AUTH-482: Add required-scc annotation to router

[jacobsee]

Adds the required-scc annotation to the default router (set to restricted) so that it can't be preempted by any other custom SCCs that might exist with a higher priority.

Test (flaking) showing that restricted is the correct SCC for the router: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-microshift-release-4.19-periodics-e2e-aws-ovn-ocp-conformance-optional-components-arm/1899015011318108160

Which issue(s) this PR addresses: AUTH-482

Closes #none

[openshift-ci-robot]

@jacobsee: This pull request references AUTH-482 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "4.19." or "openshift-4.19.", but it targets "openshift-4.16" instead.

In response to this:

Adds the required-scc annotation to the default router (set to restricted) so that it can't be preempted by any other custom SCCs that might exist with a higher priority.

Test (flaking) showing that restricted is the correct SCC for the router: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-microshift-release-4.19-periodics-e2e-aws-ovn-ocp-conformance-optional-components-arm/1899015011318108160

Which issue(s) this PR addresses: AUTH-482

Closes #none

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jacobsee: This pull request references AUTH-482 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "4.19." or "openshift-4.19.", but it targets "openshift-4.16" instead.

In response to this:

Adds the required-scc annotation to the default router (set to restricted) so that it can't be preempted by any other custom SCCs that might exist with a higher priority.

Test (flaking) showing that restricted is the correct SCC for the router: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-microshift-release-4.19-periodics-e2e-aws-ovn-ocp-conformance-optional-components-arm/1899015011318108160

Which issue(s) this PR addresses: AUTH-482

Closes #none

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hi @jacobsee. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[pmtk]

/ok-to-test

[kramaranya]

/lgtm

[pmtk]

Can you tell why it isn't included in the upstream file (https://github.com/openshift/cluster-ingress-operator/blob/master/pkg/manifests/assets/router/deployment.yaml#L10-L11)? It is set during runtime by the operator?

This file is copied when microshift updates its dependencies, so this change might be overwritten in few days if we merge this. If this is runtime addition, then we also need a change in rebase.sh script (see this).

I believe this should do the job:

yq '.spec.template.metadata.annotations += {"openshift.io/required-scc": "restricted"}' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml

[jacobsee]

Yes, the operator is setting it dynamically based on whether it needs host networking or not here: https://github.com/openshift/cluster-ingress-operator/blob/7dc12cf28557f8c80460435649cfc393761e0285/pkg/operator/controller/ingress/deployment.go#L1212-L1215

I don't see where Microshift has the same host networking config, so just setting it to restricted here.

I was not aware of the rebase script - made the change there. Thanks!

[pacevedom]

/hold
Holding because of #4656 (review). This change will get overwritten in the next rebase if not included in rebase.sh.

[pmtk]

/lgtm
/unhold

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jacobsee, kramaranya, pmtk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [pmtk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jacobsee: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.