Custom resource validation?

[rustam-almukhametov]

In my project I have the Notebook resource that is using jupyter notebook image and which is also being validated by connaisseur, but due to the fact that this resource is not supported in the role definition it fails with Unauthorized error. If I add it to the role, then another error occurs:

Am I doing it wrong? Is there any way to solve this issue?

[xopham]

Is the notebook based on a custom resource definition (CRD) or a completely new resource? Does it contain a pod resource which will then be started from it?
What error message do you get?

[rustam-almukhametov]

It is CRD that starts jupyter notebook session in a pod. The error I'm getting is:

[xopham]

@Augustussssss we had a similar case that was fixed: #582
could you share which version of Connaisseur you are using? And also a (redacted) version of your helm/values.yaml? would take it from there.
Note that the issue might be avoided by turning off automaticChildApproval: https://github.com/sse-secure-systems/connaisseur/blob/master/helm/values.yaml#L162
More info can be found in the docs: https://sse-secure-systems.github.io/connaisseur/v2.6.0/features/automatic_child_approval/

[rustam-almukhametov]

@xopham thank you, the issue is fixed by disabling automaticChildApproval. I'm using Connaisseur v2.5.1, values.yaml that I used previously (now I disabled automaticChildApproval and namespacedValidation):

# configure Connaisseur deployment
deployment:
  replicasCount: 1
  image: securesystemsengineering/connaisseur:v2.5.1
  imagePullPolicy: IfNotPresent
  # imagePullSecrets contains an optional list of Kubernetes Secrets, in Connaisseur namespace,
  # that are needed to access the registry containing Connaisseur image.
  # imagePullSecrets:
  # - name: "my-container-secret"
  failurePolicy: Fail  # use 'Ignore' to fail open if Connaisseur becomes unavailable
  # Use 'reinvocationPolicy: IfNeeded' to be called again as part of the admission evaluation if the object
  # being admitted is modified by other admission plugins after the initial webhook call
  # Note that if Connaisseur is invoked a second time, the policy to be applied might change in between.
  # Make sure, your Connaisseur policies are set up to handle multiple mutations of the image originally
  # specified in the manifest, e.g. my.private.registry/image:1.0.0 and my.private.registry/image@sha256:<hash-of-1.0.0-image>
  reinvocationPolicy: Never
  resources:
    limits:
      cpu: 1000m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 128Mi
  nodeSelector: {}
  tolerations: []
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - podAffinityTerm:
            labelSelector:
              matchExpressions:
                - key: app.kubernetes.io/instance
                  operator: In
                  values:
                    - connaisseur
            topologyKey: kubernetes.io/hostname
          weight: 100
  #annotations:  # uncomment when using Kubernetes prior v1.19
  #  seccomp.security.alpha.kubernetes.io/pod: runtime/default  # uncomment when using Kubernetes prior v1.19
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    privileged: false
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    runAsUser: 10001  # remove when using openshift or OKD 4
    runAsGroup: 20001  # remove when using openshift or OKD 4
    seccompProfile:  # remove when using Kubernetes prior v1.19, openshift or OKD 4
      type: RuntimeDefault  # remove when using Kubernetes prior v1.19, openshift or OKD 4
  # PodSecurityPolicy is deprecated as of Kubernetes v1.21, and will be removed in v1.25
  podSecurityPolicy:
    enabled: false
    name: ["connaisseur-psp"]  # list of PSPs to use, "connaisseur-psp" is the project-provided default
  envs: {} # dict of additional environment variables, which will be stored as a secret and injected into the Connaisseur pods
  # Extra config
  extraContainers: []
  extraVolumes: []
  extraVolumeMounts: []

# configure Connaisseur service
service:
  type: ClusterIP
  port: 443

### VALIDATORS ###
# validators are a set of configurations (types, public keys, authentication)
# that can be used for validating one or multiple images (or image signatures).
# they are tied to their respective image(s) via the image policy below. there
# are a few handy validators pre-configured.
validators:
  # static validator that allows each image
  - name: allow
    type: static
    approve: true
  # static validator that denies each image
  - name: deny
    type: static
    approve: false
  # the `default` validator is used if no validator is specified in image policy
  - name: default
    type: notaryv1  # or other supported validator (e.g. "cosign")
    host: notary.docker.io # in case of notaryv1, configure the notary server to be used
    trust_roots:
    # # the `default` key is used if no key is specified in image policy
    #- name: default
    #  key: |  # enter your public key below
    #    -----BEGIN PUBLIC KEY-----
    #    <add your public key here>
    #    -----END PUBLIC KEY-----
    #cert: |  # in case the trust data host is using a self-signed certificate
    #  -----BEGIN CERTIFICATE-----
    #  ...
    #  -----END CERTIFICATE-----
    #auth:  # credentials in case the trust data requires authentication
    #  # either (preferred solution)
    #  secret_name: mysecret  # reference a k8s secret in the form required by the validator type (check the docs)
    #  # or (only for notaryv1 validator)
    #  username: myuser
    #  password: mypass
  # pre-configured nv1 validator for public notary from Docker Hub
  - name: dockerhub-basics
    type: notaryv1
    host: notary.docker.io
    trust_roots:
      # public key for official docker images (https://hub.docker.com/search?q=&type=image&image_filter=official)
      # !if not needed feel free to remove the key!
      - name: docker-official
        key: |
          -----BEGIN PUBLIC KEY-----
          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOXYta5TgdCwXTCnLU09W5T4M4r9f
          QQrqJuADP6U7g5r9ICgPSmZuRHP/1AYUfOQW3baveKsT969EfELKj1lfCA==
          -----END PUBLIC KEY-----
      # public key securesystemsengineering repo including Connaisseur images
      # !this key is critical for Connaisseur!
      - name: securesystemsengineering-official
        key: |
          -----BEGIN PUBLIC KEY-----
          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsx28WV7BsQfnHF1kZmpdCTTLJaWe
          d0CA+JOi8H4REuBaWSZ5zPDe468WuOJ6f71E7WFg3CVEVYHuoZt2UYbN/Q==
          -----END PUBLIC KEY-----
  - name: {validator_name}
    type: notaryv1
    host: {host}
    trust_roots:
      - name: {root_name}
        key: |
          -----BEGIN PUBLIC KEY-----
          -----END PUBLIC KEY-----

### IMAGE POLICY ###
# the image policy ties validators and images together whereby always only the most specific rule (pattern)
# is applied. specify if and how images should be validated by which validator via the validator name.
policy:
  - pattern: "{image}:*"
    validator: {validator_name}
    with:
      trust_root: {root_name}
  - pattern: "*:*"
    validator: allow
  #- pattern: "docker.io/library/*:*"
  #  validator: dockerhub-basics
  #  with:
  #    trust_root: docker-official
  #- pattern: "k8s.gcr.io/*:*"
  #  validator: allow
  #- pattern: "docker.io/securesystemsengineering/*:*"
  #  validator: dockerhub-basics
  #  with:
  #    trust_root: securesystemsengineering-official

# in detection mode, deployment will not be denied, but only prompted
# and logged. this allows testing the functionality without
# interrupting operation.
detectionMode: false

# namespaced validation allows to restrict the namespaces that will be subject to Connaisseur verification.
# when enabled, based on namespaced validation mode ('ignore' or 'validate')
# - either all namespaces with label "securesystemsengineering.connaisseur/webhook=ignore" are ignored
# - or only namespaces with label "securesystemsengineering.connaisseur/webhook=validate" are validated.
# warning: enabling namespaced validation, allows roles with edit permission on a namespace to disable
# validation for that namespace
namespacedValidation:
  enabled: true
  mode: validate  # 'ignore' or 'validate'

# automatic child approval determines how admission of Kubernetes child resources is handled by Connaisseur.
# per default, Connaisseur validates and mutates all resources, e.g. deployments, replicaSets, pods, and
# automatically approves child resources of those to avoid duplicate validation and inconsistencies with the
# image policy. when disabled Connaisseur will only validate and mutate pods. check the docs for more
# information.
# NOTE: configuration of automatic child approval is in EXPERIMENTAL state.
automaticChildApproval:
  enabled: true

# debug: true


# The "logLevel" configuration option adds a partial redundancy to the `debug` setting.
# Removing the `debug` setting is a breaking change though - we are going to remove the `debug` setting in the context of a larger refactoring to avoid multiple breaking releases.
# Option to configure the log level. Either one of `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL`. Defaults to `INFO`
logLevel: INFO

# alerting is implemented in form of simple POST requests with json payload
# you can use and/or adapt the predefined Slack/OpsGenie/Keybase templates and the examples below
# to channel alert notifications to Slack/OpsGenie/Keybase or create a custom template for a customized alert
# payload to use with a simple POST request to the receiver_url to receive alerts.
# Parameters you can use in your templates are "alert_message", "priority", "connaisseur_pod_id", "cluster",
# "timestamp", "request_id" and "images" each one basically meaning what their names indicate
#
# Below is an example config

#alerting:
#  cluster_identifier: example-cluster-staging-europe # defaults to "not specified"
#  admit_request:
#    templates:
#      # <template> needs to be chosen such that <template>.json matches one of the file names
#      # in the ./alert_payload_templates directory
#      - template: opsgenie #REQUIRED!
#        receiver_url: https://api.eu.opsgenie.com/v2/alerts #REQUIRED!
#        priority: 4 #(defaults to 3)
#        custom_headers: ["Authorization: GenieKey <Your-Genie-Key>"]
#        payload_fields:
#          responders:
#            - username: "[email protected]"
#              type: user
#          visibleTo:
#            - username: "[email protected]"
#              type: user
#          tags:
#            - "deployed_an_image"
#        fail_if_alert_sending_fails: True  # (defaults to False, turning it to True will make Connaisseur deny your
#                                           # deployment (even in detection mode))
#      - template: slack #REQUIRED!
#        receiver_url: https://hooks.slack.com/services/<Your-Slack-Hook-Path>
#        priority: 1
#  reject_request:
#    templates:
#      - template: keybase  #REQUIRED!
#        receiver_url: https://bots.keybase.io/webhookbot/<Your-Keybase-Hook-Token>
#        fail_if_alert_sending_fails: True

[xopham]

@Augustussssss happy to hear 🚀
If you wanted to keep Automatic Child Approval, upgrading to the latest version should also fix the issue, as the above mentioned change was added in v2.5.2.