From e0dbbf0a65b56cc6d4c36791ea10ba2296ed0e57 Mon Sep 17 00:00:00 2001 From: Ted Yu Date: Fri, 20 Mar 2020 07:59:44 -0700 Subject: [PATCH] Visitors of Configmaps and Secrets should specify which containers to visit Signed-off-by: Ted Yu --- pkg/api/pod/util.go | 8 ++++---- pkg/api/pod/util_test.go | 4 ++-- plugin/pkg/admission/noderestriction/admission.go | 4 ++-- plugin/pkg/admission/serviceaccount/admission.go | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/pkg/api/pod/util.go b/pkg/api/pod/util.go index d3e51f5ed16..366ca87df29 100644 --- a/pkg/api/pod/util.go +++ b/pkg/api/pod/util.go @@ -89,13 +89,13 @@ type Visitor func(name string) (shouldContinue bool) // referenced by the pod spec. If visitor returns false, visiting is short-circuited. // Transitive references (e.g. pod -> pvc -> pv -> secret) are not visited. // Returns true if visiting completed, false if visiting was short-circuited. -func VisitPodSecretNames(pod *api.Pod, visitor Visitor) bool { +func VisitPodSecretNames(pod *api.Pod, visitor Visitor, containerType ContainerType) bool { for _, reference := range pod.Spec.ImagePullSecrets { if !visitor(reference.Name) { return false } } - VisitContainers(&pod.Spec, AllContainers, func(c *api.Container, containerType ContainerType) bool { + VisitContainers(&pod.Spec, containerType, func(c *api.Container, containerType ContainerType) bool { return visitContainerSecretNames(c, visitor) }) var source *api.VolumeSource @@ -177,8 +177,8 @@ func visitContainerSecretNames(container *api.Container, visitor Visitor) bool { // referenced by the pod spec. If visitor returns false, visiting is short-circuited. // Transitive references (e.g. pod -> pvc -> pv -> secret) are not visited. // Returns true if visiting completed, false if visiting was short-circuited. -func VisitPodConfigmapNames(pod *api.Pod, visitor Visitor) bool { - VisitContainers(&pod.Spec, AllContainers, func(c *api.Container, containerType ContainerType) bool { +func VisitPodConfigmapNames(pod *api.Pod, visitor Visitor, containerType ContainerType) bool { + VisitContainers(&pod.Spec, containerType, func(c *api.Container, containerType ContainerType) bool { return visitContainerConfigmapNames(c, visitor) }) var source *api.VolumeSource diff --git a/pkg/api/pod/util_test.go b/pkg/api/pod/util_test.go index 71418bf4390..9b4deb29211 100644 --- a/pkg/api/pod/util_test.go +++ b/pkg/api/pod/util_test.go @@ -283,7 +283,7 @@ func TestPodSecrets(t *testing.T) { VisitPodSecretNames(pod, func(name string) bool { extractedNames.Insert(name) return true - }) + }, AllContainers) // excludedSecretPaths holds struct paths to fields with "secret" in the name that are not actually references to secret API objects excludedSecretPaths := sets.NewString( @@ -428,7 +428,7 @@ func TestPodConfigmaps(t *testing.T) { VisitPodConfigmapNames(pod, func(name string) bool { extractedNames.Insert(name) return true - }) + }, AllContainers) // expectedPaths holds struct paths to fields with "ConfigMap" in the name that are references to ConfigMap API objects. // every path here should be represented as an example in the Pod stub above, with the ConfigMap name set to the path. diff --git a/plugin/pkg/admission/noderestriction/admission.go b/plugin/pkg/admission/noderestriction/admission.go index 5488c68c3b5..314800b8ef1 100644 --- a/plugin/pkg/admission/noderestriction/admission.go +++ b/plugin/pkg/admission/noderestriction/admission.go @@ -257,12 +257,12 @@ func (p *Plugin) admitPodCreate(nodeName string, a admission.Attributes) error { return admission.NewForbidden(a, fmt.Errorf("node %q can not create pods that reference a service account", nodeName)) } hasSecrets := false - podutil.VisitPodSecretNames(pod, func(name string) (shouldContinue bool) { hasSecrets = true; return false }) + podutil.VisitPodSecretNames(pod, func(name string) (shouldContinue bool) { hasSecrets = true; return false }, podutil.AllContainers) if hasSecrets { return admission.NewForbidden(a, fmt.Errorf("node %q can not create pods that reference secrets", nodeName)) } hasConfigMaps := false - podutil.VisitPodConfigmapNames(pod, func(name string) (shouldContinue bool) { hasConfigMaps = true; return false }) + podutil.VisitPodConfigmapNames(pod, func(name string) (shouldContinue bool) { hasConfigMaps = true; return false }, podutil.AllContainers) if hasConfigMaps { return admission.NewForbidden(a, fmt.Errorf("node %q can not create pods that reference configmaps", nodeName)) } diff --git a/plugin/pkg/admission/serviceaccount/admission.go b/plugin/pkg/admission/serviceaccount/admission.go index 610d39f4251..1a9448e7b94 100644 --- a/plugin/pkg/admission/serviceaccount/admission.go +++ b/plugin/pkg/admission/serviceaccount/admission.go @@ -216,7 +216,7 @@ func (s *Plugin) Validate(ctx context.Context, a admission.Attributes, o admissi podutil.VisitPodSecretNames(pod, func(name string) bool { hasSecrets = true return false - }) + }, podutil.AllContainers) if hasSecrets { return admission.NewForbidden(a, fmt.Errorf("a mirror pod may not reference secrets")) }