substra-backend
substra-backend copied to clipboard
Substra
chore: enforce pod security standards
Fixes FL-1453
How to test:
Deploy locally (with skaffold), and then apply labels:
kubectl label --dry-run=server --overwrite ns org-2 pod-security.kubernetes.io/enforce=baseline
or
kubectl label --dry-run=server --overwrite ns org-2 pod-security.kubernetes.io/enforce=restricted
The baseline profile should yield no warning. The restricted profile will show a few warnings, we are trying to remove.
![linear[bot] avatar](https://avatars.githubusercontent.com/in/20150?v=4 "Published by a pub.dev verified publisher"){kind=small}
End to end tests: :x: FAILURE
Jobs status:
- Camelyon: :next_track_button:
- Dispatch Jobs: :heavy_check_mark:
- Documentation: :next_track_button:
- MNIST: :next_track_button:
- SubstraFL: :next_track_button:
- SubstraSDK / sdk: :x:
“Boy, that escalated quickly.” ― Ron Burgundy, Anchorman: The Legend of Ron Burgundy
It seems to miss a permission for accessing substra namespace
Error: INSTALLATION FAILED: rendered manifests contain a resource that already exists. Unable to continue with install: could not get information about the resource Namespace "substra" in namespace "": namespaces "substra" is forbidden: User "[email protected]" cannot get resource "namespaces" in API group "" in the namespace "substra": requires one of ["container.namespaces.get"] permission(s).
It seems to miss a permission for accessing substra namespace
Error: INSTALLATION FAILED: rendered manifests contain a resource that already exists. Unable to continue with install: could not get information about the resource Namespace "substra" in namespace "": namespaces "substra" is forbidden: User "[email protected]" cannot get resource "namespaces" in API group "" in the namespace "substra": requires one of ["container.namespaces.get"] permission(s).
The namespace.yaml is just an example to test, but I'll remove it from this PR, since it's confusing.
End to end tests: :x: FAILURE
Jobs status:
- Camelyon: :next_track_button:
- Dispatch Jobs: :heavy_check_mark:
- Documentation / doc: :x:
- MNIST: :next_track_button:
- SubstraFL: :next_track_button:
- SubstraSDK / sdk: :x:
Too bad.
Are we?
1. Testing the charts in a `alpha` version before merging (once dev is available) 2. Merging then testing the charts + code in `alpha` on devI would recommend going for (1) as the code update is very minor.
I would also be in favour of 1 (and the whole thing will be tested at the next release anyway)