OCPBUGS-45600: Enforce privileged PSA by default #5359

Evan-Reilly · 2025-01-08T17:48:00Z

Align HyperShift with OpenShift's expectation that PSA is enforcing privileged by default instead of restricted.

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

https://issues.redhat.com/browse/OCPBUGS-45600

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci · 2025-01-08T17:49:22Z

Hi @Evan-Reilly. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2025-01-08T17:51:32Z

@Evan-Reilly: This pull request references Jira Issue OCPBUGS-45600, which is invalid:

expected dependent Jira Issue OCPBUGS-45309 to target a version in 4.19.0, but it targets "4.18" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Align HyperShift with OpenShift's expectation that PSA is enforcing privileged by default instead of restricted.

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

https://issues.redhat.com/browse/OCPBUGS-45600

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rtheis

@Evan-Reilly we need to talk with Red Hat about how to handle this because we don't want to create a cherry-pick mess like last time.

rtheis · 2025-01-09T13:35:18Z

test/e2e/create_cluster_test.go

@@ -1062,7 +1062,6 @@ func TestCreateClusterRequestServingIsolation(t *testing.T) {

 	e2eutil.NewHypershiftTest(t, ctx, func(t *testing.T, g Gomega, mgtClient crclient.Client, hostedCluster *hyperv1.HostedCluster) {
 		guestClient := e2eutil.WaitForGuestClient(t, testContext, mgtClient, hostedCluster)
-		e2eutil.EnsurePSANotPrivileged(t, ctx, guestClient)


I don't think that we should be removing this function. Instead, I think we should punt restricted PSA to 4.20 via a change to the function like was done by #4875. Then in a follow-up PR we can restore restricted by default PSA to align with how 4.19 is currently defined https://github.com/openshift/api/blob/release-4.19/features/features.go#L79-L85.

control-plane-operator/controllers/hostedcontrolplane/kas/config.go

bryan-cox · 2025-01-09T14:54:50Z

/test all

Evan-Reilly · 2025-01-09T19:27:20Z

We need to get #5362 merged before this PR.

rtheis

/lgtm

rtheis · 2025-01-10T11:18:15Z

@Evan-Reilly please rebase this PR.

Align HyperShift with OpenShift's expectation that PSA is enforcing privileged by default instead of restricted.

go.mod

rtheis

/lgtm

rtheis · 2025-01-10T19:53:07Z

/ok-to-test

rtheis · 2025-01-10T20:31:07Z

@Evan-Reilly please take a look at the test failures.

rtheis

/lgtm

rtheis · 2025-01-16T03:37:01Z

/retest-required

rtheis

@Evan-Reilly there appears to be a problem with your latest push to update the Go modules.

openshift-ci · 2025-01-16T11:03:46Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Evan-Reilly
Once this PR has been reviewed and has the lgtm label, please assign csrwng for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Update the openshift-api module to get updated feature flags

openshift-ci · 2025-01-16T15:48:08Z

@Evan-Reilly: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-kubevirt-aws-ovn-reduced	`a418f7f`	link	true	`/test e2e-kubevirt-aws-ovn-reduced`
ci/prow/unit	`a418f7f`	link	true	`/test unit`
ci/prow/e2e-aws	`a418f7f`	link	true	`/test e2e-aws`
ci/prow/e2e-aks	`a418f7f`	link	true	`/test e2e-aks`
ci/prow/images	`a418f7f`	link	true	`/test images`
ci/prow/okd-scos-e2e-aws-ovn	`a418f7f`	link	false	`/test okd-scos-e2e-aws-ovn`
ci/prow/okd-scos-images	`a418f7f`	link	true	`/test okd-scos-images`
ci/prow/verify	`a418f7f`	link	true	`/test verify`
ci/prow/mce-images	`a418f7f`	link	true	`/test mce-images`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Evan-Reilly changed the title ~~Enforce privileged PSA by default~~ OCPBUGS-45600: Enforce privileged PSA by default Jan 8, 2025

rtheis suggested changes Jan 9, 2025

View reviewed changes

openshift-ci bot assigned rtheis Jan 9, 2025

Evan-Reilly force-pushed the enforce-privileged-psa-4.18 branch from b1849d5 to d28b4c0 Compare January 9, 2025 19:25

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 9, 2025

Evan-Reilly force-pushed the enforce-privileged-psa-4.18 branch from d28b4c0 to 98709bc Compare January 9, 2025 20:29

openshift-merge-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jan 9, 2025

rtheis approved these changes Jan 10, 2025

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 10, 2025

Evan-Reilly force-pushed the enforce-privileged-psa-4.18 branch from 0ed817e to 1faffb9 Compare January 10, 2025 16:14

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 10, 2025

Enforce privileged PSA by default

6acc352

Align HyperShift with OpenShift's expectation that PSA is enforcing privileged by default instead of restricted.

Evan-Reilly force-pushed the enforce-privileged-psa-4.18 branch from 1faffb9 to 89ffa79 Compare January 10, 2025 16:22

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 10, 2025

rtheis suggested changes Jan 10, 2025

View reviewed changes

go.mod Show resolved Hide resolved

Evan-Reilly force-pushed the enforce-privileged-psa-4.18 branch from 89ffa79 to 29be711 Compare January 10, 2025 18:55

rtheis approved these changes Jan 10, 2025

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 10, 2025

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 10, 2025

Evan-Reilly force-pushed the enforce-privileged-psa-4.18 branch from 29be711 to 6acc352 Compare January 15, 2025 20:11

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 15, 2025

Evan-Reilly marked this pull request as ready for review January 15, 2025 20:15

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 15, 2025

openshift-ci bot requested review from hasueki and isco-rodriguez January 15, 2025 20:15

rtheis approved these changes Jan 16, 2025

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 16, 2025

rtheis suggested changes Jan 16, 2025

View reviewed changes

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 16, 2025

Update openshift-api

a418f7f

Update the openshift-api module to get updated feature flags

Evan-Reilly force-pushed the enforce-privileged-psa-4.18 branch from ade60a0 to a418f7f Compare January 16, 2025 15:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-45600: Enforce privileged PSA by default #5359

OCPBUGS-45600: Enforce privileged PSA by default #5359

Evan-Reilly commented Jan 8, 2025 •

edited

Loading

openshift-ci bot commented Jan 8, 2025

openshift-ci-robot commented Jan 8, 2025

rtheis left a comment

rtheis Jan 9, 2025

bryan-cox commented Jan 9, 2025

Evan-Reilly commented Jan 9, 2025

rtheis left a comment

rtheis commented Jan 10, 2025

rtheis left a comment

rtheis commented Jan 10, 2025

rtheis commented Jan 10, 2025

rtheis left a comment

rtheis commented Jan 16, 2025

rtheis left a comment

openshift-ci bot commented Jan 16, 2025

openshift-ci bot commented Jan 16, 2025

OCPBUGS-45600: Enforce privileged PSA by default #5359

Are you sure you want to change the base?

OCPBUGS-45600: Enforce privileged PSA by default #5359

Conversation

Evan-Reilly commented Jan 8, 2025 • edited Loading

openshift-ci bot commented Jan 8, 2025

openshift-ci-robot commented Jan 8, 2025

rtheis left a comment

Choose a reason for hiding this comment

rtheis Jan 9, 2025

Choose a reason for hiding this comment

bryan-cox commented Jan 9, 2025

Evan-Reilly commented Jan 9, 2025

rtheis left a comment

Choose a reason for hiding this comment

rtheis commented Jan 10, 2025

rtheis left a comment

Choose a reason for hiding this comment

rtheis commented Jan 10, 2025

rtheis commented Jan 10, 2025

rtheis left a comment

Choose a reason for hiding this comment

rtheis commented Jan 16, 2025

rtheis left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Jan 16, 2025

openshift-ci bot commented Jan 16, 2025

Evan-Reilly commented Jan 8, 2025 •

edited

Loading