Sub-Module 2.4: SELinux Policy CI/CD with Tekton

cat << 'EOF' | oc apply -f -
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: udica-policy-generate
  namespace: hummingbird-builds-{user}
  labels:
    app.kubernetes.io/part-of: hummingbird-workshop
spec:
  description: >-
    Generate a custom SELinux CIL policy for a container image using udica.
    The task inspects the image configuration and produces a policy scoped
    to the image's actual port, mount, and capability requirements.
  params:
    - name: IMAGE
      type: string
      description: "Fully qualified image reference (registry/repo:tag or @sha256:...)"
    - name: POLICY_NAME
      type: string
      description: "Name for the generated SELinux policy (alphanumeric + underscores)"
    - name: PORTS
      type: string
      description: "Comma-separated list of ports the container exposes"
      default: "8080"
    - name: MOUNTS
      type: string
      description: "Comma-separated host paths the container bind-mounts (empty if none)"
      default: ""
  results:
    - name: POLICY_CIL
      description: "Contents of the generated .cil policy file"
    - name: IMAGE_DIGEST
      description: "Digest of the inspected image"
    - name: POLICY_TYPE
      description: "SELinux type to use in seLinuxOptions (policy_name.process)"
  steps:
    - name: generate-policy
      image: registry.redhat.io/rhel9/toolbox:latest
      securityContext:
        privileged: true
      script: |
        #!/usr/bin/env bash
        set -euo pipefail

        echo "=== Installing udica ==="
        dnf install -y -q udica podman container-selinux

        IMAGE="$(params.IMAGE)"
        POLICY="$(params.POLICY_NAME)"
        PORTS="$(params.PORTS)"
        MOUNTS="$(params.MOUNTS)"

        echo "=== Pulling image: $IMAGE ==="
        podman pull "$IMAGE"

        DIGEST=$(podman inspect "$IMAGE" --format '{{.Digest}}')
        echo -n "$DIGEST" > $(results.IMAGE_DIGEST.path)

        echo "=== Running container for inspection ==="
        RUN_ARGS=("--name" "udica-inspect" "--env" "container=podman")

        # Add port mappings
        IFS=',' read -ra PORT_LIST <<< "$PORTS"
        for p in "${PORT_LIST[@]}"; do
          [ -n "$p" ] && RUN_ARGS+=("-p" "${p}:${p}")
        done

        # Add mount mappings if specified
        if [ -n "$MOUNTS" ]; then
          IFS=',' read -ra MOUNT_LIST <<< "$MOUNTS"
          for m in "${MOUNT_LIST[@]}"; do
            [ -n "$m" ] && mkdir -p "$m" && RUN_ARGS+=("-v" "${m}:${m}:rw,Z")
          done
        fi

        podman run -d "${RUN_ARGS[@]}" "$IMAGE" || true
        sleep 3

        echo "=== Generating udica policy: $POLICY ==="
        podman inspect udica-inspect | udica "$POLICY"

        echo "=== Generated CIL policy ==="
        cat "${POLICY}.cil"

        cp "${POLICY}.cil" /workspace/policy.cil
        cat "${POLICY}.cil" > $(results.POLICY_CIL.path)
        echo -n "${POLICY}.process" > $(results.POLICY_TYPE.path)

        echo ""
        echo "=== Policy type for seLinuxOptions: ${POLICY}.process ==="

        podman stop udica-inspect 2>/dev/null || true
        podman rm udica-inspect 2>/dev/null || true
EOF

oc get task udica-policy-generate -n hummingbird-builds-{user}

cat << 'EOF' | oc apply -f -
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: selinux-policy-pipeline
  namespace: hummingbird-builds-{user}
  labels:
    app.kubernetes.io/part-of: hummingbird-workshop
spec:
  params:
    - name: IMAGE
      type: string
      description: "Fully qualified image reference"
    - name: POLICY_NAME
      type: string
      description: "Name for the generated SELinux policy"
    - name: PORTS
      type: string
      description: "Comma-separated list of ports"
      default: "8080"
    - name: MOUNTS
      type: string
      description: "Comma-separated host paths (empty if none)"
      default: ""
  tasks:
    - name: generate-policy
      taskRef:
        name: udica-policy-generate
      params:
        - name: IMAGE
          value: "$(params.IMAGE)"
        - name: POLICY_NAME
          value: "$(params.POLICY_NAME)"
        - name: PORTS
          value: "$(params.PORTS)"
        - name: MOUNTS
          value: "$(params.MOUNTS)"
EOF

oc get pipeline selinux-policy-pipeline -n hummingbird-builds-{user}

cat << 'EOF' | oc apply -f -
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: generate-nodejs-policy
  namespace: hummingbird-builds-{user}
spec:
  pipelineRef:
    name: selinux-policy-pipeline
  params:
    - name: IMAGE
      value: "{quay_hostname}/{quay_user}/secure-nodejs:latest"
    - name: POLICY_NAME
      value: "hummingbird_nodejs"
    - name: PORTS
      value: "8080"
    - name: MOUNTS
      value: ""
EOF

oc get pipelinerun generate-nodejs-policy -n hummingbird-builds-{user} -w

TASKRUN=$(oc get pipelinerun generate-nodejs-policy -n hummingbird-builds-{user} \
  -o jsonpath='{.status.childReferences[0].name}')
oc get taskrun $TASKRUN -n hummingbird-builds-{user} \
  -o jsonpath='{.status.results}' | python3 -m json.tool

oc logs ${TASKRUN}-pod -n hummingbird-builds-{user} -c step-generate-policy

cat << 'EOF' | oc apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nodejs-selinux
  namespace: hummingbird-builds-{user}
  labels:
    app: nodejs-selinux
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nodejs-selinux
  template:
    metadata:
      labels:
        app: nodejs-selinux
    spec:
      containers:
        - name: app
          image: {quay_hostname}/{quay_user}/secure-nodejs:latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              memory: "64Mi"
              cpu: "100m"
            limits:
              memory: "128Mi"
              cpu: "500m"
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            seLinuxOptions:
              type: hummingbird_nodejs.process
EOF

oc get pods -l app=nodejs-selinux -n hummingbird-builds-{user}