feat(openshift): add SCC-managed deployment profile - #216
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2fcf2b7efc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| securityContext: {} | ||
| containerSecurityContext: {} |
There was a problem hiding this comment.
With this example, OpenShift Tenant pods still get the operator's fixed defaults instead of SCC-assigned IDs: the reconciler treats {} as an empty override, starts from the 10001 UID/GID/FSGroup defaults in effective_workload_security_context(), and new_statefulset_with_tls_plan_and_cluster_domain() always writes those Pod and container security contexts. In a restricted-v2 namespace where UID 10001 is outside the allowed range, applying this advertised OpenShift manifest will still produce rejected Tenant pods unless the controller also omits the generated contexts for the paired empty objects.
Useful? React with 👍 / 👎.
| # image-layer directories such as /data and /logs must be owned by group 0 | ||
| # and grant the group the same permissions as the owner. Do not deploy this | ||
| # example until such a RustFS image is available in your registry. | ||
| image: registry.example.com/rustfs/rustfs:openshift-compatible |
There was a problem hiding this comment.
When users follow this example with an arbitrary-UID-compatible image from their own registry, the reconciler classifies that custom repository as unverifiable under the default RuntimeDefault profile and requires operator.rustfs.com/runtime-default-image-ack to exactly match the image. Because the example lacks that annotation, it is rejected with WorkloadSecurityIncompatible before any OpenShift SCC behavior is exercised; include the acknowledgement or use a known-compatible official tag.
Useful? React with 👍 / 👎.
2fcf2b7 to
a6772be
Compare
1 participant
Type of Change
Related Issues
Part of #206. Depends on #215 for Tenant workload delegation. The RBAC repair is split into #214.
Summary of Changes
openshift.enabledHelm value, defaulting tofalserestricted-v2scope, arbitrary-UID image requirements, upgrade ordering, preflight inventory, rollout behavior, storage risks, and rollback constraints in English and ChineseChecklist
make pre-commit(fmt-check + clippy + test + console-lint + console-fmt-check)[Unreleased](if user-visible change) — N/A; this repository does not currently containCHANGELOG.mdImpact
Update impact
openshift.enabled=falserender the current fixed Operator/Console security contexts.10001behavior in place.{}/{}form rolls the affected StatefulSet. A changed SCC-assigned FSGroup can trigger first-mount ownership work; large volumes can start slowly, and incompatible CSI/root-squash permissions can fail.openshift.enabled=true, wait for Operator/Console rollout, validate SCC/image/storage prerequisites, then migrate Tenant manifests in a maintenance window.OpenShift release blockers and support boundary
restricted-v2;restricted-v3spec.hostUsers: falseis not implemented./dataand/logsownership10001:10001with mode0750. A separate arbitrary-UID image fix and real OpenShift data read/write, existing-PVC, rollout, and rollback validation are required before end-to-end support can be declared.Verification
make pre-commit cargo test --manifest-path e2e/Cargo.toml --test openshift_manifest --test sts_manifest cargo clippy --manifest-path e2e/Cargo.toml --all-targets -- -D warningsAdditional Notes
This PR intentionally avoids adding a Console Tenant mode button. The current Console API is Tenant-scoped while the MinIO contract is Pool-aware; YAML remains the lossless configuration path until a Pool-aware API can preserve advanced security fields.
Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.