else do I need to do?

…

On Tue, Oct 22, 2024, 4:26 AM Philip Laine ***@***.***> wrote: @Ansible-man <https://github.com/Ansible-man> could you rebase? — Reply to this email directly, view it on GitHub <#3036 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AWHLQRT6AXZ73NPVWJLPNSTZ4YR7HAVCNFSM6AAAAABO4A5AKCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIMRYHEYDANJVGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

phillebaba · 2024-10-23T09:50:17Z

@Ansible-man there is a conflict with a change done in main which needs to be resolved before we can merge.

Ansible-man · 2024-10-23T12:02:09Z

Okay, I will be back home Thursday and I will resolve.

…

On Wed, Oct 23, 2024, 3:50 AM Philip Laine ***@***.***> wrote: @Ansible-man <https://github.com/Ansible-man> there is a conflict with a change done in main which needs to be resolved before we can merge. — Reply to this email directly, view it on GitHub <#3036 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AWHLQRQMAER3NFT5KN6JZRTZ45WO7AVCNFSM6AAAAABO4A5AKCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIMZRGU2TMOBVGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

Ansible-man · 2024-10-25T05:04:35Z

Let me know if that resolved it

phillebaba · 2024-10-25T08:58:09Z

src/test/nightly/ecr_publish_test.go

@@ -61,6 +61,8 @@ func TestECRPublishing(t *testing.T) {
 	// Ensure we get a warning when trying to inspect the online published package
 	stdOut, stdErr, err = e2e.Zarf(t, "package", "inspect", upstreamPackageURL, keyFlag, "--sbom-out", tmpDir, "--skip-signature-validation")
 	require.NoError(t, err, stdOut, stdErr)
+	require.Contains(t, stdErr, "Validating SBOM checksums")


Why is this being added to the test? Can we remove this.

Yeah I will rebase again and remove it. Not sure how it got in there.

…1.20.5 (zarf-dev#3143) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Cade Thomas <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Cade Thomas <[email protected]>

zarf-dev#3144) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Cade Thomas <[email protected]>

Signed-off-by: Cade Thomas <[email protected]>

Ansible-man · 2024-11-01T04:12:28Z

5th time a charm?

…y standard (zarf-dev#3036) Signed-off-by: Cade Thomas <[email protected]> Signed-off-by: schristoff <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Cade Thomas <[email protected]> Co-authored-by: schristoff <[email protected]> Co-authored-by: Austin Abro <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Ansible-man requested review from a team as code owners September 26, 2024 03:08

AustinAbro321 changed the title ~~Add security context to zarf-agent in order to comply with offical re…~~ feat: add security context to zarf-agent in order to comply with offical restricted pod security standard Sep 26, 2024

AustinAbro321 changed the title ~~feat: add security context to zarf-agent in order to comply with offical restricted pod security standard~~ feat: make zarf-agent pods comply with offical restricted pod security standard Sep 26, 2024

AustinAbro321 previously approved these changes Sep 26, 2024

View reviewed changes

Cade Thomas and others added 3 commits October 19, 2024 00:50

Add security context to zarf-agent in order to comply with offical re…

09bfd04

…stricted PSS Signed-off-by: Cade Thomas <[email protected]>

Add security context to zarf-agent in order to comply with offical re…

22afbea

…stricted PSS Signed-off-by: Cade Thomas <[email protected]>

fix: nightly by removing logline no longer printed (zarf-dev#3038)

d30d04a

Signed-off-by: schristoff <[email protected]> Signed-off-by: Cade Thomas <[email protected]>

Ansible-man force-pushed the main branch from 2d5d578 to d30d04a Compare October 19, 2024 05:50

Merge branch 'main' into main

d6f6fc1

Ansible-man dismissed AustinAbro321’s stale review via d6f6fc1 October 25, 2024 05:03

phillebaba reviewed Oct 25, 2024

View reviewed changes

AustinAbro321 and others added 10 commits October 25, 2024 07:18

Merge branch 'main' into main

4a4a150

chore(deps): bump github.com/prometheus/client_golang from 1.20.4 to …

8df7c90

…1.20.5 (zarf-dev#3143) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Cade Thomas <[email protected]>

chore(deps): bump actions/setup-node from 4.0.4 to 4.1.0 (zarf-dev#3141)

2df5b3c

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Cade Thomas <[email protected]>

chore(deps): bump actions/setup-go from 5.0.2 to 5.1.0 (zarf-dev#3140)

2b30b7a

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Cade Thomas <[email protected]>

chore(deps): bump k8s.io/kubectl from 0.31.1 to 0.31.2 (zarf-dev#3142)

4e39b22

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Cade Thomas <[email protected]>

chore(deps): bump sigs.k8s.io/controller-runtime from 0.19.0 to 0.19.1 (

6f7cb7e

zarf-dev#3144) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Cade Thomas <[email protected]>

Remove line from ecr_publish_test.go

98f79cb

Signed-off-by: Cade Thomas <[email protected]>

Remove line from ecr_publish_test.go

16e9d5c

Signed-off-by: Cade Thomas <[email protected]>

Merge branch 'main' of https://github.com/Ansible-man/zarf

0fcbf64

Add comment to explain

3c45873

Signed-off-by: Cade Thomas <[email protected]>

phillebaba approved these changes Nov 1, 2024

View reviewed changes

phillebaba added this pull request to the merge queue Nov 1, 2024

Merged via the queue into zarf-dev:main with commit 785feeb Nov 1, 2024
26 checks passed

This was referenced Nov 18, 2024

fix: change agent to run as same user in dockerfile #3243

Merged

Zarf agent deployments security context uses incorrect user / group #3244

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: make zarf-agent pods comply with offical restricted pod security standard #3036

feat: make zarf-agent pods comply with offical restricted pod security standard #3036

Ansible-man commented Sep 26, 2024

netlify bot commented Sep 26, 2024 •

edited

Loading

Ansible-man commented Sep 26, 2024

AustinAbro321 commented Sep 26, 2024

codecov bot commented Sep 26, 2024 •

edited

Loading

Ansible-man commented Sep 27, 2024

Miaoxiang-philips commented Oct 10, 2024

Ansible-man commented Oct 10, 2024 via email

phillebaba commented Oct 11, 2024

phillebaba commented Oct 11, 2024

Miaoxiang-philips commented Oct 12, 2024 •

edited

Loading

schristoff commented Oct 17, 2024

Ansible-man commented Oct 18, 2024 via email

Ansible-man commented Oct 19, 2024

phillebaba commented Oct 22, 2024

Ansible-man commented Oct 22, 2024 via email

phillebaba commented Oct 23, 2024

Ansible-man commented Oct 23, 2024 via email

Ansible-man commented Oct 25, 2024

phillebaba Oct 25, 2024

Ansible-man Nov 1, 2024

Ansible-man commented Nov 1, 2024

feat: make zarf-agent pods comply with offical restricted pod security standard #3036

feat: make zarf-agent pods comply with offical restricted pod security standard #3036

Conversation

Ansible-man commented Sep 26, 2024

Description

Related Issue

Checklist before merging

netlify bot commented Sep 26, 2024 • edited Loading

✅ Deploy Preview for zarf-docs canceled.

Ansible-man commented Sep 26, 2024

AustinAbro321 commented Sep 26, 2024

codecov bot commented Sep 26, 2024 • edited Loading

Codecov Report

Ansible-man commented Sep 27, 2024

Miaoxiang-philips commented Oct 10, 2024

Ansible-man commented Oct 10, 2024 via email

phillebaba commented Oct 11, 2024

phillebaba commented Oct 11, 2024

Miaoxiang-philips commented Oct 12, 2024 • edited Loading

schristoff commented Oct 17, 2024

Ansible-man commented Oct 18, 2024 via email

Ansible-man commented Oct 19, 2024

phillebaba commented Oct 22, 2024

Ansible-man commented Oct 22, 2024 via email

phillebaba commented Oct 23, 2024

Ansible-man commented Oct 23, 2024 via email

Ansible-man commented Oct 25, 2024

phillebaba Oct 25, 2024

Choose a reason for hiding this comment

Ansible-man Nov 1, 2024

Choose a reason for hiding this comment

Ansible-man commented Nov 1, 2024

netlify bot commented Sep 26, 2024 •

edited

Loading

codecov bot commented Sep 26, 2024 •

edited

Loading

Miaoxiang-philips commented Oct 12, 2024 •

edited

Loading