ROX-8825 - Add Local Scanner Operator API to SecuredCluster CRD by SimonBaeumer · Pull Request #691 · stackrox/stackrox

SimonBaeumer · 2022-02-19T14:29:38Z

Description

Scanner Deployments
Operator UI
Scanner Password DB Reconciler
Image Overrides with RELATED_ env variables

Depended PRs

ROX-9589 - Remove scanner slim prefixes #820

Specification

The reconciler should be able to:

Custom resource API: extend schema of SecuredCluster CRD spec with fields for local scanner.
Install scanner.
By default scanner should be installed in a namespace without central.
Scanner should not be deployed in the same namespace as Central
If central is already installed in the same namespace, do not install scanner.
The operator should be able to generate a secret that contains the scanner database password.

Checklist

Investigated and inspected CI test results
Unit test and regression tests added
Evaluated and added CHANGELOG entry if required
Determined and documented upgrade steps

If any of these don't apply, please comment below.

TODO

Check CRD documentation
Add Scanner DB password reconciler
Test OpenShift Operator UI
Remove Enabled scanenrComponent option in favour of AutoSense
Protect translation logic by feature flag

Testing Performed

Test installation
Test upgrades
Test uninstall
Operator reconciles scanner-db-password if scanner is enabled
Operator does not install Scanner when
- in Kubernetes clusters
- in same namespace with Central
Deployment in different namespace than Central works

Scanner spec

apiVersion: platform.stackrox.io/v1alpha1
kind: SecuredCluster
metadata:
  namespace: openshift-operators
  name: stackrox-secured-cluster-services
spec:
  clusterName: my-cluster
  auditLogs:
    collection: Auto
  admissionControl:
    [...]
  scanner:
    analyzer:
      scaling:
        autoScaling: AutoSense
        maxReplicas: 5
        minReplicas: 2
        replicas: 3
        resources: [...]
        nodeSelector: [...]
        tolerations: [...]
    scannerComponent: AutoSense
    db:
      resources: [...]
      nodeSelector: [...]
      tolerations: [...]

ghost · 2022-02-19T14:48:42Z

Tag for build #287400 is 3.69.x-55-gaf9511040c.

💻 For deploying this image using the dev scripts, run the following first:

export MAIN_IMAGE_TAG='3.69.x-55-gaf9511040c'

📦 You can also generate an installation bundle with:

docker run -i --rm stackrox/main:3.69.x-55-gaf9511040c central generate interactive > bundle.zip

🕹️ A roxctl binary artifact can be downloaded from CircleCI.

operator/apis/platform/v1alpha1/central_types.go

operator/apis/platform/v1alpha1/securedcluster_types.go

operator/apis/platform/v1alpha1/common_types.go

operator/apis/platform/v1alpha1/securedcluster_types.go

operator/pkg/central/reconciler/securedcluster_watch.go

operator/pkg/securedcluster/extensions/reconcile_scanner.go

operator/pkg/securedcluster/reconciler/central_watch.go

operator/pkg/securedcluster/scanner/auto_sense.go

juanrh · 2022-03-07T17:53:50Z

operator/pkg/securedcluster/values/translation/image_overrides.go

+		images.Scanner:       "image.scanner.fullRef",
+		images.ScannerDB:     "image.scannerDb.fullRef",


Please check that this is on sync with https://github.com/stackrox/stackrox/blob/porridge/ROX-9524/operator/pkg/securedcluster/values/translation/image_overrides.go

Rebased after @porridge's PR was merged

Revert the changes the merged PR was broken, it should not be scanner slim because these are implementation details.
The Secured Cluster chart does not differentiate from the outside for them, thus we can add the overrides directly.

porridge

Mostly nitpicks but there's also one or two more important things.

CHANGELOG.md

operator/apis/platform/v1alpha1/central_types.go

operator/apis/platform/v1alpha1/securedcluster_types.go

operator/pkg/securedcluster/scanner/auto_sense_test.go

operator/pkg/securedcluster/values/translation/translation.go

operator/pkg/securedcluster/values/translation/translation_test.go

operator/pkg/utils/testutils/client.go

juanrh · 2022-03-08T09:43:08Z

To answer your first question, @juanrh this is a separate comment block in order to prevent tools from copying it into any user-facing documentation.

Thanks for the clarification @porridge !

…-visible

porridge · 2022-03-09T08:53:14Z

I just:

squashed all changes so far into one commit (to make the next step easier)
rebased on tip of master, noting the warning from Connor about required postgres tests
added a few changes to address remaining review comments and fix the build/tests, most notably:
removed the mention from changelog, since this is still feature-gated and thus not user visible (and IMO not really changelog-worthy according to our definition of what the changelog should contain)
restored separate env var for scanner-slim images (I don't see how a single var could work for two different images 🤔 )
stripped remaining mentions of "local" in user-visible places
guarded against a nil pointer panic in autosense function and extracted the now-common code
updated autogenerated code and manifests

@juanrh PTAL

juanrh

Looks good to me in general, but I'd like to clarify something about the image overrides

operator/pkg/securedcluster/values/translation/image_overrides.go

msugakov · 2022-03-09T11:33:22Z

What makes me confused is that this PR #691 is targeted for 3.69.1 patch-release but PR #836 is targeted for 3.69.0 release. Would 3.69.0 still function ok without this change or is it a mistake and the milestone should be 69.0-rc.*?
Related Slack thread https://srox.slack.com/archives/C02TWBJ63DX/p1646825532918719

porridge · 2022-03-09T15:52:15Z

What makes me confused is that this PR #691 is targeted for 3.69.1 patch-release but PR #836 is targeted for 3.69.0 release. Would 3.69.0 still function ok without this change or is it a mistake and the milestone should be 69.0-rc.*?

I think #836 by itself is a no-op, @msugakov

#691) Co-authored-by: Marcin Owsiany <porridge@redhat.com> (cherry picked from commit bfcbf99)

#691) Co-authored-by: Marcin Owsiany <porridge@redhat.com>

github-actions bot added the area/operator label Feb 19, 2022

SimonBaeumer force-pushed the sb/rox-8825-operator-api branch 3 times, most recently from f1fbca3 to 4d26253 Compare March 1, 2022 08:16

SimonBaeumer added the ci-openshift-4-operator-tests label Mar 1, 2022

SimonBaeumer force-pushed the sb/rox-8825-operator-api branch 2 times, most recently from d304bd4 to b6dd799 Compare March 4, 2022 14:19

github-actions bot added area/helm area/sensor labels Mar 4, 2022

SimonBaeumer changed the base branch from master to sb/rox-9589-remove-scanner-slim-prefixes March 4, 2022 15:30

github-actions bot removed area/sensor area/helm labels Mar 6, 2022

SimonBaeumer changed the title ~~ROX-8825 - Operator API~~ ROX-8825 - Local Scanner Operator API Mar 7, 2022

SimonBaeumer requested review from RTann, juanrh and porridge March 7, 2022 10:10

SimonBaeumer marked this pull request as ready for review March 7, 2022 10:10

SimonBaeumer changed the title ~~ROX-8825 - Local Scanner Operator API~~ ROX-8825 - Add Local Scanner Operator API to SecuredCluster CRD Mar 7, 2022

Base automatically changed from sb/rox-9589-remove-scanner-slim-prefixes to master March 7, 2022 10:24

SimonBaeumer force-pushed the sb/rox-8825-operator-api branch 2 times, most recently from 11568a0 to d9f3d01 Compare March 7, 2022 10:25

SimonBaeumer added this to the 69.0-rc.2 milestone Mar 7, 2022

SimonBaeumer force-pushed the sb/rox-8825-operator-api branch from c5543ae to fe488b3 Compare March 7, 2022 14:58

juanrh reviewed Mar 7, 2022

View reviewed changes

operator/apis/platform/v1alpha1/central_types.go Outdated Show resolved Hide resolved

RTann reviewed Mar 7, 2022

View reviewed changes

operator/apis/platform/v1alpha1/central_types.go Outdated Show resolved Hide resolved

operator/apis/platform/v1alpha1/securedcluster_types.go Outdated Show resolved Hide resolved

juanrh suggested changes Mar 7, 2022

View reviewed changes

porridge mentioned this pull request Mar 8, 2022

ROX-8825: local scanner operator API #277

Closed

4 tasks

SimonBaeumer force-pushed the sb/rox-8825-operator-api branch from da101bd to fa70404 Compare March 8, 2022 09:16

porridge requested changes Mar 8, 2022

View reviewed changes

SimonBaeumer modified the milestones: 69.0-rc.2, 68.2-rc.1, 69.1-rc.1 Mar 8, 2022

SimonBaeumer requested review from RTann, juanrh and porridge March 8, 2022 14:46

SimonBaeumer and others added 6 commits March 9, 2022 08:21

Operator support for local scanner

194d828

restore separate env var for scanner slim images

0579f33

Strip remaining user-visible "local" from scanner.

1d91d82

make generate manifests bundle bundle-build

7718d36

removing changelog note since this is still feature-gated so not user…

af3a5ef

…-visible

guard against nil pointer panic and extract some common code

a82fbda

porridge force-pushed the sb/rox-8825-operator-api branch from afed0b5 to a82fbda Compare March 9, 2022 08:46

github-actions bot added the area/helm label Mar 9, 2022

fix helm test which looks for error message

af95110

juanrh suggested changes Mar 9, 2022

View reviewed changes

operator/pkg/securedcluster/values/translation/image_overrides.go Show resolved Hide resolved

juanrh approved these changes Mar 9, 2022

View reviewed changes

porridge approved these changes Mar 9, 2022

View reviewed changes

porridge merged commit bfcbf99 into master Mar 9, 2022

porridge deleted the sb/rox-8825-operator-api branch March 9, 2022 15:48

parametalol modified the milestones: 69.1-rc.1, 69.0-rc.2 Mar 9, 2022

RTann pushed a commit that referenced this pull request Mar 9, 2022

ROX-8825 - Add Operator support for Local Scanner in SecuredCluster CR (

a565227

#691) Co-authored-by: Marcin Owsiany <porridge@redhat.com> (cherry picked from commit bfcbf99)

RTann pushed a commit that referenced this pull request Apr 6, 2022

ROX-8825 - Add Operator support for Local Scanner in SecuredCluster CR (

b2f3ee1

#691) Co-authored-by: Marcin Owsiany <porridge@redhat.com>

		images.Scanner: "image.scanner.fullRef",
		images.ScannerDB: "image.scannerDb.fullRef",

Conversation

SimonBaeumer commented Feb 19, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Depended PRs

Specification

Checklist

TODO

Testing Performed

Scanner spec

Uh oh!

ghost commented Feb 19, 2022 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

juanrh Mar 7, 2022

Choose a reason for hiding this comment

Uh oh!

SimonBaeumer Mar 8, 2022

Choose a reason for hiding this comment

Uh oh!

SimonBaeumer Mar 8, 2022

Choose a reason for hiding this comment

Uh oh!

porridge left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

juanrh commented Mar 8, 2022

Uh oh!

porridge commented Mar 9, 2022

Uh oh!

juanrh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msugakov commented Mar 9, 2022

Uh oh!

porridge commented Mar 9, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

SimonBaeumer commented Feb 19, 2022 •

edited

Loading

ghost commented Feb 19, 2022 •

edited by ghost

Loading