Use 0700 perms for etcd data dir

[shaneboulden]

Currently the cluster etcd operator creates 0755 permissions for /var/lib/etcd by default:

$ oc debug node/ip-10-0-22-132.ap-southeast-2.compute.internal
sh-5.1# ls -l /host/var/lib/ | grep etcd
drwxr-xr-x.  3 root root     41 Jul  4 03:09 etcd

Upstream etcd uses 0700: https://github.com/etcd-io/etcd/blob/866bc0717c0b56579514c7363f3f47f6cd4109c6/client/pkg/fileutil/fileutil.go#L47

And the OpenShift CIS benchmark requires that the /var/lib/etcd data dir is configured with 0700 file permissions: https://github.com/ComplianceAsCode/content/blob/24dba6b94757881c8d8e0dd21390fa733a7c3b70/applications/openshift/master/file_permissions_var_lib_etcd/rule.yml#L28

This change aligns the cluster etcd operator with upstream and the CIS benchmark for OpenShift.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: shaneboulden
Once this PR has been reviewed and has the lgtm label, please assign dusk125 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @shaneboulden. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tjungblu]

are you sure that this changes the dataDir?

[shaneboulden]

This is the only location I could find in the codebase where the /var/lib/etcd dir is created, via the memberDir.

[lance5890]

I'm also curious about the permission of "/var/lib/etcd" which set to 0755

but I'm afraid u got the wrong place

maybe u could change the dir permission in the following place just like :

cluster-etcd-operator/bindata/etcd/pod.yaml

Line 26 in d5259e4

mkdir -p /var/log/etcd && chmod 0600 /var/log/etcd

[tjungblu]

I think the reason is that the entire folder structure is on 0755:

sh-5.1# stat --format '%a' /var/    
755
sh-5.1# stat --format '%a' /var/lib/etcd/
755 

same with other openshift folders:

sh-5.1# stat --format '%a' /var/lib/ovn-ic/                 
755
sh-5.1# stat --format '%a' /var/lib/kubelet/
755

so I would rather advocate to change the CIS rule.

[shaneboulden]

@lance5890 you're right, I'm mistaken. I will take a look at an initContainers approach. Should I turn this into a draft / WIP?

@tjungblu
I think you're right.

I couldn't find the /var/lib/etcd dir explicitly created by the operator. But, doing some digging through older issues, it sounds like the kubelet will create the dir with 0755 if it doesn't exist (not sure how much has changed since 2018...)

kubernetes/kubeadm#1308 (comment)

so I would rather advocate to change the CIS rule.

Looks like 0700 is also part of the STIG: https://github.com/ComplianceAsCode/content/blob/49189d32c6039a5e4ca68f6e4a04de1f719e47b2/products/ocp4/profiles/stig-node-v1r1.profile#L62

[tjungblu]

@shaneboulden are you sure that the data dir is part of the STIG? https://stigviewer.com/stigs/kubernetes
The data files I agree and understand, but the datadir itself seems pretty strange to me.

[shaneboulden]

@tjungblu it is certainly in the OpenShift v1r1 STIG

https://complianceascode.github.io/content-pages/guides/ssg-ocp4-guide-stig-node-v1r1.html

https://github.com/ComplianceAsCode/content/blob/49189d32c6039a5e4ca68f6e4a04de1f719e47b2/products/ocp4/profiles/stig-node-v1r1.profile#L91

https://github.com/ComplianceAsCode/content/blob/49189d32c6039a5e4ca68f6e4a04de1f719e47b2/applications/openshift/master/file_permissions_etcd_data_dir/rule.yml#L7

[tjungblu]

I assume that the STIG is generated from the git repo ;)
Oz is not around anymore for a few years, so we won't be able to ask him. I remember my old team was writing a few of those rules too.

Tracking this back to 2020: ComplianceAsCode/content#6341 and ComplianceAsCode/content#6341 (comment)

not sure whether this ever worked, it also seems an additional check that is not listed in the initial ticket.