github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-07-31 23:36:12 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #9579 from microsoft/saulparedes/add_seccomp_support

Browse Source 
genpolicy: ignore SeccompProfile in PodSpec
This commit is contained in:
Aurélien Bombo 2024-06-24 08:58:01 -07:00 committed by GitHub
commit b0cdf4eb0d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/tools/genpolicy/src/pod.rs
View File

@ -283,6 +283,19 @@ struct SecurityContext {
#[serde(skip_serializing_if = "Option::is_none")]
runAsUser: Option<i64>,
#[serde(skip_serializing_if = "Option::is_none")]
seccompProfile: Option<SeccompProfile>,
}
/// See Reference / Kubernetes API / Workload Resources / Pod.
#[derive(Clone, Debug, Serialize, Deserialize)]
struct SeccompProfile {
#[serde(rename = "type")]
profile_type: String,
#[serde(skip_serializing_if = "Option::is_none")]
localhostProfile: Option<String>,
}
/// See Reference / Kubernetes API / Workload Resources / Pod.
@ -860,6 +873,7 @@ pub async fn add_pause_container(containers: &mut Vec<Container>, config: &Confi
privileged: None,
capabilities: None,
runAsUser: None,
seccompProfile: None,
}),
..Default::default()
};

3
tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-pod.yaml
View File

@ -24,3 +24,6 @@ spec:
configMapKeyRef:
name: policy-configmap
key: data-2
securityContext:
seccompProfile:
type: RuntimeDefault