control-service: Container read-only file system

[gabrielgeorgiev1]

To reduce the attack surface of jobs containers, jobs
should run with the root file system set to read-only.
However, this means that job pods cannot write to the
file system, so we need to create an ephemeral file
system that jobs can use instead.

The test job contains one step with the following code:

import logging

import time

from vdk.api.job_input  import IJobInput

log = logging.getLogger(__name__)


def run(job_input: IJobInput):
    log.info("Testing we can still write to the ephemeral filesystem.")

    with open("test-file.txt", 'w') as f:
        f.write("Testing sentence.")

    with open("test-file.txt", 'r') as f:
        if str(f.read()) != 'Testing sentence.':
            raise Exception("File write was unsuccessful.")

    log.info("Testing we cannot write to the root filesystem.")

    try:
        with open("/test-file.txt", 'w') as f:
            f.write("Testing sentence.")
    except OSError:
        log.info("Root filesystem is read-only, as it should.")
    else:
        raise Exception("Root filesystem is not read-only")

Testing done: integration test

Signed-off-by: Gabriel Georgiev gageorgiev@vmware.com

[antoniivanov]

This is setting root file system for the builder jobs. And it looks ok.

What happens for the data jobs themselves ? Are you planning to do it? It make sense to me to be a separate PR but I just wondered because initially it seems we are changing the data job .
You need to fix the title if this PR is to be for builder jobs

[mivanov1988]

Probably you are going to expose this option through the Helm chart in a separate PR, right?

[gabrielgeorgiev1]

Probably you are going to expose this option through the Helm chart in a separate PR, right?

I don't follow. My understanding was that this will be configured through values.yml.

[mivanov1988]

Probably you are going to expose this option through the Helm chart in a separate PR, right?

I don't follow. My understanding was that this will be configured through values.yml.

Yes, but now it is not possible, since this property is not exposed yet, right?