From 9112e18d31dbf26f4a8b21481fdec9d87cef84f4 Mon Sep 17 00:00:00 2001 From: Goutham Pacha Ravi Date: Fri, 10 Jul 2026 11:38:22 -0700 Subject: [PATCH 1/2] Drop privileged SCC from RBAC grants manila-share no longer runs with a privileged security context, so remove the privileged SCC from kubebuilder RBAC markers, the runtime policy rules, and the generated ClusterRole/Role manifests. Only the anyuid SCC is needed. Co-Authored-By: Claude Opus 4.6 (1M context) --- config/rbac/role.yaml | 16 ---------------- internal/controller/manila_controller.go | 4 ++-- internal/controller/manilashare_controller.go | 1 - 3 files changed, 2 insertions(+), 19 deletions(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 6c47f8ec7..db3cd3dbc 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -177,7 +177,6 @@ rules: - security.openshift.io resourceNames: - anyuid - - privileged resources: - securitycontextconstraints verbs: @@ -191,18 +190,3 @@ rules: - list - update - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: manager-role - namespace: openstack -rules: -- apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use diff --git a/internal/controller/manila_controller.go b/internal/controller/manila_controller.go index 2ed77841d..0734c0414 100644 --- a/internal/controller/manila_controller.go +++ b/internal/controller/manila_controller.go @@ -120,7 +120,7 @@ func (r *ManilaReconciler) GetLogger(ctx context.Context) logr.Logger { // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch // service account permissions that are needed to grant permission to the above -// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged,resources=securitycontextconstraints,verbs=use +// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use // +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch // Reconcile - @@ -551,7 +551,7 @@ func (r *ManilaReconciler) reconcileNormal(ctx context.Context, instance *manila rbacRules := []rbacv1.PolicyRule{ { APIGroups: []string{"security.openshift.io"}, - ResourceNames: []string{"anyuid", "privileged"}, + ResourceNames: []string{"anyuid"}, Resources: []string{"securitycontextconstraints"}, Verbs: []string{"use"}, }, diff --git a/internal/controller/manilashare_controller.go b/internal/controller/manilashare_controller.go index 76a50ec7b..ec4d61279 100644 --- a/internal/controller/manilashare_controller.go +++ b/internal/controller/manilashare_controller.go @@ -90,7 +90,6 @@ func (r *ManilaShareReconciler) GetLogger(ctx context.Context) logr.Logger { // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list; // +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;create;update;patch;delete;watch -// +kubebuilder:rbac:groups=security.openshift.io,namespace=openstack,resources=securitycontextconstraints,resourceNames=privileged,verbs=use // +kubebuilder:rbac:groups=k8s.cni.cncf.io,resources=network-attachment-definitions,verbs=get;list;watch // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update From cd9013842026ee56ea40663902b496662cc6cc5b Mon Sep 17 00:00:00 2001 From: Francesco Pantano Date: Sat, 11 Jul 2026 09:07:04 +0200 Subject: [PATCH 2/2] Fix manilaDefaultSecurityContext for manila-db-sync and remove hostPath As we removed scc from the rbac roles assigned to manila sa, we need to fix the SeccompProfile assigned to the manila jobs (both dbsync and cronjobs). In addition, this patch removes the hostPath /etc/machine-id mount that prevent the final removal of privileged rbac. Signed-off-by: Francesco Pantano --- internal/manila/funcs.go | 3 --- internal/manila/volumes.go | 13 ------------ test/functional/manila_controller_test.go | 6 +++--- test/functional/manilaapi_controller_test.go | 4 ++-- .../manilascheduler_controller_test.go | 4 ++-- .../functional/manilashare_controller_test.go | 4 ++-- test/kuttl/tests/manila-tls/03-assert.yaml | 21 ------------------- 7 files changed, 9 insertions(+), 46 deletions(-) diff --git a/internal/manila/funcs.go b/internal/manila/funcs.go index b49d35060..3f5b328f3 100644 --- a/internal/manila/funcs.go +++ b/internal/manila/funcs.go @@ -40,9 +40,6 @@ func manilaDefaultSecurityContext() *corev1.SecurityContext { "ALL", }, }, - SeccompProfile: &corev1.SeccompProfile{ - Type: corev1.SeccompProfileTypeRuntimeDefault, - }, } } diff --git a/internal/manila/volumes.go b/internal/manila/volumes.go index affb2b964..c0fd4a117 100644 --- a/internal/manila/volumes.go +++ b/internal/manila/volumes.go @@ -14,14 +14,6 @@ func GetVolumes(name string, extraVol []manilav1.ManilaExtraVolMounts, svc []sto var config0644AccessMode int32 = 0644 res := []corev1.Volume{ - { - Name: "etc-machine-id", - VolumeSource: corev1.VolumeSource{ - HostPath: &corev1.HostPathVolumeSource{ - Path: "/etc/machine-id", - }, - }, - }, { Name: "scripts", VolumeSource: corev1.VolumeSource{ @@ -60,11 +52,6 @@ func GetVolumes(name string, extraVol []manilav1.ManilaExtraVolMounts, svc []sto // GetVolumeMounts - Nova Control Plane VolumeMounts func GetVolumeMounts(extraVol []manilav1.ManilaExtraVolMounts, svc []storage.PropagationType) []corev1.VolumeMount { res := []corev1.VolumeMount{ - { - Name: "etc-machine-id", - MountPath: "/etc/machine-id", - ReadOnly: true, - }, { Name: "config-data", MountPath: "/var/lib/config-data/default", diff --git a/test/functional/manila_controller_test.go b/test/functional/manila_controller_test.go index e33e87a44..8cf2418e3 100644 --- a/test/functional/manila_controller_test.go +++ b/test/functional/manila_controller_test.go @@ -677,7 +677,7 @@ var _ = Describe("Manila controller", func() { // Check the resulting deployment fieldsq Expect(int(*d.Spec.Replicas)).To(Equal(1)) - Expect(d.Spec.Template.Spec.Volumes).To(HaveLen(8)) + Expect(d.Spec.Template.Spec.Volumes).To(HaveLen(7)) Expect(d.Spec.Template.Spec.Containers).To(HaveLen(2)) // cert deployment volumes @@ -1268,13 +1268,13 @@ var _ = Describe("Manila controller", func() { ss := th.GetStatefulSet(share) // Check the resulting deployment fields Expect(int(*ss.Spec.Replicas)).To(Equal(1)) - Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(5)) + Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4)) Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2)) // Get the manila-share container container := ss.Spec.Template.Spec.Containers[1] // Fail if manila-share doesn't have the right number of // VolumeMounts entries - Expect(container.VolumeMounts).To(HaveLen(7)) + Expect(container.VolumeMounts).To(HaveLen(6)) // Inspect VolumeMounts and make sure we have the Ceph MountPath // provided through extraMounts th.AssertVolumeMountPathExists(ManilaCephExtraMountsSecretName, diff --git a/test/functional/manilaapi_controller_test.go b/test/functional/manilaapi_controller_test.go index 7ec1baf10..996b4b2a2 100644 --- a/test/functional/manilaapi_controller_test.go +++ b/test/functional/manilaapi_controller_test.go @@ -135,11 +135,11 @@ var _ = Describe("ManilaAPI controller", func() { ss := th.GetStatefulSet(manilaTest.ManilaAPI) // Check the resulting deployment fields Expect(int(*ss.Spec.Replicas)).To(Equal(1)) - Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(5)) + Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4)) Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2)) container := ss.Spec.Template.Spec.Containers[1] - Expect(container.VolumeMounts).To(HaveLen(7)) + Expect(container.VolumeMounts).To(HaveLen(6)) Expect(container.Image).To(Equal(manilaTest.ContainerImage)) Expect(container.LivenessProbe.HTTPGet.Port.IntVal).To(Equal(int32(8786))) Expect(container.ReadinessProbe.HTTPGet.Port.IntVal).To(Equal(int32(8786))) diff --git a/test/functional/manilascheduler_controller_test.go b/test/functional/manilascheduler_controller_test.go index af3069632..82fafa92a 100644 --- a/test/functional/manilascheduler_controller_test.go +++ b/test/functional/manilascheduler_controller_test.go @@ -136,11 +136,11 @@ var _ = Describe("ManilaScheduler controller", func() { ss := th.GetStatefulSet(manilaTest.ManilaScheduler) // Check the resulting deployment fields Expect(int(*ss.Spec.Replicas)).To(Equal(1)) - Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4)) + Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(3)) Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2)) container := ss.Spec.Template.Spec.Containers[1] - Expect(container.VolumeMounts).To(HaveLen(6)) + Expect(container.VolumeMounts).To(HaveLen(5)) Expect(container.Image).To(Equal(manilaTest.ContainerImage)) }) It("stored the input hash in the Status", func() { diff --git a/test/functional/manilashare_controller_test.go b/test/functional/manilashare_controller_test.go index 5c3f3095a..edbbea795 100644 --- a/test/functional/manilashare_controller_test.go +++ b/test/functional/manilashare_controller_test.go @@ -149,11 +149,11 @@ var _ = Describe("ManilaShare controller", func() { ss := th.GetStatefulSet(share) // Check the resulting deployment fields Expect(int(*ss.Spec.Replicas)).To(Equal(1)) - Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4)) + Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(3)) Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2)) container := ss.Spec.Template.Spec.Containers[1] - Expect(container.VolumeMounts).To(HaveLen(6)) + Expect(container.VolumeMounts).To(HaveLen(5)) Expect(container.Image).To(Equal(manilaTest.ContainerImage)) // the input hash is stored in the current manilaShare.Status diff --git a/test/kuttl/tests/manila-tls/03-assert.yaml b/test/kuttl/tests/manila-tls/03-assert.yaml index 6e5b8d1f3..b639c2146 100644 --- a/test/kuttl/tests/manila-tls/03-assert.yaml +++ b/test/kuttl/tests/manila-tls/03-assert.yaml @@ -267,9 +267,6 @@ spec: command: - /usr/bin/dumb-init volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - readOnly: true - mountPath: /var/lib/config-data/default name: config-data - mountPath: /usr/local/bin/container-scripts @@ -307,9 +304,6 @@ spec: readOnly: true subPath: tls.key volumes: - - name: etc-machine-id - hostPath: - path: /etc/machine-id - name: scripts secret: secretName: manila-scripts @@ -362,8 +356,6 @@ spec: command: - /usr/bin/dumb-init volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - mountPath: /var/lib/config-data/default name: config-data readOnly: true @@ -393,8 +385,6 @@ spec: - share - /etc/manila/manila.conf.d volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - mountPath: /var/lib/config-data/default name: config-data readOnly: true @@ -420,9 +410,6 @@ spec: readOnly: true subPath: tls-ca-bundle.pem volumes: - - name: etc-machine-id - hostPath: - path: /etc/machine-id - name: scripts secret: secretName: manila-scripts @@ -467,8 +454,6 @@ spec: command: - /usr/bin/dumb-init volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - mountPath: /var/lib/config-data/default name: config-data readOnly: true @@ -495,9 +480,6 @@ spec: - scheduler - /etc/manila/manila.conf.d volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - readOnly: true - mountPath: /var/lib/config-data/default name: config-data readOnly: true @@ -520,9 +502,6 @@ spec: readOnly: true subPath: tls-ca-bundle.pem volumes: - - name: etc-machine-id - hostPath: - path: /etc/machine-id - name: scripts secret: secretName: manila-scripts