PSAP-1428: read only root filesystem

[jmencak]

In line with the "Principle of least privilege", add
readOnlyRootFilesystem to the NTO operand's container securityContext.

Key changes:

• NTO's operand daemonset sets the readOnlyRootFilesystem container
  securityContext.
• Use memory-backed emptyDir for /etc/tuned.
• /tmp uses memory-backed emptyDir now to allow the operand's TuneD
  daemon writing temporary files when using profiles such as the
  cpu-partitioning profile.
• TuneD container's home directory is now /run/ocp-tuned with a link to
  host's ocp-tuned persistent directory:
  persist -> /host/var/lib/ocp-tuned
• Make /var/lib/tuned directory persistent on the host by:
  /var/lib/tuned -> /host/var/lib/tuned
  The persistent directory is populated by files such as ksm-masked coming
  from cpu-partitioning profile.
• Change the ocp-tuned-one-shot systemd service to mount the hosts's
  persistent host /var/lib/{ocp-,}tuned directories to
  /host/var/lib/{ocp-,}tuned to simplify the operand code.

[openshift-ci-robot]

@jmencak: This pull request references PSAP-1428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.17.0" version, but no target version was set.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jmencak]

This looks like CI issues
/retest

[openshift-ci-robot]

@jmencak: This pull request references PSAP-1428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.17.0" version, but no target version was set.

In response to this:

In line with the "Principle of least privilege" add readOnlyRootFilesystem to the NTO operand's container securityContext.

Other changes:

• Container image build cleanup after OKD-40: Unify OKD and OCP Dockerfiles #1058
• Remove obsolete Dockerfile.rhel8
• Rename operand to ocp-tuned and use /run/ocp-tuned as home directory

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jmencak: This pull request references PSAP-1428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.17.0" version, but no target version was set.

In response to this:

In line with the "Principle of least privilege" add readOnlyRootFilesystem to the NTO operand's container securityContext.

Other changes:

• Container image build cleanup after OKD-40: Unify OKD and OCP Dockerfiles #1058
• Remove obsolete Dockerfile.rhel8
• Rename operand to ocp-tuned and use /run/ocp-tuned as home directory

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jmencak]

Finally figured out why the PAO tests are failing! The ocp-tuned-one-shot.service is failing with this PR. Fix to follow hopefully soon.

[openshift-ci-robot]

@jmencak: This pull request references PSAP-1428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.17.0" version, but no target version was set.

In response to this:

In line with the "Principle of least privilege", add
readOnlyRootFilesystem to the NTO operand's container securityContext.

NTO's operator deployment does not set readOnlyRootFilesystem here. To
set the securityContext to true for the operator, a complete rewrite of
the metrics server would be needed.

Key changes:

• NTO's operand daemonset sets the readOnlyRootFilesystem container
  securityContext.
• /tmp is symlinked to /run/ocp-tuned and the directory ownership is set
  to the operator ID. This allows:
  • the operator metrics server writing the root certificate bundle
    which is then used to verify client certificates and
  • the operand's TuneD daemon writing temporary files when using profiles
    such as the cpu-partitioning profile.
• Make /var/lib/tuned directory persistent on the host.
• Change the ocp-tuned-one-shot systemd service to mount the hosts's
  persistent host /var/lib/{ocp-,}tuned directories to
  /host/var/lib/{ocp-,}tuned to simplify the operand code.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[MarSik]

I think this will break https://github.com/openshift/must-gather/blob/master/collection-scripts/gather_ppc#L56 and we need to find a path to keep it working.

[MarSik]

On the other hand.. maybe not, we use custom container spec with volume mounts in must gather.

[openshift-ci-robot]

@jmencak: This pull request references PSAP-1428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.18.0" version, but no target version was set.

In response to this:

Read-only container root filesystem

In line with the "Principle of least privilege", add
readOnlyRootFilesystem to the NTO operand's container securityContext.

Key changes:

• NTO's operand daemonset sets the readOnlyRootFilesystem container
  securityContext.
• /tmp is symlinked to /run/ocp-tuned and the directory ownership is set
  to the operator ID. This allows:
  • the operand's TuneD daemon writing temporary files when using profiles
    such as the cpu-partitioning profile.
• Make /var/lib/tuned directory persistent on the host.
• Change the ocp-tuned-one-shot systemd service to mount the hosts's
  persistent host /var/lib/{ocp-,}tuned directories to
  /host/var/lib/{ocp-,}tuned to simplify the operand code.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jmencak]

/retest

[jmencak]

Seems like infra issues to me
/retest

[openshift-ci-robot]

@jmencak: This pull request references PSAP-1428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.18.0" version, but no target version was set.

In response to this:

In line with the "Principle of least privilege", add
readOnlyRootFilesystem to the NTO operand's container securityContext.

Key changes:

• NTO's operand daemonset sets the readOnlyRootFilesystem container
  securityContext.
• /tmp uses memory-backed emptyDir now to allow the operand's TuneD
  daemon writing temporary files when using profiles such as the
  cpu-partitioning profile.
• TuneD container's home directory is now /run/ocp-tuned with a link to
  host's ocp-tuned persistent directory:
  persist -> /host/var/lib/ocp-tuned
• Make /var/lib/tuned directory persistent on the host by:
  /var/lib/tuned -> /host/var/lib/tuned
  The persistent directory is populated by files such as ksm-masked coming
  from cpu-partitioning profile.
• Change the ocp-tuned-one-shot systemd service to mount the hosts's
  persistent host /var/lib/{ocp-,}tuned directories to
  /host/var/lib/{ocp-,}tuned to simplify the operand code.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jmencak]

Keeping this still WiP as we need to evaluate the impact of this on the installer rendering manifests.

[openshift-ci-robot]

@jmencak: This pull request references PSAP-1428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.18.0" version, but no target version was set.

In response to this:

In line with the "Principle of least privilege", add
readOnlyRootFilesystem to the NTO operand's container securityContext.

Key changes:

• NTO's operand daemonset sets the readOnlyRootFilesystem container
  securityContext.
• Use memory-backed emptyDir for /etc/tuned.
• /tmp uses memory-backed emptyDir now to allow the operand's TuneD
  daemon writing temporary files when using profiles such as the
  cpu-partitioning profile.
• TuneD container's home directory is now /run/ocp-tuned with a link to
  host's ocp-tuned persistent directory:
  persist -> /host/var/lib/ocp-tuned
• Make /var/lib/tuned directory persistent on the host by:
  /var/lib/tuned -> /host/var/lib/tuned
  The persistent directory is populated by files such as ksm-masked coming
  from cpu-partitioning profile.
• Change the ocp-tuned-one-shot systemd service to mount the hosts's
  persistent host /var/lib/{ocp-,}tuned directories to
  /host/var/lib/{ocp-,}tuned to simplify the operand code.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jmencak]

Removing WiP. I've successfully tested that this functionality no longer breaks installer rendering manifests. I've verified that both by locally testing the render functionality by running podman and by installing SNO with a custom openshift/release payload and adding a PerformanceProfile as a manifest. The manifest was rendered successfully, MachineConfig was created and /proc/cmdline successfully updated.

This PR is ready for review.

[jmencak]

I think this will break https://github.com/openshift/must-gather/blob/master/collection-scripts/gather_ppc#L56 and we need to find a path to keep it working.

Forgot about this one. Let me test this.
/hold

[jmencak]

I think this will break https://github.com/openshift/must-gather/blob/master/collection-scripts/gather_ppc#L56 and we need to find a path to keep it working.

Forgot about this one. Let me test this. /hold

I believe this still works @MarSik .

/hold cancel

Collected data from a SNO install

total 1596
drwxr-xr-x. 2 mencak mencak    300 Nov  7 11:28 .
drwxr-xr-x. 3 mencak mencak     80 Nov  7 11:28 ..
-rw-r--r--. 1 mencak mencak 266600 Nov  7 11:27 cpu_affinities.json
-rw-r--r--. 1 mencak mencak 444117 Nov  7 11:27 dmesg
-rw-r--r--. 1 mencak mencak    154 Nov  7 11:27 ethtool_channels
-rw-r--r--. 1 mencak mencak   1794 Nov  7 11:27 ethtool_features
-rw-r--r--. 1 mencak mencak   2489 Nov  7 11:27 irq_affinities.json
-rw-r--r--. 1 mencak mencak    378 Nov  7 11:27 lscpu
-rw-r--r--. 1 mencak mencak  17833 Nov  7 11:27 lspci
-rw-r--r--. 1 mencak mencak  15892 Nov  7 11:27 podresources.json
-rw-r--r--. 1 mencak mencak  32873 Nov  7 11:27 pods_info.json
-rw-r--r--. 1 mencak mencak    739 Nov  7 11:27 proc_cmdline
-rw-r--r--. 1 mencak mencak 409069 Nov  7 11:27 sno_logs_kubelet.gz
-rw-r--r--. 1 mencak mencak 384273 Nov  7 11:27 sysinfo.log
-rw-r--r--. 1 mencak mencak  26550 Nov  7 11:27 sysinfo.tgz

[MarSik]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jmencak, MarSik

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [MarSik,jmencak]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 7bca466 and 2 for PR HEAD 224fb45 in total

[jmencak]

/retest

[openshift-ci]

@jmencak: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: cluster-node-tuning-operator
This PR has been included in build cluster-node-tuning-operator-container-v4.18.0-202411080007.p0.g34a7dc6.assembly.stream.el9.
All builds following this will include this PR.