Drop privileged SCC from RBAC grants

config/rbac/role.yaml

@@ -177,7 +177,6 @@ rules:
   - security.openshift.io
   resourceNames:
   - anyuid
-  - privileged
   resources:
   - securitycontextconstraints
   verbs:
@@ -191,18 +190,3 @@ rules:
   - list
   - update
   - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: manager-role
-  namespace: openstack
-rules:
-- apiGroups:
-  - security.openshift.io
-  resourceNames:
-  - privileged
-  resources:
-  - securitycontextconstraints
-  verbs:
-  - use

internal/controller/manila_controller.go

@@ -120,7 +120,7 @@ func (r *ManilaReconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged,resources=securitycontextconstraints,verbs=use
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
 
 // Reconcile -
@@ -551,7 +551,7 @@ func (r *ManilaReconciler) reconcileNormal(ctx context.Context, instance *manila
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid", "privileged"},
+			ResourceNames: []string{"anyuid"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},

internal/controller/manilashare_controller.go

@@ -90,7 +90,6 @@ func (r *ManilaShareReconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;
 // +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;create;update;patch;delete;watch
-// +kubebuilder:rbac:groups=security.openshift.io,namespace=openstack,resources=securitycontextconstraints,resourceNames=privileged,verbs=use
 // +kubebuilder:rbac:groups=k8s.cni.cncf.io,resources=network-attachment-definitions,verbs=get;list;watch
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
 

internal/manila/funcs.go

@@ -40,9 +40,6 @@ func manilaDefaultSecurityContext() *corev1.SecurityContext {
 				"ALL",
 			},
 		},
-		SeccompProfile: &corev1.SeccompProfile{
-			Type: corev1.SeccompProfileTypeRuntimeDefault,
-		},
 	}
 }
 

internal/manila/volumes.go

@@ -14,14 +14,6 @@ func GetVolumes(name string, extraVol []manilav1.ManilaExtraVolMounts, svc []sto
 	var config0644AccessMode int32 = 0644
 
 	res := []corev1.Volume{
-		{
-			Name: "etc-machine-id",
-			VolumeSource: corev1.VolumeSource{
-				HostPath: &corev1.HostPathVolumeSource{
-					Path: "/etc/machine-id",
-				},
-			},
-		},
 		{
 			Name: "scripts",
 			VolumeSource: corev1.VolumeSource{
@@ -60,11 +52,6 @@ func GetVolumes(name string, extraVol []manilav1.ManilaExtraVolMounts, svc []sto
 // GetVolumeMounts - Nova Control Plane VolumeMounts
 func GetVolumeMounts(extraVol []manilav1.ManilaExtraVolMounts, svc []storage.PropagationType) []corev1.VolumeMount {
 	res := []corev1.VolumeMount{
-		{
-			Name:      "etc-machine-id",
-			MountPath: "/etc/machine-id",
-			ReadOnly:  true,
-		},
 		{
 			Name:      "config-data",
 			MountPath: "/var/lib/config-data/default",

test/functional/manila_controller_test.go

@@ -677,7 +677,7 @@ var _ = Describe("Manila controller", func() {
 			// Check the resulting deployment fieldsq
 			Expect(int(*d.Spec.Replicas)).To(Equal(1))
 
-			Expect(d.Spec.Template.Spec.Volumes).To(HaveLen(8))
+			Expect(d.Spec.Template.Spec.Volumes).To(HaveLen(7))
 			Expect(d.Spec.Template.Spec.Containers).To(HaveLen(2))
 
 			// cert deployment volumes
@@ -1268,13 +1268,13 @@ var _ = Describe("Manila controller", func() {
 			ss := th.GetStatefulSet(share)
 			// Check the resulting deployment fields
 			Expect(int(*ss.Spec.Replicas)).To(Equal(1))
-			Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(5))
+			Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4))
 			Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2))
 			// Get the manila-share container
 			container := ss.Spec.Template.Spec.Containers[1]
 			// Fail if manila-share doesn't have the right number of
 			// VolumeMounts entries
-			Expect(container.VolumeMounts).To(HaveLen(7))
+			Expect(container.VolumeMounts).To(HaveLen(6))
 			// Inspect VolumeMounts and make sure we have the Ceph MountPath
 			// provided through extraMounts
 			th.AssertVolumeMountPathExists(ManilaCephExtraMountsSecretName,

test/functional/manilaapi_controller_test.go

@@ -135,11 +135,11 @@ var _ = Describe("ManilaAPI controller", func() {
 				ss := th.GetStatefulSet(manilaTest.ManilaAPI)
 				// Check the resulting deployment fields
 				Expect(int(*ss.Spec.Replicas)).To(Equal(1))
-				Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(5))
+				Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4))
 				Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2))
 
 				container := ss.Spec.Template.Spec.Containers[1]
-				Expect(container.VolumeMounts).To(HaveLen(7))
+				Expect(container.VolumeMounts).To(HaveLen(6))
 				Expect(container.Image).To(Equal(manilaTest.ContainerImage))
 				Expect(container.LivenessProbe.HTTPGet.Port.IntVal).To(Equal(int32(8786)))
 				Expect(container.ReadinessProbe.HTTPGet.Port.IntVal).To(Equal(int32(8786)))

test/functional/manilascheduler_controller_test.go

@@ -136,11 +136,11 @@ var _ = Describe("ManilaScheduler controller", func() {
 				ss := th.GetStatefulSet(manilaTest.ManilaScheduler)
 				// Check the resulting deployment fields
 				Expect(int(*ss.Spec.Replicas)).To(Equal(1))
-				Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4))
+				Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(3))
 				Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2))
 
 				container := ss.Spec.Template.Spec.Containers[1]
-				Expect(container.VolumeMounts).To(HaveLen(6))
+				Expect(container.VolumeMounts).To(HaveLen(5))
 				Expect(container.Image).To(Equal(manilaTest.ContainerImage))
 			})
 			It("stored the input hash in the Status", func() {

test/functional/manilashare_controller_test.go

@@ -149,11 +149,11 @@ var _ = Describe("ManilaShare controller", func() {
 					ss := th.GetStatefulSet(share)
 					// Check the resulting deployment fields
 					Expect(int(*ss.Spec.Replicas)).To(Equal(1))
-					Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4))
+					Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(3))
 					Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2))
 
 					container := ss.Spec.Template.Spec.Containers[1]
-					Expect(container.VolumeMounts).To(HaveLen(6))
+					Expect(container.VolumeMounts).To(HaveLen(5))
 					Expect(container.Image).To(Equal(manilaTest.ContainerImage))
 
 					// the input hash is stored in the current manilaShare.Status

test/kuttl/tests/manila-tls/03-assert.yaml

@@ -267,9 +267,6 @@ spec:
         command:
         - /usr/bin/dumb-init
         volumeMounts:
-        - mountPath: /etc/machine-id
-          name: etc-machine-id
-          readOnly: true
         - mountPath: /var/lib/config-data/default
           name: config-data
         - mountPath: /usr/local/bin/container-scripts
@@ -307,9 +304,6 @@ spec:
           readOnly: true
           subPath: tls.key
       volumes:
-      - name: etc-machine-id
-        hostPath:
-          path: /etc/machine-id
       - name: scripts
         secret:
           secretName: manila-scripts
@@ -362,8 +356,6 @@ spec:
         command:
         - /usr/bin/dumb-init
         volumeMounts:
-        - mountPath: /etc/machine-id
-          name: etc-machine-id
         - mountPath: /var/lib/config-data/default
           name: config-data
           readOnly: true
@@ -393,8 +385,6 @@ spec:
         - share
         - /etc/manila/manila.conf.d
         volumeMounts:
-        - mountPath: /etc/machine-id
-          name: etc-machine-id
         - mountPath: /var/lib/config-data/default
           name: config-data
           readOnly: true
@@ -420,9 +410,6 @@ spec:
           readOnly: true
           subPath: tls-ca-bundle.pem
       volumes:
-        - name: etc-machine-id
-          hostPath:
-            path: /etc/machine-id
         - name: scripts
           secret:
             secretName: manila-scripts
@@ -467,8 +454,6 @@ spec:
         command:
         - /usr/bin/dumb-init
         volumeMounts:
-        - mountPath: /etc/machine-id
-          name: etc-machine-id
         - mountPath: /var/lib/config-data/default
           name: config-data
           readOnly: true
@@ -495,9 +480,6 @@ spec:
         - scheduler
         - /etc/manila/manila.conf.d
         volumeMounts:
-        - mountPath: /etc/machine-id
-          name: etc-machine-id
-          readOnly: true
         - mountPath: /var/lib/config-data/default
           name: config-data
           readOnly: true
@@ -520,9 +502,6 @@ spec:
           readOnly: true
           subPath: tls-ca-bundle.pem
       volumes:
-        - name: etc-machine-id
-          hostPath:
-            path: /etc/machine-id
         - name: scripts
           secret:
             secretName: manila-scripts