Skip to content

Disable service account token mounting in test pods #520

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kstrenkova wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Disable service account token mounting in test pods #520

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions api/bases/test.openstack.org_ansibletests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -884,11 +884,10 @@ spec:
description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
type: boolean
resources:
default:
Expand Down
9 changes: 4 additions & 5 deletions api/bases/test.openstack.org_horizontests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -891,11 +891,10 @@ spec:
description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
type: boolean
projectNameXpath:
description: |-
Expand Down
9 changes: 4 additions & 5 deletions api/bases/test.openstack.org_tempests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -883,11 +883,10 @@ spec:
description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
type: boolean
rerunFailedTests:
default: false
Expand Down
9 changes: 4 additions & 5 deletions api/bases/test.openstack.org_tobikoes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -898,11 +898,10 @@ spec:
description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
type: boolean
publicKey:
default: ""
Expand Down
9 changes: 4 additions & 5 deletions api/v1beta1/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,11 +50,10 @@ type CommonOptions struct {
// +optional
// Use with caution! This parameter specifies whether test-operator should spawn
// test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
// runAsNonRoot: false, automountServiceAccountToken: true, and the default
// capabilities on top of capabilities that are usually needed by the test
// pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
// needed for certain test-operator functionalities to work properly (e.g.:
// extraRPMs in Tempest CR, or a certain set of tobiko tests).
// runAsNonRoot: false, and the default capabilities on top of capabilities that
// are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
// deemed insecure but it is needed for certain test-operator functionalities to
// work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
Privileged bool `json:"privileged"`

// +operator-sdk:csv:customresourcedefinitions:type=spec
Expand Down
4 changes: 2 additions & 2 deletions api/v1beta1/common_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,8 @@ const (
// WarnPrivilegedModeOn
WarnPrivilegedModeOn = "%s.Spec.Privileged is set to true. This means that test pods " +
"are spawned with allowPrivilegedEscalation: true, readOnlyRootFilesystem: false, " +
"runAsNonRoot: false, automountServiceAccountToken: true and default " +
"capabilities on top of those required by the test operator (NET_ADMIN, NET_RAW)."
"runAsNonRoot: false and default capabilities on top of those required by the " +
"test operator (NET_ADMIN, NET_RAW)."

// WarnPrivilegedModeOff
WarnPrivilegedModeOff = "%[1]s.Spec.Privileged is set to false. Note, that a certain " +
Expand Down
9 changes: 4 additions & 5 deletions config/crd/bases/test.openstack.org_ansibletests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -884,11 +884,10 @@ spec:
description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
type: boolean
resources:
default:
Expand Down
9 changes: 4 additions & 5 deletions config/crd/bases/test.openstack.org_horizontests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -891,11 +891,10 @@ spec:
description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
type: boolean
projectNameXpath:
description: |-
Expand Down
9 changes: 4 additions & 5 deletions config/crd/bases/test.openstack.org_tempests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -883,11 +883,10 @@ spec:
description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
type: boolean
rerunFailedTests:
default: false
Expand Down
9 changes: 4 additions & 5 deletions config/crd/bases/test.openstack.org_tobikoes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -898,11 +898,10 @@ spec:
description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
type: boolean
publicKey:
default: ""
Expand Down
36 changes: 16 additions & 20 deletions config/manifests/bases/test-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,11 +111,10 @@ spec:
- description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
displayName: Privileged
path: privileged
- description: StorageClass used to create any test-operator related PVCs.
Expand Down Expand Up @@ -340,11 +339,10 @@ spec:
- description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
displayName: Privileged
path: privileged
- description: |-
Expand Down Expand Up @@ -464,11 +462,10 @@ spec:
- description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
displayName: Privileged
path: privileged
- description: |-
Expand Down Expand Up @@ -1118,11 +1115,10 @@ spec:
- description: |-
Use with caution! This parameter specifies whether test-operator should spawn
test pods with allowedPrivilegedEscalation: true, readOnlyRootFilesystem: false,
runAsNonRoot: false, automountServiceAccountToken: true, and the default
capabilities on top of capabilities that are usually needed by the test
pods (NET_ADMIN, NET_RAW). This parameter is deemed insecure but it is
needed for certain test-operator functionalities to work properly (e.g.:
extraRPMs in Tempest CR, or a certain set of tobiko tests).
runAsNonRoot: false, and the default capabilities on top of capabilities that
are usually needed by the test pods (NET_ADMIN, NET_RAW). This parameter is
deemed insecure but it is needed for certain test-operator functionalities to
work properly (e.g.: extraRPMs in Tempest CR, or a certain set of tobiko tests).
displayName: Privileged
path: privileged
- description: Public Key
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ require (
k8s.io/component-base v0.33.13 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
Expand Down
3 changes: 2 additions & 1 deletion internal/util/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"github.com/openstack-k8s-operators/lib-common/modules/storage"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/ptr"
)

const (
Expand Down Expand Up @@ -99,7 +100,7 @@ func BuildTestPod(
Annotations: annotations,
},
Spec: corev1.PodSpec{
AutomountServiceAccountToken: &privileged,
AutomountServiceAccountToken: ptr.To(false),
RestartPolicy: corev1.RestartPolicyNever,
Tolerations: tolerations,
NodeSelector: nodeSelector,
Expand Down
Loading