Feat/add scc howto#797
Merged
Merged
Conversation
Contributor
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughAdds a how‑to for OpenShift-style SecurityContextConstraints on Kubernetes: CRD, 13 example SCC profiles, Kyverno enforcement with caching and RBAC reader binding, mutating/validating policies, rollout/verification steps, binding workflows, troubleshooting, and reference material. ChangesSCC Implementation Guide
Sequence DiagramsequenceDiagram
participant Pod as PodAdmissionRequest
participant Kyverno as Kyverno (mutating/validating policies)
participant Caches as GlobalContextEntry caches (SCC, RBAC lookups)
participant K8sAPI as Kubernetes API (CRD & RBAC)
Pod->>Kyverno: admission request (create/update Pod)
Kyverno->>Caches: query SCC and RBAC caches
Caches->>K8sAPI: fetch CRD/RBAC objects as needed
K8sAPI->>Caches: return SCC/Role/Binding results
Caches->>Kyverno: resolved SCCs & access grants
Kyverno->>Kyverno: apply scc-fill-defaults (mutate) / evaluate scc-auto-pick (validate)
Kyverno->>Pod: admit (with alauda.io/scc) or deny
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@docs/en/security/security_and_compliance/compliance/howto/security_context_constraints.md`:
- Around line 1162-1168: The prose describing skipped namespaces is out of sync
with the policy expression that checks request.namespace (e.g.,
request.namespace.startsWith('kube-'), request.namespace.startsWith('cpaas-'),
request.namespace.startsWith('alauda-'), request.namespace == 'kyverno',
request.namespace == 'cattle-system', request.namespace == 'operators',
request.namespace == 'default'); reconcile them by either updating the
human-readable paragraph to list all skipped namespaces/prefixes (kube-*,
cpaas-*, alauda-*, kyverno, cattle-system, operators, default) or by removing
the extra checks (cpaas-*, alauda-*, operators) from the policy expression so
the prose and the policy match; pick the intended behavior and make the
corresponding change in the explanatory text or the policy expression.
- Around line 742-744: The doc incorrectly implies pods will pick the most
restrictive SCC, but the current example and values (anyuid with priority: 10,
restrictiveScore: 60 and restricted-v2) cause selection to favor priority over
restrictiveness; update the text in Step 2.2 and any referenced examples
(mentions of anyuid, restricted-v2, priority, restrictiveScore) to either (a)
change the numeric priority/restrictiveScore values so the example demonstrates
the “most restrictive acceptable” outcome, or (b) explicitly state that priority
takes precedence over restrictiveScore and adjust the narrative and example to
reflect that behavior.
- Around line 2004-2005: The sentence about ClusterRoleBinding is misleading:
change the wording so it states that a ClusterRoleBinding binds a single
namespaced ServiceAccount subject (formatted as
system:serviceaccount:<namespace>:<name>) and grants that ServiceAccount
cluster-wide permissions; replace "cover the ServiceAccount across all
namespaces" with a phrase like "grant a ServiceAccount cluster-wide permissions"
and add a short clarifying note contrasting this with a namespaced RoleBinding.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: bf8cf3d0-2b79-4af0-8ef6-17ec63992e45
📒 Files selected for processing (1)
docs/en/security/security_and_compliance/compliance/howto/security_context_constraints.md
Deploying alauda-container-platform with
|
| Latest commit: |
6e963e2
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://21ce129f.alauda-container-platform.pages.dev |
| Branch Preview URL: | https://feat-add-scc-howto.alauda-container-platform.pages.dev |
mysekai7
force-pushed
the
feat/add_scc_howto
branch
from
c75334d to
c54e9f5
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@docs/en/security/security_and_compliance/compliance/howto/security_context_constraints.md`:
- Line 1937: The example text stating the image "runs as root (UID 999)" is
incorrect; update the sentence referencing the ServiceAccount
`databases/postgres-sa` so it correctly states the image runs as root with UID 0
(e.g., change "runs as root (UID 999)" to "runs as root (UID 0)") to avoid
misleading SCC selection guidance.
- Line 965: Update the sentence that says "You should see all 13 profiles listed
with their `Priority`, `Score`, and `PSA` columns populated" because the CRD
shown in this document does not define a `PSA` printerColumn; either remove
`PSA` from the expected columns in that `kubectl get scc` verification text or
explicitly add guidance to modify the CRD to include a `PSA` printerColumn.
Refer to the `kubectl get scc` expectation and the CRD definition in the doc
when making the change (adjust the verification text or the CRD's printerColumns
accordingly).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8c073c45-cbad-4a00-a9fb-050396dba7a0
📒 Files selected for processing (1)
docs/en/security/security_and_compliance/compliance/howto/security_context_constraints.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit