[sled30]

Motivation

Mutating admission webhooks (e.g. Kyverno Pod Security policies) may inject
runAsNonRoot into the pod and the Spilo container security context of the
operator-generated StatefulSet. The operator cannot emit this field: the
configuration offers spilo_runasuser / spilo_runasgroup /
spilo_fsgroup, spilo_privileged and spilo_allow_privilege_escalation -
but no runAsNonRoot knob. Therefore the desired pod template never matches
the live state, and on every resync the operator detects "pod changes" and
performs a full rolling update with a Patroni switchover:

reason: new statefulset containers's postgres (index 0) security context does not match the current one
reason: new statefulset's pod template security context in spec does not match the current one
mark rolling update annotation for banking-pg-0: reason pod changes

Newly created pods are mutated by the webhook again, so the cluster never
converges: in our environment the whole PostgreSQL cluster restarted with a
leader switchover on every resync period (30 minutes, ~48 restarts/day per
cluster). This is the same class of problem as PR #3095 (webhook-injected
sysctls) and issue #1638 (GKE Autopilot mutating resources/annotations).

Fixes #3210
Related: #3095, #1638

Change

Add a spilo_run_as_non_root operator option (OperatorConfiguration,
kubernetes section) and a spiloRunAsNonRoot cluster manifest field that
overrides the global option. When set, the operator includes runAsNonRoot
in both the pod security context (generatePodTemplate) and the Spilo
container security context (generateContainer; the logical backup container
follows the existing spilo_privileged / spilo_allow_privilege_escalation
pattern). Unset by default: runAsNonRoot is omitted from the generated pod
spec, preserving the current behavior.

Files

• pkg/util/config/config.go — SpiloRunAsNonRoot *bool (spilo_run_as_non_root)
• pkg/apis/acid.zalan.do/v1/operator_configuration_type.go — matching CRD config type
• pkg/apis/acid.zalan.do/v1/postgresql_type.go — spiloRunAsNonRoot in PostgresSpec
• pkg/apis/acid.zalan.do/v1/zz_generated.deepcopy.go — deepcopy for the new field
• manifests/postgresql.crd.yaml, manifests/operatorconfiguration.crd.yaml,
  pkg/apis/acid.zalan.do/v1/postgresql.crd.yaml,
  pkg/apis/acid.zalan.do/v1/operatorconfiguration.crd.yaml,
  charts/postgres-operator/crds/* — regenerated CRDs
• pkg/cluster/k8sres.go — emit RunAsNonRoot at pod and container level
• pkg/cluster/k8sres_test.go — TestSpiloRunAsNonRoot
• manifests/postgresql-operator-default-configuration.yaml,
  docs/reference/operator_parameters.md,
  docs/reference/cluster_manifest.md — examples and reference docs

Test

go build ./..., go vet ./pkg/cluster/ ./pkg/util/config/ and the full
./pkg/cluster/, ./pkg/util/... suites pass. New focused test:

go test ./pkg/cluster/ -run TestSpiloRunAsNonRoot -v -count=1
--- PASS: TestSpiloRunAsNonRoot (0.01s)
    --- PASS: TestSpiloRunAsNonRoot/unset_leaves_runAsNonRoot_out_of_the_pod_spec
    --- PASS: TestSpiloRunAsNonRoot/operator_option_sets_runAsNonRoot_on_pod_and_container_level
    --- PASS: TestSpiloRunAsNonRoot/cluster_manifest_overrides_the_operator_option

Scope / operations notes

• the option works in both configuration modes (ConfigMap and
  OperatorConfiguration CRD), like the other scalar spilo_* options;
• clusters already running with webhook-injected fields get one final
  rolling update after enabling the option (the generated spec changes), then
  the loop stops;
• the option covers runAsNonRoot, which is the field our enforcing policy
  injects; other webhook-injected fields (e.g. sysctls, see feat: add pod_sysctls operator config option #3095) would
  need analogous options.

[yyvess]

Good lock, I wait from 2022 to fix it on my PR :-(
#2082

[yyvess]

I try to address all security option in one new clean PR => #3224
Let see if someone have change to look on

[sled30]

I try to address all security option in one new clean PR => #3224 Let see if someone have change to look on

Thanks a lot! For now, I’ll keep the PR open-just in case something doesn’t look right.