Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add disableOciArtifactSignatureVerification spod option #1804

Merged
merged 1 commit into from
Aug 18, 2023
Merged

Add disableOciArtifactSignatureVerification spod option #1804

merged 1 commit into from
Aug 18, 2023

Conversation

saschagrunert
Copy link
Member

@saschagrunert saschagrunert commented Jul 27, 2023 •
edited
Loading

What type of PR is this?

/kind flake

What this PR does / why we need it:

None

Which issue(s) this PR fixes:

None

Does this PR have test?

Yes

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

Added `disableOciArtifactSignatureVerification` option to spod config to be able to disable signature verification for OCI artifact profiles.

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note-none Denotes a PR that doesn't merit a release note. kind/flake Categorizes issue or PR as related to a flaky test. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jul 27, 2023
@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jul 27, 2023
@saschagrunert
Copy link
Member Author

/test pull-security-profiles-operator-test-e2e

1 similar comment
@saschagrunert
Copy link
Member Author

/test pull-security-profiles-operator-test-e2e

@saschagrunert saschagrunert force-pushed the base-profile-test branch 3 times, most recently from b9979da to 1271e8c Compare July 27, 2023 12:57
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jul 27, 2023
@saschagrunert saschagrunert force-pushed the base-profile-test branch 3 times, most recently from 3b3f6d2 to 4faa694 Compare July 27, 2023 13:17
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Jul 27, 2023
@saschagrunert saschagrunert force-pushed the base-profile-test branch 3 times, most recently from bc475ab to 9bfe6d4 Compare July 27, 2023 14:04
@saschagrunert
Copy link
Member Author

/retest

@saschagrunert saschagrunert changed the title WIP: Deflake base profiles OCI registry e2e tests WIP: Add disableOciArtifactSignatureVerification option Jul 27, 2023
@saschagrunert saschagrunert changed the title WIP: Add disableOciArtifactSignatureVerification option WIP: Add disableOciArtifactSignatureVerification spod option Jul 27, 2023
@saschagrunert saschagrunert deleted the base-profile-test branch July 28, 2023 07:28
@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 16, 2023
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 16, 2023
@saschagrunert
Copy link
Member Author

/test pull-security-profiles-operator-test-e2e

2 similar comments
@saschagrunert
Copy link
Member Author

/test pull-security-profiles-operator-test-e2e

@saschagrunert
Copy link
Member Author

/test pull-security-profiles-operator-test-e2e

@saschagrunert saschagrunert changed the title WIP: Add disableOciArtifactSignatureVerification spod option Add disableOciArtifactSignatureVerification spod option Aug 16, 2023
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 16, 2023
@saschagrunert
Copy link
Member Author

All tests green, @kubernetes-sigs/security-profiles-operator-maintainers PTAL

ccojocar
ccojocar approved these changes Aug 16, 2023
View reviewed changes
Copy link
Contributor

@ccojocar ccojocar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ccojocar, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [ccojocar,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 16, 2023
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 17, 2023
@saschagrunert
Copy link
Member Author

/test pull-security-profiles-operator-test-e2e

@saschagrunert saschagrunert force-pushed the base-profile-test branch 2 times, most recently from 979204f to 9860e55 Compare August 17, 2023 10:30
@saschagrunert
Copy link
Member Author

/test pull-security-profiles-operator-test-e2e

1 similar comment
@saschagrunert
Copy link
Member Author

/test pull-security-profiles-operator-test-e2e

@saschagrunert
Add disableOciArtifactSignatureVerification spod option
7de1ba9 
This allos the spod to disable signature verification for OCI artifact
profiles.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
@saschagrunert
Copy link
Member Author

Ugh:

E0817 12:29:17.345373       1 seccompprofile.go:381] seccomp-spod "msg"="cannot pull base profile oci://ghcr.io/security-profiles/runc:v1.1.6" "error"="copy from repository: failed to resolve v1.1.6: Get \"https://ghcr.io/v2/security-profiles/runc/manifests/v1.1.6\": dial tcp: lookup ghcr.io: i/o timeout" "namespace"="test-ns" "profile"="profile-1692275170"
E0817 12:29:17.345437       1 seccompprofile.go:448] seccomp-spod "msg"="merge base profile" "error"="resolve syscalls: retrieve base profile ghcr.io/security-profiles/runc:v1.1.6 from OCI registry: copy from repository: failed to resolve v1.1.6: Get \"https://ghcr.io/v2/security-profiles/runc/manifests/v1.1.6\": dial tcp: lookup ghcr.io: i/o timeout" "namespace"="test-ns" "profile"="profile-1692275170"

@saschagrunert
Copy link
Member Author

/retest

@ccojocar
Copy link
Contributor

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 18, 2023
@k8s-ci-robot k8s-ci-robot merged commit 81666bb into kubernetes-sigs:main Aug 18, 2023
19 checks passed
@saschagrunert saschagrunert deleted the base-profile-test branch August 21, 2023 07:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ccojocar ccojocar ccojocar approved these changes

@JAORMX JAORMX Awaiting requested review from JAORMX

@Vincent056 Vincent056 Awaiting requested review from Vincent056

Assignees

@ccojocar ccojocar

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/flake Categorizes issue or PR as related to a flaky test. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@saschagrunert @k8s-ci-robot @ccojocar