github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-08 11:38:15 +00:00
Code Issues Projects Releases Wiki Activity

Limit usage of system critical priority classes to the system namespace

Browse Source
This commit is contained in:
Bobby (Babak) Salamat 2018-06-28 11:11:22 -07:00
parent f8c4907bec
commit 1ce7585924
2 changed files with 35 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
plugin/pkg/admission/priority/admission.go
View File

@ -21,6 +21,7 @@ import (
"io" "io"
"k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/labels"
"k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/admission"
utilfeature "k8s.io/apiserver/pkg/util/feature" utilfeature "k8s.io/apiserver/pkg/util/feature"
@ -162,6 +163,15 @@ func (p *priorityPlugin) admitPod(a admission.Attributes) error {
return fmt.Errorf("failed to get default priority class: %v", err) return fmt.Errorf("failed to get default priority class: %v", err)
} }
} else { } else {
pcName := pod.Spec.PriorityClassName
// Only allow system priorities in the system namespace. This is to prevent abuse or incorrect
// usage of these priorities. Pods created at these priorities could preempt system critical
// components.
for _, spc := range scheduling.SystemPriorityClasses() {
if spc.Name == pcName && a.GetNamespace() != metav1.NamespaceSystem {
return admission.NewForbidden(a, fmt.Errorf("pods with %v priorityClass can only be created in %v namespace", spc.Name, metav1.NamespaceSystem))
}
}
// Try resolving the priority class name. // Try resolving the priority class name.
pc, err := p.lister.Get(pod.Spec.PriorityClassName) pc, err := p.lister.Get(pod.Spec.PriorityClassName)
if err != nil { if err != nil {

29
plugin/pkg/admission/priority/admission_test.go
View File

@ -314,7 +314,7 @@ func TestPodAdmission(t *testing.T) {
{ {
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: "pod-w-system-priority", Name: "pod-w-system-priority",
Namespace: "namespace", Namespace: metav1.NamespaceSystem,
}, },
Spec: api.PodSpec{ Spec: api.PodSpec{
Containers: []api.Container{ Containers: []api.Container{
@ -329,7 +329,7 @@ func TestPodAdmission(t *testing.T) {
{ {
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: "mirror-pod-w-system-priority", Name: "mirror-pod-w-system-priority",
Namespace: "namespace", Namespace: metav1.NamespaceSystem,
Annotations: map[string]string{api.MirrorPodAnnotationKey: ""}, Annotations: map[string]string{api.MirrorPodAnnotationKey: ""},
}, },
Spec: api.PodSpec{ Spec: api.PodSpec{
@ -374,6 +374,21 @@ func TestPodAdmission(t *testing.T) {
}, },
}, },
}, },
// pod[8]: Pod with a system priority class name in non-system namespace
{
ObjectMeta: metav1.ObjectMeta{
Name: "pod-w-system-priority-in-nonsystem-namespace",
Namespace: "non-system-namespace",
},
Spec: api.PodSpec{
Containers: []api.Container{
{
Name: containerName,
},
},
PriorityClassName: scheduling.SystemClusterCritical,
},
},
} }
// Enable PodPriority feature gate. // Enable PodPriority feature gate.
utilfeature.DefaultFeatureGate.Set(fmt.Sprintf("%s=true", features.PodPriority)) utilfeature.DefaultFeatureGate.Set(fmt.Sprintf("%s=true", features.PodPriority))
@ -459,6 +474,13 @@ func TestPodAdmission(t *testing.T) {
scheduling.SystemCriticalPriority, scheduling.SystemCriticalPriority,
false, false,
}, },
{
"pod with system critical priority in non-system namespace",
[]*scheduling.PriorityClass{systemClusterCritical},
*pods[8],
scheduling.SystemCriticalPriority,
true,
},
} }
for _, test := range tests { for _, test := range tests {
@ -485,8 +507,7 @@ func TestPodAdmission(t *testing.T) {
if !test.expectError { if !test.expectError {
if err != nil { if err != nil {
t.Errorf("Test %q: unexpected error received: %v", test.name, err) t.Errorf("Test %q: unexpected error received: %v", test.name, err)
} } else if *test.pod.Spec.Priority != test.expectedPriority {
if *test.pod.Spec.Priority != test.expectedPriority {
t.Errorf("Test %q: expected priority is %d, but got %d.", test.name, test.expectedPriority, *test.pod.Spec.Priority) t.Errorf("Test %q: expected priority is %d, but got %d.", test.name, test.expectedPriority, *test.pod.Spec.Priority)
} }
} }