Skip to content

Add restrictive security context to registry pod and init containers #7040

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kaovilai wants to merge 2 commits into
base: master
Choose a base branch
from
+19 −2
Open

Add restrictive security context to registry pod and init containers #7040

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7af34db
Add restrictive security context to registry pod and init containers
kaovilai Jan 16, 2026
e9a876b
Add changelog fragment for init container security context fix
kaovilai Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions changelog/fragments/fix-fbc-init-container-security-context.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# entries is a list of entries to include in
# release notes and/or the migration guide
entries:
- description: >
Fixed `operator-sdk run bundle` with `--security-context-config=restricted` to apply
the restricted security context to init containers (`registry-grpc-init`), not just
the main container. This resolves PodSecurity violations on clusters with
`restricted` policy enforcement.
kind: bugfix
breaking: false
11 changes: 9 additions & 2 deletions internal/olm/operator/registry/fbcindex/fbc_registry_pod.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,15 +148,22 @@ func (f *FBCRegistryPod) Create(ctx context.Context, cfg *operator.Configuration
},
}

// Update the Registry Pod container security context to be restrictive
f.pod.Spec.Containers[0].SecurityContext = &corev1.SecurityContext{
restrictedSecurityContext := &corev1.SecurityContext{
Privileged: pointer.To(false),
ReadOnlyRootFilesystem: pointer.To(false),
AllowPrivilegeEscalation: pointer.To(false),
Capabilities: &corev1.Capabilities{
Drop: []corev1.Capability{"ALL"},
},
}

// Update the Registry Pod container security context to be restrictive
f.pod.Spec.Containers[0].SecurityContext = restrictedSecurityContext

// Update all init containers with the same restrictive security context
for i := range f.pod.Spec.InitContainers {
f.pod.Spec.InitContainers[i].SecurityContext = restrictedSecurityContext
}
Comment on lines +163 to +166
Copy link

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new functionality that applies the restrictive security context to init containers lacks test coverage. The test file fbc_registry_pod_test.go has comprehensive tests for other functionality but does not verify that init containers receive the security context when SecurityContext is set to 'restricted'. Consider adding a test case that creates an FBCRegistryPod with SecurityContext: 'restricted' and verifies that both the main container and init containers have the expected security context settings.

Copilot uses AI. Check for mistakes.
}

if f.ImagePullPolicy == "" {
Expand Down
Loading