From 85bd6367074179e1dd0cfaa876c21f4b05178dbc Mon Sep 17 00:00:00 2001 From: Jake Zielny Date: Wed, 9 Mar 2022 10:29:12 -0500 Subject: [PATCH] Updated secret permissions to 416 --- .../hostedcontrolplane/cvo/reconcile.go | 2 +- .../hostedcontrolplane/kas/deployment.go | 18 +++++++++--------- .../hostedcontrolplane/kcm/deployment.go | 2 +- .../hostedcluster/hostedcluster_controller.go | 2 +- .../hostedcluster/internal/platform/aws/aws.go | 2 +- .../internal/platform/kubevirt/kubevirt.go | 2 +- 6 files changed, 14 insertions(+), 14 deletions(-) diff --git a/control-plane-operator/controllers/hostedcontrolplane/cvo/reconcile.go b/control-plane-operator/controllers/hostedcontrolplane/cvo/reconcile.go index f0dfc29613..9e1e4e8604 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/cvo/reconcile.go +++ b/control-plane-operator/controllers/hostedcontrolplane/cvo/reconcile.go @@ -302,7 +302,7 @@ func buildCVOVolumeServerCert(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.ClusterVersionOperatorServerCertSecret("").Name } diff --git a/control-plane-operator/controllers/hostedcontrolplane/kas/deployment.go b/control-plane-operator/controllers/hostedcontrolplane/kas/deployment.go index 799356a60d..c751921627 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/kas/deployment.go +++ b/control-plane-operator/controllers/hostedcontrolplane/kas/deployment.go @@ -367,7 +367,7 @@ func buildKASVolumeLocalhostKubeconfig(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.KASLocalhostKubeconfigSecret("").Name } @@ -412,7 +412,7 @@ func buildKASVolumeRootCA(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.RootCASecret("").Name } @@ -439,7 +439,7 @@ func buildKASVolumeServerCert(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.KASServerCertSecret("").Name } @@ -465,7 +465,7 @@ func buildKASVolumeKonnectivityClientCert(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.KonnectivityClientSecret("").Name } @@ -478,7 +478,7 @@ func buildKASVolumeAggregatorCert(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.KASAggregatorCertSecret("").Name } @@ -518,7 +518,7 @@ func buildKASVolumeServiceAccountKey(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.ServiceAccountSigningKeySecret("").Name } @@ -532,7 +532,7 @@ func buildKASVolumeKubeletClientCert(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.KASKubeletClientCertSecret("").Name } @@ -545,7 +545,7 @@ func buildKASVolumeEtcdClientCert(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.EtcdClientSecret("").Name } @@ -571,7 +571,7 @@ func buildKASVolumeAuthTokenWebhookConfig(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.KASAuthenticationTokenWebhookConfigSecret("").Name } diff --git a/control-plane-operator/controllers/hostedcontrolplane/kcm/deployment.go b/control-plane-operator/controllers/hostedcontrolplane/kcm/deployment.go index fbcd787347..56b953aaee 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/kcm/deployment.go +++ b/control-plane-operator/controllers/hostedcontrolplane/kcm/deployment.go @@ -255,7 +255,7 @@ func buildKCMVolumeServerCert(v *corev1.Volume) { if v.Secret == nil { v.Secret = &corev1.SecretVolumeSource{} } - v.Secret.DefaultMode = pointer.Int32Ptr(420) + v.Secret.DefaultMode = pointer.Int32Ptr(416) v.Secret.SecretName = manifests.KCMServerCertSecret("").Name } diff --git a/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go b/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go index c11e709fe6..8af0c0488f 100644 --- a/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go +++ b/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go @@ -2317,7 +2317,7 @@ func reconcileCAPICluster(cluster *capiv1.Cluster, hcluster *hyperv1.HostedClust } func reconcileCAPIManagerDeployment(deployment *appsv1.Deployment, hc *hyperv1.HostedCluster, sa *corev1.ServiceAccount, capiManagerImage string, setDefaultSecurityContext bool) error { - defaultMode := int32(420) + defaultMode := int32(416) capiManagerLabels := map[string]string{ "name": "cluster-api", "app": "cluster-api", diff --git a/hypershift-operator/controllers/hostedcluster/internal/platform/aws/aws.go b/hypershift-operator/controllers/hostedcluster/internal/platform/aws/aws.go index 212a3e4848..5f8313b0e4 100644 --- a/hypershift-operator/controllers/hostedcluster/internal/platform/aws/aws.go +++ b/hypershift-operator/controllers/hostedcluster/internal/platform/aws/aws.go @@ -65,7 +65,7 @@ func (p AWS) CAPIProviderDeploymentSpec(hcluster *hyperv1.HostedCluster, hcp *hy if override, ok := hcluster.Annotations[hyperv1.ClusterAPIProviderAWSImage]; ok { providerImage = override } - defaultMode := int32(420) + defaultMode := int32(416) deploymentSpec := &appsv1.DeploymentSpec{ Template: corev1.PodTemplateSpec{ Spec: corev1.PodSpec{ diff --git a/hypershift-operator/controllers/hostedcluster/internal/platform/kubevirt/kubevirt.go b/hypershift-operator/controllers/hostedcluster/internal/platform/kubevirt/kubevirt.go index 8df8d550e2..6dae7be1ca 100644 --- a/hypershift-operator/controllers/hostedcluster/internal/platform/kubevirt/kubevirt.go +++ b/hypershift-operator/controllers/hostedcluster/internal/platform/kubevirt/kubevirt.go @@ -57,7 +57,7 @@ func (p Kubevirt) CAPIProviderDeploymentSpec(hcluster *hyperv1.HostedCluster, _ if override, ok := hcluster.Annotations[hyperv1.ClusterAPIKubeVirtProviderImage]; ok { providerImage = override } - defaultMode := int32(420) + defaultMode := int32(416) return &appsv1.DeploymentSpec{ Replicas: k8sutilspointer.Int32Ptr(1), Template: corev1.PodTemplateSpec{