mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-08-25 11:13:15 +00:00
genpolicy: fix svc_name regex
The service name is specified as RFC 1035 lable name [1]. The svc_name
regex in the genpolicy settings is applied to the downward API env
variables created based on the service name. So it tries to match
RFC 1035 labels after they are transformed to downward API variable
names [2]. So the set of lower case alphanumerics and dashes is
transformed to upper case alphanumerics and underscores.
The previous regex wronly permitted use of numbers, but did allow
dot and dash, which shouldn't be allowed (dot not because they aren't
conform with RFC 1035, dash not because it is transformed to underscore).
We have to take care not to also try to use the regex in places where
we actually want to check for RFC 1035 label instead of the downward
API transformed version of it.
Further, we should consider using a format like JSON5/JSONC for the
policy settings, as these are far from trivial and would highly benefit
from proper documentation through comments.
[1]: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service
[2]: b2dfba4151/pkg/kubelet/envvars/envvars.go (L29-L70)
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
This commit is contained in:
parent
20d3bc6f37
commit
78eb65bb0b
@ -255,7 +255,7 @@
|
|||||||
"sfprefix": "^$(cpath)/$(bundle-id)-[a-z0-9]{16}-",
|
"sfprefix": "^$(cpath)/$(bundle-id)-[a-z0-9]{16}-",
|
||||||
"ip_p": "[0-9]{1,5}",
|
"ip_p": "[0-9]{1,5}",
|
||||||
"ipv4_a": "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])",
|
"ipv4_a": "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])",
|
||||||
"svc_name": "[A-Z_\\.\\-]+",
|
"svc_name": "[A-Z](?:[A-Z0-9_]{0,61}[A-Z0-9])?",
|
||||||
"dns_label": "[a-zA-Z0-9_\\.\\-]+",
|
"dns_label": "[a-zA-Z0-9_\\.\\-]+",
|
||||||
"default_caps": [
|
"default_caps": [
|
||||||
"CAP_CHOWN",
|
"CAP_CHOWN",
|
||||||
|
Loading…
Reference in New Issue
Block a user