Remove kolla entrypoint pattern, harden SecurityContext by stuggi · Pull Request #623 · openstack-k8s-operators/manila-operator

stuggi · 2026-08-06T11:50:08Z

Remove kolla_start / kolla config.json / KOLLA_CONFIG_STRATEGY from all manila workloads (API, scheduler, share, dbsync job, cronjob). Each service binary is now launched directly:

manila-api: /usr/sbin/httpd -DFOREGROUND
manila-scheduler: /usr/bin/manila-scheduler --config-dir ...
manila-share: /usr/bin/manila-share --config-dir ...

Config files (httpd.conf, 10-manila_wsgi.conf) are mounted directly via SubPath from the config-data secret instead of being copied by kolla at startup. The deleted kolla config.json templates and the ssl.conf common template reference are no longer needed.

Harden the security posture:

Replace inline SecurityContext with pod.RestrictivePodSecurityContext and pod.RestrictiveSecurityContext from lib-common (using serviceuser.ManilaUID / serviceuser.ApacheGID).
Add AutomountServiceAccountToken: ptr.To(false) to all workload PodSpecs (API statefulset, scheduler statefulset, share statefulset, dbsync job, db-purge cronjob).
Change secret DefaultMode from 0644/0640 to 0440 across all volume definitions using a package-level configMode variable.
Switch SCC requirement from anyuid to hostmount-anyuid + nonroot-v2.

Adopt lib-common volume helpers:

Replace inline emptyDir volumes/mounts for run-httpd, var-log-httpd, and logs with volume.WritableDirVolume / volume.WritableDirVolumeMount from lib-common/modules/common/volume.
Remove GetConfigSecretVolumes (replaced by volume.ConfigSecretVolumes in lib-common).
Fix run-httpd mount path from /etc/httpd/run to the canonical /run/httpd (matching lib-common's volume.RunHttpdMountPath constant).

Update httpd.conf to run as manila:manila (not apache:apache) since containers no longer start as root.

Remove ManilaUserID / ManilaGroupID constants (replaced by serviceuser.ManilaUID from lib-common).

Update MTLS volume mounts to use explicit cert/key mount paths instead of nil (matching the infra-operator API change).

Update kuttl and functional tests to match the new volume counts, mount paths, commands, and security context.

Jira: OSPRH-33504
Jira: OSPRH-33503

Depends-On: openstack-k8s-operators/lib-common#728

centosinfra-prod-github-app · 2026-08-06T13:53:25Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/c44954c1b0a148549b08c72d3e472e56

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 58m 19s
❌ manila-operator-kuttl FAILURE in 54m 02s
✔️ manila-operator-tempest SUCCESS in 1h 37m 38s

centosinfra-prod-github-app · 2026-08-07T13:03:54Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/9d2db3f066104e4b81c9a6c82fd6ed23

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 12m 47s
❌ manila-operator-kuttl FAILURE in 52m 22s
❌ manila-operator-tempest RETRY_LIMIT in 5m 31s

centosinfra-prod-github-app · 2026-08-07T15:48:06Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/d8c3c2fd11504367ae7bd8a5d822bd31

❌ openstack-k8s-operators-content-provider FAILURE in 12m 35s
⚠️ manila-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ manila-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

stuggi · 2026-08-07T15:51:58Z

/test functional

stuggi · 2026-08-07T15:52:03Z

recheck

centosinfra-prod-github-app · 2026-08-11T15:22:57Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/860f17e3ceea4a8a9cb3e1c8d8d8a30e

❌ openstack-k8s-operators-content-provider FAILURE in 11m 16s
⚠️ manila-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ manila-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

stuggi · 2026-08-11T15:35:05Z

recheck

centosinfra-prod-github-app · 2026-08-12T17:09:45Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/acd0c88cc2f04b5b8becada4bcf46a22

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 51m 50s
✔️ manila-operator-kuttl SUCCESS in 51m 17s
❌ manila-operator-tempest FAILURE in 1h 25m 50s

stuggi · 2026-08-12T20:50:05Z

recheck

centosinfra-prod-github-app · 2026-08-12T20:57:55Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/6f2ad2f9a43b4a6f972b8ff6165dbc3d

❌ openstack-k8s-operators-content-provider FAILURE in 5m 56s
⚠️ manila-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ manila-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

stuggi · 2026-08-13T06:49:36Z

recheck

centosinfra-prod-github-app · 2026-08-13T10:37:32Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/02e578a2723a44d68cdf17f6f1656008

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 46m 41s
❌ manila-operator-kuttl POST_FAILURE in 22m 17s
✔️ manila-operator-tempest SUCCESS in 1h 48m 34s

stuggi · 2026-08-13T11:24:49Z

recheck

centosinfra-prod-github-app · 2026-08-13T12:53:09Z

This change depends on a change that failed to merge.

Change openstack-k8s-operators/lib-common#728 is needed.

stuggi · 2026-08-13T12:54:35Z

recheck

Remove kolla_start / kolla config.json / KOLLA_CONFIG_STRATEGY from all manila workloads (API, scheduler, share, dbsync job, cronjob). Each service binary is now launched directly: - manila-api: /usr/sbin/httpd -DFOREGROUND - manila-scheduler: /usr/bin/manila-scheduler --config-dir ... - manila-share: /usr/bin/manila-share --config-dir ... Config files (httpd.conf, 10-manila_wsgi.conf) are mounted directly via SubPath from the config-data secret instead of being copied by kolla at startup. The deleted kolla config.json templates and the ssl.conf common template reference are no longer needed. Harden the security posture: - Replace inline SecurityContext with pod.RestrictivePodSecurityContext and pod.RestrictiveSecurityContext from lib-common (using user.ManilaUID / user.ApacheGID). - Add AutomountServiceAccountToken: ptr.To(false) to all workload PodSpecs (API statefulset, scheduler statefulset, share statefulset, dbsync job, db-purge cronjob). - Change secret DefaultMode from 0644/0640 to 0440 across all volume definitions using a package-level configMode variable. - Switch SCC requirement from anyuid to hostmount-anyuid + nonroot-v2. Adopt lib-common volume helpers: - Replace inline emptyDir volumes/mounts for run-httpd, var-log-httpd, and logs with volume.WritableDirVolume / volume.WritableDirVolumeMount from lib-common/modules/common/volume. - Remove GetConfigSecretVolumes (replaced by volume.ConfigSecretVolumes in lib-common). - Fix run-httpd mount path from /etc/httpd/run to the canonical /run/httpd (matching lib-common's volume.RunHttpdMountPath constant). Update httpd.conf to run as manila:manila (not apache:apache) since containers no longer start as root. Remove ManilaUserID / ManilaGroupID constants (replaced by user.ManilaUID from lib-common). Update MTLS volume mounts to use explicit cert/key mount paths instead of nil (matching the infra-operator API change). Update kuttl and functional tests to match the new volume counts, mount paths, commands, and security context. Jira: OSPRH-33504 Jira: OSPRH-33503 Depends-On: openstack-k8s-operators/lib-common#728 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Martin Schuppert <mschuppert@redhat.com>

stuggi · 2026-08-17T09:18:19Z

@fmount wondering if we need hostmount-anyuid for manila, like do we need to support hostpath here.

stuggi · 2026-08-17T09:25:57Z

/test functional

stuggi · 2026-08-17T10:01:57Z

@fmount wondering if we need hostmount-anyuid for manila, like do we need to support hostpath here.
I think I was wrong on nfs vol source works with nonroot-v2 in the glance PR:

oc get scc
NAME                              PRIV    CAPS                   SELINUX     RUNASUSER          FSGROUP     SUPGROUP    PRIORITY     READONLYROOTFS   VOLUMES
anyuid                            false   <no value>             MustRunAs   RunAsAny           RunAsAny    RunAsAny    10           false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
hostaccess                        false   <no value>             MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","hostPath","image","persistentVolumeClaim","projected","secret"]
hostmount-anyuid                  false   <no value>             MustRunAs   RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","hostPath","image","nfs","persistentVolumeClaim","projected","secret"]
hostmount-anyuid-v2               false   <no value>             RunAsAny    RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","hostPath","image","nfs","persistentVolumeClaim","projected","secret"]
hostnetwork                       false   <no value>             MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
hostnetwork-v2                    false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
hostpath-provisioner              true    <no value>             RunAsAny    RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["*"]
machine-api-termination-handler   false   <no value>             MustRunAs   RunAsAny           MustRunAs   MustRunAs   <no value>   false            ["downwardAPI","hostPath"]
nested-container                  false   ["SETUID","SETGID"]    MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
nonroot                           false   <no value>             MustRunAs   MustRunAsNonRoot   RunAsAny    RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
nonroot-v2                        false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsNonRoot   RunAsAny    RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
privileged                        true    ["*"]                  RunAsAny    RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["*"]
restricted                        false   <no value>             MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
restricted-v2                     false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
restricted-v3                     false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]

stuggi · 2026-08-17T10:21:47Z

@fmount wondering if we need hostmount-anyuid for manila, like do we need to support hostpath here.
I think I was wrong on nfs vol source works with nonroot-v2 in the glance PR:

oc get scc
NAME                              PRIV    CAPS                   SELINUX     RUNASUSER          FSGROUP     SUPGROUP    PRIORITY     READONLYROOTFS   VOLUMES
anyuid                            false   <no value>             MustRunAs   RunAsAny           RunAsAny    RunAsAny    10           false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
hostaccess                        false   <no value>             MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","hostPath","image","persistentVolumeClaim","projected","secret"]
hostmount-anyuid                  false   <no value>             MustRunAs   RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","hostPath","image","nfs","persistentVolumeClaim","projected","secret"]
hostmount-anyuid-v2               false   <no value>             RunAsAny    RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","hostPath","image","nfs","persistentVolumeClaim","projected","secret"]
hostnetwork                       false   <no value>             MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
hostnetwork-v2                    false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
hostpath-provisioner              true    <no value>             RunAsAny    RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["*"]
machine-api-termination-handler   false   <no value>             MustRunAs   RunAsAny           MustRunAs   MustRunAs   <no value>   false            ["downwardAPI","hostPath"]
nested-container                  false   ["SETUID","SETGID"]    MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
nonroot                           false   <no value>             MustRunAs   MustRunAsNonRoot   RunAsAny    RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
nonroot-v2                        false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsNonRoot   RunAsAny    RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
privileged                        true    ["*"]                  RunAsAny    RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["*"]
restricted                        false   <no value>             MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
restricted-v2                     false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]
restricted-v3                     false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","csi","downwardAPI","emptyDir","ephemeral","image","persistentVolumeClaim","projected","secret"]

oh man I am mixing things with so many PRs :) we already have hostmount-anyuid

fmount

/lgtm

openshift-ci · 2026-08-19T14:12:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fmount, stuggi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [fmount,stuggi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

stuggi added the do-not-merge/hold label Aug 6, 2026

openshift-ci Bot requested review from fmount and gouthampacha August 6, 2026 11:50

openshift-ci Bot added the approved label Aug 6, 2026

stuggi force-pushed the remove-kolla branch from 1adf275 to b29645b Compare August 7, 2026 11:49

stuggi force-pushed the remove-kolla branch 2 times, most recently from 3cc887e to 87326dc Compare August 7, 2026 15:33

stuggi force-pushed the remove-kolla branch 2 times, most recently from 359177f to 8516b49 Compare August 11, 2026 15:04

stuggi force-pushed the remove-kolla branch from 8516b49 to ab14804 Compare August 12, 2026 15:16

stuggi force-pushed the remove-kolla branch from ab14804 to 8f3dd3a Compare August 14, 2026 07:36

openshift-ci Bot added the needs-rebase label Aug 15, 2026

stuggi force-pushed the remove-kolla branch from 8f3dd3a to bf3382c Compare August 17, 2026 09:15

openshift-ci Bot removed the needs-rebase label Aug 17, 2026

stuggi removed the do-not-merge/hold label Aug 19, 2026

fmount approved these changes Aug 19, 2026

View reviewed changes

openshift-ci Bot assigned fmount Aug 19, 2026

openshift-ci Bot added the lgtm label Aug 19, 2026

openshift-merge-bot Bot merged commit 54e418a into openstack-k8s-operators:main Aug 19, 2026
8 checks passed

Uh oh!

Conversation

stuggi commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

centosinfra-prod-github-app Bot commented Aug 6, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 7, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 7, 2026

Uh oh!

stuggi commented Aug 7, 2026

Uh oh!

stuggi commented Aug 7, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 11, 2026

Uh oh!

stuggi commented Aug 11, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 12, 2026

Uh oh!

stuggi commented Aug 12, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 12, 2026

Uh oh!

stuggi commented Aug 13, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 13, 2026

Uh oh!

stuggi commented Aug 13, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 13, 2026

Uh oh!

stuggi commented Aug 13, 2026

Uh oh!

stuggi commented Aug 17, 2026

Uh oh!

stuggi commented Aug 17, 2026

Uh oh!

stuggi commented Aug 17, 2026

Uh oh!

stuggi commented Aug 17, 2026

Uh oh!

fmount left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

stuggi commented Aug 6, 2026 •

edited

Loading