diff --git a/src/tools/genpolicy/src/daemon_set.rs b/src/tools/genpolicy/src/daemon_set.rs index 3e0a6ee44b..19ce944b02 100644 --- a/src/tools/genpolicy/src/daemon_set.rs +++ b/src/tools/genpolicy/src/daemon_set.rs @@ -147,4 +147,8 @@ impl yaml::K8sResource for DaemonSet { .clone() .or_else(|| Some(String::new())) } + + fn get_process_fields(&self, process: &mut policy::KataProcess) { + yaml::get_process_fields(process, &self.spec.template.spec.securityContext); + } } diff --git a/src/tools/genpolicy/src/deployment.rs b/src/tools/genpolicy/src/deployment.rs index adc7f9778d..4167b25a9f 100644 --- a/src/tools/genpolicy/src/deployment.rs +++ b/src/tools/genpolicy/src/deployment.rs @@ -145,4 +145,8 @@ impl yaml::K8sResource for Deployment { .clone() .or_else(|| Some(String::new())) } + + fn get_process_fields(&self, process: &mut policy::KataProcess) { + yaml::get_process_fields(process, &self.spec.template.spec.securityContext); + } } diff --git a/src/tools/genpolicy/src/job.rs b/src/tools/genpolicy/src/job.rs index e686d333c9..63c3571776 100644 --- a/src/tools/genpolicy/src/job.rs +++ b/src/tools/genpolicy/src/job.rs @@ -110,4 +110,8 @@ impl yaml::K8sResource for Job { } false } + + fn get_process_fields(&self, process: &mut policy::KataProcess) { + yaml::get_process_fields(process, &self.spec.template.spec.securityContext); + } } diff --git a/src/tools/genpolicy/src/pod.rs b/src/tools/genpolicy/src/pod.rs index e7f61132cf..19f8822395 100644 --- a/src/tools/genpolicy/src/pod.rs +++ b/src/tools/genpolicy/src/pod.rs @@ -94,7 +94,7 @@ pub struct PodSpec { topologySpreadConstraints: Option>, #[serde(skip_serializing_if = "Option::is_none")] - securityContext: Option, + pub securityContext: Option, #[serde(skip_serializing_if = "Option::is_none")] priorityClassName: Option, @@ -312,9 +312,9 @@ struct SeccompProfile { /// See Reference / Kubernetes API / Workload Resources / Pod. #[derive(Clone, Debug, Serialize, Deserialize)] -struct PodSecurityContext { +pub struct PodSecurityContext { #[serde(skip_serializing_if = "Option::is_none")] - runAsUser: Option, + pub runAsUser: Option, // TODO: additional fields. } @@ -893,11 +893,7 @@ impl yaml::K8sResource for Pod { } fn get_process_fields(&self, process: &mut policy::KataProcess) { - if let Some(context) = &self.spec.securityContext { - if let Some(uid) = context.runAsUser { - process.User.UID = uid.try_into().unwrap(); - } - } + yaml::get_process_fields(process, &self.spec.securityContext); } } diff --git a/src/tools/genpolicy/src/replica_set.rs b/src/tools/genpolicy/src/replica_set.rs index 04d46e1b81..06daedab85 100644 --- a/src/tools/genpolicy/src/replica_set.rs +++ b/src/tools/genpolicy/src/replica_set.rs @@ -108,4 +108,8 @@ impl yaml::K8sResource for ReplicaSet { } false } + + fn get_process_fields(&self, process: &mut policy::KataProcess) { + yaml::get_process_fields(process, &self.spec.template.spec.securityContext); + } } diff --git a/src/tools/genpolicy/src/replication_controller.rs b/src/tools/genpolicy/src/replication_controller.rs index 0c7583d816..6fea847c7d 100644 --- a/src/tools/genpolicy/src/replication_controller.rs +++ b/src/tools/genpolicy/src/replication_controller.rs @@ -110,4 +110,8 @@ impl yaml::K8sResource for ReplicationController { } false } + + fn get_process_fields(&self, process: &mut policy::KataProcess) { + yaml::get_process_fields(process, &self.spec.template.spec.securityContext); + } } diff --git a/src/tools/genpolicy/src/stateful_set.rs b/src/tools/genpolicy/src/stateful_set.rs index e0c0325f42..04e1ee06ed 100644 --- a/src/tools/genpolicy/src/stateful_set.rs +++ b/src/tools/genpolicy/src/stateful_set.rs @@ -192,6 +192,10 @@ impl yaml::K8sResource for StatefulSet { .clone() .or_else(|| Some(String::new())) } + + fn get_process_fields(&self, process: &mut policy::KataProcess) { + yaml::get_process_fields(process, &self.spec.template.spec.securityContext); + } } impl StatefulSet { diff --git a/src/tools/genpolicy/src/yaml.rs b/src/tools/genpolicy/src/yaml.rs index cb48a88959..e7127fb7d3 100644 --- a/src/tools/genpolicy/src/yaml.rs +++ b/src/tools/genpolicy/src/yaml.rs @@ -97,8 +97,8 @@ pub trait K8sResource { } fn get_process_fields(&self, _process: &mut policy::KataProcess) { - // Just Pods can have a PodSecurityContext field, so the other - // resources can use this default get_process_fields implementation. + // No need to implement support for securityContext or similar fields + // for some of the K8s resource types. } } @@ -378,3 +378,14 @@ fn handle_unused_field(path: &str, silent_unsupported_fields: bool) { panic!("Unsupported field: {}", path); } } + +pub fn get_process_fields( + process: &mut policy::KataProcess, + security_context: &Option, +) { + if let Some(context) = security_context { + if let Some(uid) = context.runAsUser { + process.User.UID = uid.try_into().unwrap(); + } + } +}