Remove kolla entrypoint pattern, harden SecurityContext - #427
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post ✔️ openstack-meta-content-provider-master SUCCESS in 3h 26m 01s |
| // that only requires read access (satisfied by FSGroup=WatcherUID), | ||
| // sidestepping the question of whether the non-root, non-owning | ||
| // container has the file's execute bit at all. | ||
| args := []string{GetScriptVolumeMount().MountPath + "/dbpurge.sh"} |
There was a problem hiding this comment.
so this is just
set -x
export PURGE_AGE=${PURGE_AGE:?"Please specify PURGE_AGE variable."}
echo y | watcher-db-manage --config-dir /etc/watcher/watcher.conf.d/ --debug purge -d ${PURGE_AGE}
we only used a script to be abel to use it form kolla
so the alternitive would be ot just make this
echo y | watcher-db-manage --config-dir /etc/watcher/watcher.conf.d/ --debug purge -d ${PURGE_AGE}
i dont thinke the echo y is even needed since i belive the commadn does not prompt for conformation
There was a problem hiding this comment.
good call, I had not looked into the script and was just focusing for now to remove kolla calls and just use what was used inside, so just moved the script. I'll update it to remove it.
There was a problem hiding this comment.
it really asks for confirmation:
sh-5.1$ watcher-db-manage --config-dir /etc/watcher/watcher.conf.d/ --debug purge -d 5
/usr/lib/python3.9/site-packages/watcher/common/scheduling.py:43: DeprecationWarning: Using class 'GreenThreadPoolExecutor' (either directly or via inheritance) is deprecated: Eventlet support is deprecated. Please migrate your code and stop using Green executor.
pool = futurist.GreenThreadPoolExecutor(int(max_workers))
+-------+------------+-----------------+--------+--------------+---------+-------+
| Goals | Strategies | Audit Templates | Audits | Action Plans | Actions | Total |
+-------+------------+-----------------+--------+--------------+---------+-------+
| 0 | 0 | 0 | 0 | 0 | 0 | 0 |
+-------+------------+-----------------+--------+--------------+---------+-------+
There are 0 objects set for deletion. Continue? [y/N]
| MountPath: "/etc/watcher/watcher.conf.d/00-default.conf", | ||
| SubPath: DefaultsConfigFileName, | ||
| ReadOnly: true, | ||
| }, |
There was a problem hiding this comment.
we should maybe revistig this as well i do not think we currnet support this.
i know i orgianly did not want to provide a single top level filed like "01-global-custom.conf" that appled to all watcher services
this might now actually be used our side of tests today
and
so i think we could delete 01-global-custom.conf as i dont think tis exposed at the crd level
https://github.com/openstack-k8s-operators/watcher-operator/blob/main/api/v1beta1/common_types.go#L81-L154 and i woudl like to avoid adding it.
There was a problem hiding this comment.
isn't it exposed in WatcherCommon https://github.com/openstack-k8s-operators/watcher-operator/blob/main/api/v1beta1/common_types.go#L67 ?
Replaces the kolla_start/kolla_set_configs/config.json staging pattern with direct volume mounts to final config paths and direct service commands for watcher-api, watcher-applier, watcher-decision-engine, db-sync, and db-purge. Key changes: - Replace kolla_start with direct commands per workload (httpd -DFOREGROUND, watcher-applier/decision-engine --config-dir, watcher-db-manage upgrade, watcher-db-manage purge) - Remove KOLLA_CONFIG_STRATEGY env vars and 5 config.json templates - Mount configs via SubPath to /etc/watcher/watcher.conf.d/, /etc/httpd/, /etc/my.cnf - Use pod.RestrictiveSecurityContext/RestrictivePodSecurityContext from lib-common (serviceuser.WatcherUID) on all workloads; db-sync and db-purge were missing pod-level SecurityContext -- added - AutomountServiceAccountToken: false on all 5 workloads - SCC: clean anyuid -> nonroot-v2 swap - httpd.conf: User/Group apache -> watcher (WSGIDaemonProcess user=watcher evidence proves dedicated system user exists) - ApacheGID as supplemental group for RPM-shipped conf.d files - DefaultMode 0440 on all config Secrets; deduplicated triplicated config0440AccessMode vars to single package-level declaration - Removed dead WatcherUserID constant (migrated to serviceuser.WatcherUID) - Removed local GetLogVolume/GetLogVolumeMount wrapper functions, replaced all call sites with direct volume.WritableDirVolume/ WritableDirVolumeMount calls - Replaced local GetRunHttpdVolume/Mount, GetVarLogHttpdVolume/Mount, GetConfigSecretVolumes with lib-common volume helpers - Fix watcher-api probe assignment: startup probe was on the log sidecar (tail -F) instead of the httpd container, and the log sidecar had HTTP probes testing httpd's port instead of its own process. Moved startup probe to httpd, removed all probes from log sidecar. - Fix db-sync: removed GetVolumeMounts/GetVolumes calls that added conflicting SubPath mounts from the shared config-data volume into /etc/watcher/watcher.conf.d/ (directory doesn't exist in image); db-sync uses its own db-sync-config-data volume with whole-directory mount instead - Fix db-purge: run watcher-db-manage purge directly instead of via shell script; removed dbpurge.sh template, scripts secret, and script volume/mount; purge age passed as CLI arg - Also fixes: TLS cert/key and memcached mTLS staging-path bugs; missing /run/httpd and /var/log/httpd emptyDirs - Update functional and kuttl tests Jira: OSPRH-33504 Jira: OSPRH-33503 Depends-On: openstack-k8s-operators/lib-common#728 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
2 participants
Replaces the kolla_start/kolla_set_configs/config.json staging pattern with direct volume mounts to final config paths and direct service commands for watcher-api, watcher-applier, watcher-decision-engine, db-sync, and db-purge.
Key changes:
Jira: OSPRH-33504
Jira: OSPRH-33503
Depends-On: openstack-k8s-operators/lib-common#728