search

openshift-metal3 / dev-scripts

Scripts to automate development/test setup for openshift integration with https://github.com/metal3-io/
Apache License 2.0
93 stars 185 forks source link

Stop running auxiliary containers with maximum priveleges #1606

Open dtantsur opened 9 months ago

dtantsur commented 9 months ago

None of the Metal3 components actually require --privileged. Instead, disable the SELinux isolation to allow the containers to mount host directories.

Also don't expose sushy-tools and vbmc to the host networking.

openshift-ci[bot] commented 9 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please ask for approval from dtantsur. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/openshift-metal3/dev-scripts/blob/master/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
elfosardo commented 9 months ago

/retest

dtantsur commented 9 months ago

/retest

openshift-ci[bot] commented 9 months ago

@dtantsur: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-metal-ipi-ovn-dualstack 819abffc085c5c0a2417eed2d0da6782f6c4082d link false /test e2e-metal-ipi-ovn-dualstack
ci/prow/e2e-metal-ipi-ovn-ipv6 819abffc085c5c0a2417eed2d0da6782f6c4082d link true /test e2e-metal-ipi-ovn-ipv6
ci/prow/e2e-metal-ipi-bm-bond 819abffc085c5c0a2417eed2d0da6782f6c4082d link false /test e2e-metal-ipi-bm-bond
ci/prow/e2e-metal-ipi-serial-ipv4 819abffc085c5c0a2417eed2d0da6782f6c4082d link true /test e2e-metal-ipi-serial-ipv4
ci/prow/e2e-metal-ipi-serial-ovn-ipv6 819abffc085c5c0a2417eed2d0da6782f6c4082d link false /test e2e-metal-ipi-serial-ovn-ipv6

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).