Skip to content

Commit c45bcb6

Browse files
benjaminjbbenjaminjb
authored
Revert "Enable seccomp on containers (CrunchyData#3193)" (CrunchyData#3215)
* Revert "Enable seccomp on containers (CrunchyData#3193)" This reverts commit 6193560. * update Release notes
1 parent 58c293f commit c45bcb6

File tree

12 files changed

+2
-105
lines changed

12 files changed

+2
-105
lines changed

‎config/manager/manager.yaml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,4 @@ spec:
3838
allowPrivilegeEscalation: false
3939
readOnlyRootFilesystem: true
4040
runAsNonRoot: true
41-
seccompProfile:
42-
type: RuntimeDefault
4341
serviceAccountName: pgo

‎docs/content/releases/5.1.1.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,3 @@ Read more about how you can [get started]({{< relref "quickstart/_index.md" >}})
2222

2323
- It is now possible to perform major PostgreSQL version upgrades when using an external WAL directory.
2424
- The documentation for pgAdmin 4 now clearly states that any pgAdmin user created by PGO will have a `@pgo` suffix.
25-
26-
## Changes
27-
28-
- The `seccompProfile` field in the `securityContext` for all containers is now set to `RuntimeDefault` in order to properly restrict syscalls.

‎internal/controller/postgrescluster/instance_test.go

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -563,8 +563,6 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
563563
privileged: false
564564
readOnlyRootFilesystem: true
565565
runAsNonRoot: true
566-
seccompProfile:
567-
type: RuntimeDefault
568566
volumeMounts:
569567
- mountPath: /etc/pgbackrest/server
570568
name: pgbackrest-server
@@ -612,8 +610,6 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
612610
privileged: false
613611
readOnlyRootFilesystem: true
614612
runAsNonRoot: true
615-
seccompProfile:
616-
type: RuntimeDefault
617613
volumeMounts:
618614
- mountPath: /etc/pgbackrest/server
619615
name: pgbackrest-server
@@ -669,8 +665,6 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
669665
privileged: false
670666
readOnlyRootFilesystem: true
671667
runAsNonRoot: true
672-
seccompProfile:
673-
type: RuntimeDefault
674668
volumeMounts:
675669
- mountPath: /etc/pgbackrest/server
676670
name: pgbackrest-server
@@ -718,8 +712,6 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) {
718712
privileged: false
719713
readOnlyRootFilesystem: true
720714
runAsNonRoot: true
721-
seccompProfile:
722-
type: RuntimeDefault
723715
volumeMounts:
724716
- mountPath: /etc/pgbackrest/server
725717
name: pgbackrest-server

‎internal/controller/postgrescluster/pgbackrest_test.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2510,8 +2510,6 @@ containers:
25102510
privileged: false
25112511
readOnlyRootFilesystem: true
25122512
runAsNonRoot: true
2513-
seccompProfile:
2514-
type: RuntimeDefault
25152513
volumeMounts:
25162514
- mountPath: /etc/pgbackrest/conf.d
25172515
name: pgbackrest-config

‎internal/controller/postgrescluster/volumes_test.go

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -991,8 +991,6 @@ containers:
991991
privileged: false
992992
readOnlyRootFilesystem: true
993993
runAsNonRoot: true
994-
seccompProfile:
995-
type: RuntimeDefault
996994
terminationMessagePath: /dev/termination-log
997995
terminationMessagePolicy: File
998996
volumeMounts:
@@ -1046,8 +1044,6 @@ containers:
10461044
privileged: false
10471045
readOnlyRootFilesystem: true
10481046
runAsNonRoot: true
1049-
seccompProfile:
1050-
type: RuntimeDefault
10511047
terminationMessagePath: /dev/termination-log
10521048
terminationMessagePolicy: File
10531049
volumeMounts:
@@ -1103,8 +1099,6 @@ containers:
11031099
privileged: false
11041100
readOnlyRootFilesystem: true
11051101
runAsNonRoot: true
1106-
seccompProfile:
1107-
type: RuntimeDefault
11081102
terminationMessagePath: /dev/termination-log
11091103
terminationMessagePolicy: File
11101104
volumeMounts:

‎internal/initialize/security.go

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,6 @@ import (
2020
)
2121

2222
// RestrictedPodSecurityContext returns a v1.PodSecurityContext with safe defaults.
23-
// Note: All current containers have security context set by `RestrictedSecurityContext`
24-
// which has recommended limits; if more pods/containers are added
25-
// make sure to set the SC on the container
2623
// See https://docs.k8s.io/concepts/security/pod-security-standards/
2724
func RestrictedPodSecurityContext() *corev1.PodSecurityContext {
2825
return &corev1.PodSecurityContext{
@@ -46,12 +43,5 @@ func RestrictedSecurityContext() *corev1.SecurityContext {
4643

4744
// Fail to start the container if its image runs as UID 0 (root).
4845
RunAsNonRoot: Bool(true),
49-
50-
// Restrict syscalls with RuntimeDefault seccomp.
51-
// Set this on the container-level to avoid interfering
52-
// with sidecars and injected containers.
53-
SeccompProfile: &corev1.SeccompProfile{
54-
Type: corev1.SeccompProfileTypeRuntimeDefault,
55-
},
5646
}
5747
}

‎internal/initialize/security_test.go

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -97,11 +97,8 @@ func TestRestrictedSecurityContext(t *testing.T) {
9797
"Containers must be required to run as non-root users.")
9898
}
9999

100-
if assert.Check(t, sc.SeccompProfile != nil) {
101-
assert.Assert(t, sc.SeccompProfile.Type == "RuntimeDefault",
102-
"Seccomp profile must be explicitly set to one of the allowed values.")
103-
}
104-
100+
assert.Assert(t, sc.SeccompProfile == nil,
101+
"The RuntimeDefault seccomp profile must be required, or allow specific additional profiles.")
105102
})
106103

107104
if assert.Check(t, sc.ReadOnlyRootFilesystem != nil) {

‎internal/pgadmin/reconcile_test.go

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,6 @@ containers:
241241
privileged: false
242242
readOnlyRootFilesystem: true
243243
runAsNonRoot: true
244-
seccompProfile:
245-
type: RuntimeDefault
246244
volumeMounts:
247245
- mountPath: /etc/pgadmin
248246
name: pgadmin-startup
@@ -280,8 +278,6 @@ initContainers:
280278
privileged: false
281279
readOnlyRootFilesystem: true
282280
runAsNonRoot: true
283-
seccompProfile:
284-
type: RuntimeDefault
285281
volumeMounts:
286282
- mountPath: /etc/pgadmin
287283
name: pgadmin-startup
@@ -477,8 +473,6 @@ containers:
477473
privileged: false
478474
readOnlyRootFilesystem: true
479475
runAsNonRoot: true
480-
seccompProfile:
481-
type: RuntimeDefault
482476
volumeMounts:
483477
- mountPath: /etc/pgadmin
484478
name: pgadmin-startup
@@ -520,8 +514,6 @@ initContainers:
520514
privileged: false
521515
readOnlyRootFilesystem: true
522516
runAsNonRoot: true
523-
seccompProfile:
524-
type: RuntimeDefault
525517
volumeMounts:
526518
- mountPath: /etc/pgadmin
527519
name: pgadmin-startup

‎internal/pgbackrest/reconcile_test.go

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -571,8 +571,6 @@ func TestAddServerToInstancePod(t *testing.T) {
571571
privileged: false
572572
readOnlyRootFilesystem: true
573573
runAsNonRoot: true
574-
seccompProfile:
575-
type: RuntimeDefault
576574
volumeMounts:
577575
- mountPath: /etc/pgbackrest/server
578576
name: pgbackrest-server
@@ -619,8 +617,6 @@ func TestAddServerToInstancePod(t *testing.T) {
619617
privileged: false
620618
readOnlyRootFilesystem: true
621619
runAsNonRoot: true
622-
seccompProfile:
623-
type: RuntimeDefault
624620
volumeMounts:
625621
- mountPath: /etc/pgbackrest/server
626622
name: pgbackrest-server
@@ -705,8 +701,6 @@ func TestAddServerToRepoPod(t *testing.T) {
705701
privileged: false
706702
readOnlyRootFilesystem: true
707703
runAsNonRoot: true
708-
seccompProfile:
709-
type: RuntimeDefault
710704
volumeMounts:
711705
- mountPath: /etc/pgbackrest/server
712706
name: pgbackrest-server
@@ -749,8 +743,6 @@ func TestAddServerToRepoPod(t *testing.T) {
749743
privileged: false
750744
readOnlyRootFilesystem: true
751745
runAsNonRoot: true
752-
seccompProfile:
753-
type: RuntimeDefault
754746
volumeMounts:
755747
- mountPath: /etc/pgbackrest/server
756748
name: pgbackrest-server

‎internal/pgbouncer/reconcile_test.go

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -141,8 +141,6 @@ containers:
141141
privileged: false
142142
readOnlyRootFilesystem: true
143143
runAsNonRoot: true
144-
seccompProfile:
145-
type: RuntimeDefault
146144
volumeMounts:
147145
- mountPath: /etc/pgbouncer
148146
name: pgbouncer-config
@@ -171,8 +169,6 @@ containers:
171169
privileged: false
172170
readOnlyRootFilesystem: true
173171
runAsNonRoot: true
174-
seccompProfile:
175-
type: RuntimeDefault
176172
volumeMounts:
177173
- mountPath: /etc/pgbouncer
178174
name: pgbouncer-config
@@ -249,8 +245,6 @@ containers:
249245
privileged: false
250246
readOnlyRootFilesystem: true
251247
runAsNonRoot: true
252-
seccompProfile:
253-
type: RuntimeDefault
254248
volumeMounts:
255249
- mountPath: /etc/pgbouncer
256250
name: pgbouncer-config
@@ -284,8 +278,6 @@ containers:
284278
privileged: false
285279
readOnlyRootFilesystem: true
286280
runAsNonRoot: true
287-
seccompProfile:
288-
type: RuntimeDefault
289281
volumeMounts:
290282
- mountPath: /etc/pgbouncer
291283
name: pgbouncer-config
@@ -353,8 +345,6 @@ containers:
353345
privileged: false
354346
readOnlyRootFilesystem: true
355347
runAsNonRoot: true
356-
seccompProfile:
357-
type: RuntimeDefault
358348
volumeMounts:
359349
- mountPath: /etc/pgbouncer
360350
name: pgbouncer-config
@@ -387,8 +377,6 @@ containers:
387377
privileged: false
388378
readOnlyRootFilesystem: true
389379
runAsNonRoot: true
390-
seccompProfile:
391-
type: RuntimeDefault
392380
volumeMounts:
393381
- mountPath: /etc/pgbouncer
394382
name: pgbouncer-config

0 commit comments

Comments
 (0)