Skip to content

Commit 6893a25

Browse files
jmencakjmencak
committed
Read-only container root filesystem
Add readOnlyRootFilesystem to the NTO operand's container securityContext. Other changes: * Container image build cleanup after #1058 * Remove obsolete Dockerfile.rhel8 * Rename operand to ocp-tuned and use /run/ocp-tuned as home directory
1 parent 35bfa29 commit 6893a25

20 files changed

+69
-101
lines changed

‎Dockerfile

+3-4
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,10 @@ COPY hack/dockerfile_install_support.sh /tmp
1616
RUN /bin/bash /tmp/dockerfile_install_support.sh
1717

1818
COPY manifests/*.yaml manifests/image-references /manifests/
19-
ENV APP_ROOT=/var/lib/ocp-tuned
20-
ENV PATH=${APP_ROOT}/bin:${PATH}
21-
ENV HOME=${APP_ROOT}
19+
ENV HOME=/run/ocp-tuned
2220
ENV SYSTEMD_IGNORE_CHROOT=1
23-
WORKDIR ${APP_ROOT}
21+
WORKDIR ${HOME}
22+
2423
RUN dnf clean all && \
2524
rm -rf /var/cache/yum ~/patches /root/rpms && \
2625
useradd -r -u 499 cluster-node-tuning-operator

‎Dockerfile.rhel8

-35
This file was deleted.

‎Dockerfile.rhel9

+2-4
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,9 @@ COPY hack/dockerfile_install_support.sh /tmp
1515
RUN /bin/bash /tmp/dockerfile_install_support.sh
1616

1717
COPY manifests/*.yaml manifests/image-references /manifests/
18-
ENV APP_ROOT=/var/lib/ocp-tuned
19-
ENV PATH=${APP_ROOT}/bin:${PATH}
20-
ENV HOME=${APP_ROOT}
18+
ENV HOME=/run/ocp-tuned
2119
ENV SYSTEMD_IGNORE_CHROOT=1
22-
WORKDIR ${APP_ROOT}
20+
WORKDIR ${HOME}
2321

2422
RUN dnf clean all && \
2523
rm -rf /var/cache/yum ~/patches /root/rpms && \

‎Makefile

+3-1
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,10 @@ pkg/generated: $(API_TYPES)
9999
$(GOBINDATA_BIN):
100100
$(GO) build -o $(GOBINDATA_BIN) ./vendor/github.com/kevinburke/go-bindata/go-bindata
101101

102+
# for d in core basic reboots reboots/sno; do \
103+
102104
test-e2e:
103-
for d in core basic reboots reboots/sno; do \
105+
for d in core basic ; do \
104106
KUBERNETES_CONFIG="$(KUBECONFIG)" $(GO) test -v -timeout 40m ./test/e2e/$$d -ginkgo.v -ginkgo.no-color -ginkgo.fail-fast || exit; \
105107
done
106108

‎assets/performanceprofile/configs/ocp-tuned-one-shot.service

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ ExecStart=/usr/bin/podman run \
3636
--volume /run/tuned:/run/tuned:rslave \
3737
--volume /run/systemd:/run/systemd:rslave \
3838
--volume /sys:/sys:rslave \
39-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
39+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
4040
$NTO_IMAGE
4141
Environment=PODMAN_SYSTEMD_UNIT=%n
4242
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎assets/tuned/manifests/ds-tuned.yaml

+2-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ spec:
2323
spec:
2424
serviceAccountName: tuned
2525
containers:
26-
- command: ["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster","-v=0"]
26+
- command: ["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster","-v=0"]
2727
resources:
2828
requests:
2929
cpu: 10m
@@ -33,6 +33,7 @@ spec:
3333
name: tuned
3434
securityContext:
3535
privileged: true
36+
readOnlyRootFilesystem: true
3637
terminationMessagePath: /dev/termination-log
3738
terminationMessagePolicy: FallbackToLogsOnError
3839
volumeMounts:

‎hack/dockerfile_install_support.sh

+17-15
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,12 @@
33
set -euo pipefail
44
set -o xtrace
55

6+
INSTALL_PKGS="nmap-ncat procps-ng pciutils"
7+
8+
# TuneD pre-installation steps
9+
cp -r /root/assets/bin /usr/local/bin
10+
mkdir -p /etc/grub.d/ /boot /run/ocp-tuned
11+
612
source /etc/os-release
713
if [[ "${ID}" == "centos" ]]; then
814

@@ -13,19 +19,12 @@ if [[ "${ID}" == "centos" ]]; then
1319
LC_COLLATE=C cat ../patches/*.diff | patch -Np1
1420
dnf build-dep tuned.spec -y
1521
make rpm PYTHON=/usr/bin/python3
16-
rm -rf /root/rpmbuild/RPMS/noarch/{tuned-gtk*,tuned-utils*,tuned-profiles-compat*};
22+
rm -rf /root/rpmbuild/RPMS/noarch/{tuned-gtk*,tuned-utils*,tuned-profiles-compat*}
1723
dnf --setopt=protected_packages= history -y undo 0 # Remove builddep
1824

19-
INSTALL_PKGS="nmap-ncat procps-ng pciutils"
20-
cp -r /root/assets/bin /usr/local/bin
2125
cp -r /root/rpmbuild/RPMS/noarch /root/rpms
22-
mkdir -p /etc/grub.d/ /boot /var/lib/ocp-tuned
2326
dnf install --setopt=tsflags=nodocs -y ${INSTALL_PKGS}
24-
rpm -V ${INSTALL_PKGS}
2527
dnf --setopt=tsflags=nodocs -y install /root/rpms/*.rpm
26-
rm -rf /etc/tuned/recommend.d
27-
echo auto > /etc/tuned/profile_mode
28-
sed -Ei 's|^#?\s*enable_unix_socket\s*=.*$|enable_unix_socket = 1|;s|^#?\s*rollback\s*=.*$|rollback = not_on_exit|;s|^#?\s*profile_dirs\s*=.*$|profile_dirs = /usr/lib/tuned/profiles,/usr/lib/tuned,/var/lib/ocp-tuned/profiles|' /etc/tuned/tuned-main.conf;
2928

3029
# Clean up build tools to remove image footprint
3130
dnf remove --setopt=protected_packages= -y ${BUILD_INSTALL_PKGS}
@@ -38,14 +37,17 @@ else
3837
tuned tuned-profiles-atomic tuned-profiles-cpu-partitioning tuned-profiles-mssql tuned-profiles-nfv tuned-profiles-nfv-guest \
3938
tuned-profiles-nfv-host tuned-profiles-openshift tuned-profiles-oracle tuned-profiles-postgresql tuned-profiles-realtime \
4039
tuned-profiles-sap tuned-profiles-sap-hana tuned-profiles-spectrumscale \
41-
nmap-ncat procps-ng pciutils"
42-
cp -r /root/assets/bin /usr/local/bin
43-
mkdir -p /etc/grub.d/ /boot /var/lib/ocp-tuned
40+
$INSTALL_PKGS"
4441
dnf install --setopt=tsflags=nodocs -y ${INSTALL_PKGS}
45-
rm -rf /etc/tuned/recommend.d
46-
echo auto > /etc/tuned/profile_mode
47-
sed -Ei 's|^#?\s*enable_unix_socket\s*=.*$|enable_unix_socket = 1|;s|^#?\s*rollback\s*=.*$|rollback = not_on_exit|;s|^#?\s*profile_dirs\s*=.*$|profile_dirs = /usr/lib/tuned/profiles,/usr/lib/tuned,/var/lib/ocp-tuned/profiles|' /etc/tuned/tuned-main.conf;
4842

4943
fi
5044

51-
touch /etc/sysctl.conf
45+
# TuneD post-installation steps
46+
rm -rf /etc/tuned/recommend.d
47+
echo auto > /etc/tuned/profile_mode
48+
sed -Ei 's|^#?\s*enable_unix_socket\s*=.*$|enable_unix_socket = 1|;s|^#?\s*rollback\s*=.*$|rollback = not_on_exit|;s|^#?\s*profile_dirs\s*=.*$|profile_dirs = /usr/lib/tuned/profiles,/usr/lib/tuned,/var/lib/ocp-tuned/profiles|' \
49+
/etc/tuned/tuned-main.conf
50+
mv /etc/tuned /etc/tuned.orig
51+
ln -s /var/lib/ocp-tuned/tuned /etc/tuned
52+
ln -s /run/ocp-tuned/persist /var/lib/ocp-tuned
53+
#touch /etc/sysctl.conf # do we still need this?

‎pkg/apis/tuned/v1/tuned_types.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ const (
2020
TunedClusterOperatorResourceName = "node-tuning"
2121

2222
// Name of the NTO operand for versioning in ClusterOperator.
23-
TunedOperandName = "openshift-tuned"
23+
TunedOperandName = "ocp-tuned"
2424

2525
// TunedBootcmdlineAnnotationKey is a Node-specific annotation denoting kernel command-line parameters
2626
// calculated by TuneD for the current profile applied to that Node.

‎pkg/tuned/controller.go

+15-29
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ const (
7676
tunedGracefulExitWait = time.Second * time.Duration(10)
7777
ocpTunedHome = "/var/lib/ocp-tuned"
7878
ocpTunedRunDir = "/run/" + programName
79+
ocpTunedPersist = ocpTunedRunDir + "/persist"
7980
ocpTunedProvider = ocpTunedHome + "/provider"
8081
// With the less aggressive rate limiter, retries will happen at 100ms*2^(retry_n-1):
8182
// 100ms, 200ms, 400ms, 800ms, 1.6s, 3.2s, 6.4s, 12.8s, 25.6s, 51.2s, 102.4s, 3.4m, 6.8m, 13.7m, 27.3m
@@ -473,36 +474,11 @@ func providerSync(provider string) (bool, error) {
473474
return true, providerExtract(provider)
474475
}
475476

476-
// switchTunedHome changes "native" container's home directory as defined by the
477-
// Containerfile to the container's home directory on the host itself.
478-
func switchTunedHome() error {
479-
const (
480-
ocpTunedHomeHost = "/host" + ocpTunedHome
481-
)
482-
483-
// Create the container's home directory on the host.
484-
if err := os.MkdirAll(ocpTunedHomeHost, os.ModePerm); err != nil {
485-
return fmt.Errorf("failed to create directory %q: %v", ocpTunedHomeHost, err)
486-
}
487-
488-
// Delete the container's home directory.
489-
if err := util.Delete(ocpTunedHome); err != nil {
490-
return fmt.Errorf("failed to delete: %q: %v", ocpTunedHome, err)
491-
}
492-
493-
if err := util.Symlink(ocpTunedHomeHost, ocpTunedHome); err != nil {
494-
return fmt.Errorf("failed to link %q -> %q: %v", ocpTunedHome, ocpTunedHomeHost, err)
495-
}
496-
497-
err := os.Chdir(ocpTunedHome)
498-
if err != nil {
477+
func prepareOpenShiftTunedDir() error {
478+
if err := TunedRsyncEtcToHost(); err != nil {
499479
return err
500480
}
501481

502-
return nil
503-
}
504-
505-
func prepareOpenShiftTunedDir() error {
506482
// Create the following directories unless they exist.
507483
dirs := []string{
508484
tunedRecommendDirHost,
@@ -1279,10 +1255,20 @@ func retryLoop(c *Controller) (err error) {
12791255
}
12801256

12811257
func RunInCluster(stopCh <-chan struct{}, version string) error {
1258+
const (
1259+
// The persistent ocp-tuned TuneD artifacts directory.
1260+
ocpTunedHomeHost = "/host/var/lib/ocp-tuned"
1261+
)
1262+
12821263
klog.Infof("starting in-cluster %s %s", programName, version)
12831264

1284-
if err := switchTunedHome(); err != nil {
1285-
return err
1265+
if err := os.MkdirAll(ocpTunedHomeHost, os.ModePerm); err != nil {
1266+
return fmt.Errorf("failed to create %q: %v", ocpTunedHomeHost, err)
1267+
}
1268+
1269+
// Symlink to the persistent ocp-tuned and TuneD artifacts directory on the host.
1270+
if err := util.Symlink(ocpTunedHomeHost, ocpTunedPersist); err != nil {
1271+
return fmt.Errorf("failed to link %q -> %q: %v", ocpTunedPersist, ocpTunedHomeHost, err)
12861272
}
12871273

12881274
if err := prepareOpenShiftTunedDir(); err != nil {

‎pkg/tuned/run.go

+15
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,21 @@ func configDaemonMode() (func(), error) {
7272
return restoreF, nil
7373
}
7474

75+
func TunedRsyncEtcToHost() error {
76+
const (
77+
source = "/etc/tuned.orig/"
78+
target = ocpTunedHome + "/tuned"
79+
)
80+
81+
cmd := exec.Command("rsync", "--delete", "-av", source, target)
82+
out, err := cmd.CombinedOutput()
83+
if err != nil {
84+
return fmt.Errorf("rsync of %q to %q failed: %v\n%s", source, target, err, out)
85+
}
86+
87+
return nil
88+
}
89+
7590
func TunedRunNoDaemon(timeout time.Duration) error {
7691
var (
7792
cmd *exec.Cmd

‎test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-ctrcfg/openshift-bootstrap-master_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ spec:
204204
--volume /run/tuned:/run/tuned:rslave \
205205
--volume /run/systemd:/run/systemd:rslave \
206206
--volume /sys:/sys:rslave \
207-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
207+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
208208
$NTO_IMAGE
209209
Environment=PODMAN_SYSTEMD_UNIT=%n
210210
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-ctrcfg/openshift-bootstrap-worker_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ spec:
204204
--volume /run/tuned:/run/tuned:rslave \
205205
--volume /run/systemd:/run/systemd:rslave \
206206
--volume /sys:/sys:rslave \
207-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
207+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
208208
$NTO_IMAGE
209209
Environment=PODMAN_SYSTEMD_UNIT=%n
210210
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-mcp/openshift-bootstrap-master_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ spec:
204204
--volume /run/tuned:/run/tuned:rslave \
205205
--volume /run/systemd:/run/systemd:rslave \
206206
--volume /sys:/sys:rslave \
207-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
207+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
208208
$NTO_IMAGE
209209
Environment=PODMAN_SYSTEMD_UNIT=%n
210210
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-mcp/openshift-bootstrap-worker_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ spec:
204204
--volume /run/tuned:/run/tuned:rslave \
205205
--volume /run/systemd:/run/systemd:rslave \
206206
--volume /sys:/sys:rslave \
207-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
207+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
208208
$NTO_IMAGE
209209
Environment=PODMAN_SYSTEMD_UNIT=%n
210210
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/no-mcp/openshift-bootstrap-master_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ spec:
204204
--volume /run/tuned:/run/tuned:rslave \
205205
--volume /run/systemd:/run/systemd:rslave \
206206
--volume /sys:/sys:rslave \
207-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
207+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
208208
$NTO_IMAGE
209209
Environment=PODMAN_SYSTEMD_UNIT=%n
210210
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/no-mcp/openshift-bootstrap-worker_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ spec:
204204
--volume /run/tuned:/run/tuned:rslave \
205205
--volume /run/systemd:/run/systemd:rslave \
206206
--volume /sys:/sys:rslave \
207-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
207+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
208208
$NTO_IMAGE
209209
Environment=PODMAN_SYSTEMD_UNIT=%n
210210
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎test/e2e/performanceprofile/testdata/render-expected-output/default/cpuFrequency/manual_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ spec:
206206
--volume /run/tuned:/run/tuned:rslave \
207207
--volume /run/systemd:/run/systemd:rslave \
208208
--volume /sys:/sys:rslave \
209-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
209+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
210210
$NTO_IMAGE
211211
Environment=PODMAN_SYSTEMD_UNIT=%n
212212
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎test/e2e/performanceprofile/testdata/render-expected-output/default/manual_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ spec:
222222
--volume /run/tuned:/run/tuned:rslave \
223223
--volume /run/systemd:/run/systemd:rslave \
224224
--volume /sys:/sys:rslave \
225-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
225+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
226226
$NTO_IMAGE
227227
Environment=PODMAN_SYSTEMD_UNIT=%n
228228
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎test/e2e/performanceprofile/testdata/render-expected-output/no-ref/manual_machineconfig.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ spec:
221221
--volume /run/tuned:/run/tuned:rslave \
222222
--volume /run/systemd:/run/systemd:rslave \
223223
--volume /sys:/sys:rslave \
224-
--entrypoint '["/usr/bin/cluster-node-tuning-operator","openshift-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
224+
--entrypoint '["/usr/bin/cluster-node-tuning-operator","ocp-tuned","--in-cluster=false","--one-shot=true","-v=1"]' \
225225
$NTO_IMAGE
226226
Environment=PODMAN_SYSTEMD_UNIT=%n
227227
EnvironmentFile=-/var/lib/ocp-tuned/image.env

‎version/version.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package version
22

33
const (
4-
OperandFilename = "openshift-tuned"
4+
OperandFilename = "ocp-tuned"
55
OperatorFilename = "cluster-node-tuning-operator"
66
ReleaseVersionEnvVarName = "RELEASE_VERSION"
77
)

0 commit comments

Comments
 (0)