Debugging warnings in pss workflow

.github/workflows/pss_test.yaml

@@ -1,5 +1,5 @@
 name: Apply PSS labels to namespaces
 on:
   pull_request:
     paths:
     - tests/gh-actions/install_KinD_create_KinD_cluster_install_kustomize.sh
@@ -11,7 +11,7 @@
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - tests/gh-actions/install_istio_with_ext_auth.sh
+    - tests/gh-actions/install_istio-cni.sh
     - tests/gh-actions/install_multitenancy.sh
 
 jobs:
@@ -27,12 +27,25 @@
     - name: Install kubectl
       run: ./tests/gh-actions/install_kubectl.sh
 
-    - name: Install all deployments from static namespaces
+    - name: Install all istio-cni resources and kubeflow namespace
       run: |
         kustomize build common/kubeflow-namespace/base | kubectl apply -f -
         ./tests/gh-actions/install_cert_manager.sh
-        ./tests/gh-actions/install_istio_with_ext_auth.sh
-        kustomize build common/istio-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+        ./tests/gh-actions/install_istio-cni.sh
+        kustomize build common/istio-cni-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+
+    - name: Configure istio init container with seccompProfile attribute
+      run: |
+        kubectl get cm istio-sidecar-injector -n istio-system -o yaml > temporary_patch.yaml
+        sed -i '0,/runAsNonRoot: true/{s//&\n              seccompProfile:\n                type: RuntimeDefault/}' temporary_patch.yaml
+        sed -i '/runAsNonRoot: true/{N; /runAsUser: {{ .ProxyUID | default "1337" }}/a\
+                      seccompProfile:\n                type: RuntimeDefault
+        }' temporary_patch.yaml
+        kubectl apply -f temporary_patch.yaml
+        rm temporary_patch.yaml
+
+    - name: Install all other deployments of static namespaces
+      run: |
         ./tests/gh-actions/install_multi_tenancy.sh
         kustomize build ./common/oauth2-proxy/overlays/m2m-self-signed | kubectl apply -f -
         echo "Waiting for all oauth2-proxy pods to become ready..."
@@ -41,35 +54,27 @@
         echo "Waiting for pods in auth namespace to become ready..."
         kubectl wait --for=condition=Ready pods --all --timeout=180s -n auth
 
+    # - name: Configure profile-controller's manager configmap with PSS restricted label
+    #   run: |
+    #     CONFIGMAP=$(kubectl get cm -n kubeflow | awk '{print $1}' | grep -e "namespace-labels-data")
+    #     kubectl get cm $CONFIGMAP -n kubeflow -o yaml > temporary.yaml
+    #     sed -i '/app.kubernetes.io\/part-of: "kubeflow-profile"/{s/.*/&\n    pod-security.kubernetes.io\/enforce: "restricted"/}' temporary.yaml
+    #     kubectl apply -f temporary.yaml
+    #     rm temporary.yaml
+
     - name: Install KF Pipelines
       run: ./tests/gh-actions/install_pipelines.sh
 
-    - name: Apply Pod Security Standards baseline levels for static namespaces
-      run: ./tests/gh-actions/enable_baseline_PSS.sh
-
-    - name: Apply Pod Security Standards baseline levels for dynamic namespaces
-      run: |
-        cat << EOF > ./kustomization.yaml
-        apiVersion: kustomize.config.k8s.io/v1beta1
-        kind: Kustomization
-        resources:
-        - apps/profiles/upstream/overlays/kubeflow
-        components:
-        - contrib/security/PSS/dynamic/baseline
-        EOF
-        kubectl apply -k .
-        rm ./kustomization.yaml
-        kubectl -n kubeflow wait --for=condition=Ready pods -l kustomize.component=profiles --timeout 180s
-
-    - name: Unapply applied baseline values
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-        sleep 10
+    # - name: Create dynamic user namespace and check for PSS labels present
+    #   run: |
+    #     kustomize build common/user-namespace/base | kubectl apply -f -
+    #     LABELS=$(kubectl get namespace kubeflow-user-example-com --show-labels | awk 'NR==2 {print $NF}')
+    #     if [[ "$LABELS" == *pod-security.kubernetes.io/enforce=restricted* ]]; then
+    #       echo "PSS restricted label is present in dynamic namespace."
+    #     else
+    #       echo "PSS restricted label is absent in dynamic namespace."
+    #       exit 1
+    #     fi
 
     - name: Apply patches to clear warnings
       run: |
@@ -87,6 +92,19 @@
             kubectl patch "$KIND" "$NAME" -n "$NAMESPACE" --patch-file "$file"
           fi
         done
+        sleep 600
+
+    - name: Apply Pod Security Standards baseline levels for static namespaces
+      run: ./tests/gh-actions/enable_baseline_PSS.sh
+
+    - name: Unapply applied baseline labels
+      run: |
+        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")
+        for NAMESPACE in "${NAMESPACES[@]}"; do
+          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
+            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
+          fi
+        done
 
     - name: Applying Pod Security Standards restricted levels for static namespaces
       run: ./tests/gh-actions/enable_restricted_PSS.sh

contrib/security/PSS/patches/cache-server.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/kfam.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/kubeflow-pipelines-profile-controller.yaml

@@ -13,6 +13,8 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL

contrib/security/PSS/patches/manager.yaml

@@ -13,6 +13,8 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL

contrib/security/PSS/patches/metacontroller.yaml

@@ -0,0 +1,13 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: metacontroller
+  namespace: kubeflow
+spec:
+  template:
+    spec:
+      containers:
+      - name: metacontroller
+        securityContext:
+          seccompProfile: 
+            type: RuntimeDefault

contrib/security/PSS/patches/metadata-envoy-deployment.yaml

@@ -13,6 +13,8 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL

contrib/security/PSS/patches/metadata-grpc-deployment.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/metadata-writer.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/minio.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/ml-pipeline-persistenceagent.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/ml-pipeline-scheduledworkflow.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/ml-pipeline-ui.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/ml-pipeline-viewer-crd.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/ml-pipeline-visualizationserver.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/ml-pipeline.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/mysql.yaml

@@ -13,6 +13,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 0
           capabilities:
             drop:
             - ALL
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

contrib/security/PSS/patches/oauth2-proxy.yaml

@@ -4,7 +4,6 @@ metadata:
   name: oauth2-proxy
   namespace: oauth2-proxy
 spec:
-  replicas: 2
   template:
     spec:
       containers:

contrib/security/PSS/patches/workflow-controller.yaml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: workflow-controller
+  namespace: kubeflow
+spec:
+  template:
+    spec:
+      containers:
+      - name: workflow-controller
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault
+          runAsNonRoot: true
+      initContainers:
+      - image: docker.io/istio/proxyv2:1.22.1
+        name: istio-validation
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault

tests/gh-actions/install_istio-cni.sh

@@ -4,4 +4,7 @@ echo "Installing Istio-cni ..."
 cd common/istio-cni-1-22
 kustomize build istio-crds/base | kubectl apply -f -
 kustomize build istio-namespace/base | kubectl apply -f -
-kustomize build istio-install/base | kubectl apply -f -
+kustomize build istio-install/base | kubectl apply -f -
+
+echo "Waiting for all Istio Pods to become ready..."
+kubectl wait --for=condition=Ready pods --all -n istio-system --timeout 300s