github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-23 11:50:44 +00:00
Code Issues Projects Releases Wiki Activity

add import-alias for k8s.io/api/policy/v1beta1

Browse Source
This commit is contained in:
Aaron Crickenberger 2019-06-20 11:40:37 -07:00
parent 9c02d21d2d
commit 1d0d98dbc5
6 changed files with 66 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hack/.import-aliases
View File

@ -22,5 +22,6 @@
"k8s.io/api/networking/v1": "networkingv1", "k8s.io/api/networking/v1": "networkingv1",
"k8s.io/api/networking/v1beta1": "networkingv1beta1", "k8s.io/api/networking/v1beta1": "networkingv1beta1",
"k8s.io/api/node/v1alpha1": "nodev1alpha1", "k8s.io/api/node/v1alpha1": "nodev1alpha1",
"k8s.io/api/node/v1beta1": "nodev1beta1" "k8s.io/api/node/v1beta1": "nodev1beta1",
"k8s.io/api/policy/v1beta1": "policyv1beta1"
} }

14
test/e2e/apps/disruption.go
View File

@ -25,7 +25,7 @@ import (
appsv1 "k8s.io/api/apps/v1" appsv1 "k8s.io/api/apps/v1"
"k8s.io/api/core/v1" "k8s.io/api/core/v1"
policy "k8s.io/api/policy/v1beta1" policyv1beta1 "k8s.io/api/policy/v1beta1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/intstr" "k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/apimachinery/pkg/util/wait" "k8s.io/apimachinery/pkg/util/wait"
@ -168,7 +168,7 @@ var _ = SIGDescribe("DisruptionController", func() {
pod, err := locateRunningPod(cs, ns) pod, err := locateRunningPod(cs, ns)
framework.ExpectNoError(err) framework.ExpectNoError(err)
e := &policy.Eviction{ e := &policyv1beta1.Eviction{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: pod.Name, Name: pod.Name,
Namespace: ns, Namespace: ns,
@ -208,7 +208,7 @@ var _ = SIGDescribe("DisruptionController", func() {
framework.ExpectNoError(err) framework.ExpectNoError(err)
waitForPodsOrDie(cs, ns, 3) // make sure that they are running and so would be evictable with a different pdb waitForPodsOrDie(cs, ns, 3) // make sure that they are running and so would be evictable with a different pdb
e := &policy.Eviction{ e := &policyv1beta1.Eviction{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: pod.Name, Name: pod.Name,
Namespace: ns, Namespace: ns,
@ -228,12 +228,12 @@ var _ = SIGDescribe("DisruptionController", func() {
}) })
func createPDBMinAvailableOrDie(cs kubernetes.Interface, ns string, minAvailable intstr.IntOrString) { func createPDBMinAvailableOrDie(cs kubernetes.Interface, ns string, minAvailable intstr.IntOrString) {
pdb := policy.PodDisruptionBudget{ pdb := policyv1beta1.PodDisruptionBudget{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: "foo", Name: "foo",
Namespace: ns, Namespace: ns,
}, },
Spec: policy.PodDisruptionBudgetSpec{ Spec: policyv1beta1.PodDisruptionBudgetSpec{
Selector: &metav1.LabelSelector{MatchLabels: map[string]string{"foo": "bar"}}, Selector: &metav1.LabelSelector{MatchLabels: map[string]string{"foo": "bar"}},
MinAvailable: &minAvailable, MinAvailable: &minAvailable,
}, },
@ -244,12 +244,12 @@ func createPDBMinAvailableOrDie(cs kubernetes.Interface, ns string, minAvailable
} }
func createPDBMaxUnavailableOrDie(cs kubernetes.Interface, ns string, maxUnavailable intstr.IntOrString) { func createPDBMaxUnavailableOrDie(cs kubernetes.Interface, ns string, maxUnavailable intstr.IntOrString) {
pdb := policy.PodDisruptionBudget{ pdb := policyv1beta1.PodDisruptionBudget{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: "foo", Name: "foo",
Namespace: ns, Namespace: ns,
}, },
Spec: policy.PodDisruptionBudgetSpec{ Spec: policyv1beta1.PodDisruptionBudgetSpec{
Selector: &metav1.LabelSelector{MatchLabels: map[string]string{"foo": "bar"}}, Selector: &metav1.LabelSelector{MatchLabels: map[string]string{"foo": "bar"}},
MaxUnavailable: &maxUnavailable, MaxUnavailable: &maxUnavailable,
}, },

72
test/e2e/auth/pod_security_policy.go
View File

@ -20,7 +20,7 @@ import (
"fmt" "fmt"
v1 "k8s.io/api/core/v1" v1 "k8s.io/api/core/v1"
policy "k8s.io/api/policy/v1beta1" policyv1beta1 "k8s.io/api/policy/v1beta1"
rbacv1 "k8s.io/api/rbac/v1" rbacv1 "k8s.io/api/rbac/v1"
apierrs "k8s.io/apimachinery/pkg/api/errors" apierrs "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@ -208,7 +208,7 @@ func testPrivilegedPods(tester func(pod *v1.Pod)) {
} }
// createAndBindPSP creates a PSP in the policy API group. // createAndBindPSP creates a PSP in the policy API group.
func createAndBindPSP(f *framework.Framework, pspTemplate *policy.PodSecurityPolicy) (psp *policy.PodSecurityPolicy, cleanup func()) { func createAndBindPSP(f *framework.Framework, pspTemplate *policyv1beta1.PodSecurityPolicy) (psp *policyv1beta1.PodSecurityPolicy, cleanup func()) {
// Create the PodSecurityPolicy object. // Create the PodSecurityPolicy object.
psp = pspTemplate.DeepCopy() psp = pspTemplate.DeepCopy()
// Add the namespace to the name to ensure uniqueness and tie it to the namespace. // Add the namespace to the name to ensure uniqueness and tie it to the namespace.
@ -274,35 +274,35 @@ func restrictedPod(name string) *v1.Pod {
} }
// privilegedPSPInPolicy creates a PodSecurityPolicy (in the "policy" API Group) that allows everything. // privilegedPSPInPolicy creates a PodSecurityPolicy (in the "policy" API Group) that allows everything.
func privilegedPSP(name string) *policy.PodSecurityPolicy { func privilegedPSP(name string) *policyv1beta1.PodSecurityPolicy {
return &policy.PodSecurityPolicy{ return &policyv1beta1.PodSecurityPolicy{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
Annotations: map[string]string{seccomp.AllowedProfilesAnnotationKey: seccomp.AllowAny}, Annotations: map[string]string{seccomp.AllowedProfilesAnnotationKey: seccomp.AllowAny},
}, },
Spec: policy.PodSecurityPolicySpec{ Spec: policyv1beta1.PodSecurityPolicySpec{
Privileged: true, Privileged: true,
AllowPrivilegeEscalation: utilpointer.BoolPtr(true), AllowPrivilegeEscalation: utilpointer.BoolPtr(true),
AllowedCapabilities: []v1.Capability{"*"}, AllowedCapabilities: []v1.Capability{"*"},
Volumes: []policy.FSType{policy.All}, Volumes: []policyv1beta1.FSType{policyv1beta1.All},
HostNetwork: true, HostNetwork: true,
HostPorts: []policy.HostPortRange{{Min: 0, Max: 65535}}, HostPorts: []policyv1beta1.HostPortRange{{Min: 0, Max: 65535}},
HostIPC: true, HostIPC: true,
HostPID: true, HostPID: true,
RunAsUser: policy.RunAsUserStrategyOptions{ RunAsUser: policyv1beta1.RunAsUserStrategyOptions{
Rule: policy.RunAsUserStrategyRunAsAny, Rule: policyv1beta1.RunAsUserStrategyRunAsAny,
}, },
RunAsGroup: &policy.RunAsGroupStrategyOptions{ RunAsGroup: &policyv1beta1.RunAsGroupStrategyOptions{
Rule: policy.RunAsGroupStrategyRunAsAny, Rule: policyv1beta1.RunAsGroupStrategyRunAsAny,
}, },
SELinux: policy.SELinuxStrategyOptions{ SELinux: policyv1beta1.SELinuxStrategyOptions{
Rule: policy.SELinuxStrategyRunAsAny, Rule: policyv1beta1.SELinuxStrategyRunAsAny,
}, },
SupplementalGroups: policy.SupplementalGroupsStrategyOptions{ SupplementalGroups: policyv1beta1.SupplementalGroupsStrategyOptions{
Rule: policy.SupplementalGroupsStrategyRunAsAny, Rule: policyv1beta1.SupplementalGroupsStrategyRunAsAny,
}, },
FSGroup: policy.FSGroupStrategyOptions{ FSGroup: policyv1beta1.FSGroupStrategyOptions{
Rule: policy.FSGroupStrategyRunAsAny, Rule: policyv1beta1.FSGroupStrategyRunAsAny,
}, },
ReadOnlyRootFilesystem: false, ReadOnlyRootFilesystem: false,
}, },
@ -310,8 +310,8 @@ func privilegedPSP(name string) *policy.PodSecurityPolicy {
} }
// restrictedPSPInPolicy creates a PodSecurityPolicy (in the "policy" API Group) that is most strict. // restrictedPSPInPolicy creates a PodSecurityPolicy (in the "policy" API Group) that is most strict.
func restrictedPSP(name string) *policy.PodSecurityPolicy { func restrictedPSP(name string) *policyv1beta1.PodSecurityPolicy {
return &policy.PodSecurityPolicy{ return &policyv1beta1.PodSecurityPolicy{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
Annotations: map[string]string{ Annotations: map[string]string{
@ -321,7 +321,7 @@ func restrictedPSP(name string) *policy.PodSecurityPolicy {
apparmor.DefaultProfileAnnotationKey: apparmor.ProfileRuntimeDefault, apparmor.DefaultProfileAnnotationKey: apparmor.ProfileRuntimeDefault,
}, },
}, },
Spec: policy.PodSecurityPolicySpec{ Spec: policyv1beta1.PodSecurityPolicySpec{
Privileged: false, Privileged: false,
AllowPrivilegeEscalation: utilpointer.BoolPtr(false), AllowPrivilegeEscalation: utilpointer.BoolPtr(false),
RequiredDropCapabilities: []v1.Capability{ RequiredDropCapabilities: []v1.Capability{
@ -337,32 +337,32 @@ func restrictedPSP(name string) *policy.PodSecurityPolicy {
"SETUID", "SETUID",
"SYS_CHROOT", "SYS_CHROOT",
}, },
Volumes: []policy.FSType{ Volumes: []policyv1beta1.FSType{
policy.ConfigMap, policyv1beta1.ConfigMap,
policy.EmptyDir, policyv1beta1.EmptyDir,
policy.PersistentVolumeClaim, policyv1beta1.PersistentVolumeClaim,
"projected", "projected",
policy.Secret, policyv1beta1.Secret,
}, },
HostNetwork: false, HostNetwork: false,
HostIPC: false, HostIPC: false,
HostPID: false, HostPID: false,
RunAsUser: policy.RunAsUserStrategyOptions{ RunAsUser: policyv1beta1.RunAsUserStrategyOptions{
Rule: policy.RunAsUserStrategyMustRunAsNonRoot, Rule: policyv1beta1.RunAsUserStrategyMustRunAsNonRoot,
}, },
RunAsGroup: &policy.RunAsGroupStrategyOptions{ RunAsGroup: &policyv1beta1.RunAsGroupStrategyOptions{
Rule: policy.RunAsGroupStrategyMustRunAs, Rule: policyv1beta1.RunAsGroupStrategyMustRunAs,
Ranges: []policy.IDRange{ Ranges: []policyv1beta1.IDRange{
{Min: nobodyUser, Max: nobodyUser}}, {Min: nobodyUser, Max: nobodyUser}},
}, },
SELinux: policy.SELinuxStrategyOptions{ SELinux: policyv1beta1.SELinuxStrategyOptions{
Rule: policy.SELinuxStrategyRunAsAny, Rule: policyv1beta1.SELinuxStrategyRunAsAny,
}, },
SupplementalGroups: policy.SupplementalGroupsStrategyOptions{ SupplementalGroups: policyv1beta1.SupplementalGroupsStrategyOptions{
Rule: policy.SupplementalGroupsStrategyRunAsAny, Rule: policyv1beta1.SupplementalGroupsStrategyRunAsAny,
}, },
FSGroup: policy.FSGroupStrategyOptions{ FSGroup: policyv1beta1.FSGroupStrategyOptions{
Rule: policy.FSGroupStrategyRunAsAny, Rule: policyv1beta1.FSGroupStrategyRunAsAny,
}, },
ReadOnlyRootFilesystem: false, ReadOnlyRootFilesystem: false,
}, },

10
test/e2e/autoscaling/cluster_size_autoscaling.go
View File

@ -29,7 +29,7 @@ import (
"time" "time"
"k8s.io/api/core/v1" "k8s.io/api/core/v1"
policy "k8s.io/api/policy/v1beta1" policyv1beta1 "k8s.io/api/policy/v1beta1"
schedulerapi "k8s.io/api/scheduling/v1" schedulerapi "k8s.io/api/scheduling/v1"
"k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@ -1015,12 +1015,12 @@ func runDrainTest(f *framework.Framework, migSizes map[string]int, namespace str
ginkgo.By("Create a PodDisruptionBudget") ginkgo.By("Create a PodDisruptionBudget")
minAvailable := intstr.FromInt(numPods - pdbSize) minAvailable := intstr.FromInt(numPods - pdbSize)
pdb := &policy.PodDisruptionBudget{ pdb := &policyv1beta1.PodDisruptionBudget{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: "test_pdb", Name: "test_pdb",
Namespace: namespace, Namespace: namespace,
}, },
Spec: policy.PodDisruptionBudgetSpec{ Spec: policyv1beta1.PodDisruptionBudgetSpec{
Selector: &metav1.LabelSelector{MatchLabels: labelMap}, Selector: &metav1.LabelSelector{MatchLabels: labelMap},
MinAvailable: &minAvailable, MinAvailable: &minAvailable,
}, },
@ -1891,12 +1891,12 @@ func addKubeSystemPdbs(f *framework.Framework) (func(), error) {
labelMap := map[string]string{"k8s-app": pdbData.label} labelMap := map[string]string{"k8s-app": pdbData.label}
pdbName := fmt.Sprintf("test-pdb-for-%v", pdbData.label) pdbName := fmt.Sprintf("test-pdb-for-%v", pdbData.label)
minAvailable := intstr.FromInt(pdbData.minAvailable) minAvailable := intstr.FromInt(pdbData.minAvailable)
pdb := &policy.PodDisruptionBudget{ pdb := &policyv1beta1.PodDisruptionBudget{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: pdbName, Name: pdbName,
Namespace: "kube-system", Namespace: "kube-system",
}, },
Spec: policy.PodDisruptionBudgetSpec{ Spec: policyv1beta1.PodDisruptionBudgetSpec{
Selector: &metav1.LabelSelector{MatchLabels: labelMap}, Selector: &metav1.LabelSelector{MatchLabels: labelMap},
MinAvailable: &minAvailable, MinAvailable: &minAvailable,
}, },

28
test/e2e/framework/psp_util.go
View File

@ -21,7 +21,7 @@ import (
"sync" "sync"
v1 "k8s.io/api/core/v1" v1 "k8s.io/api/core/v1"
policy "k8s.io/api/policy/v1beta1" policyv1beta1 "k8s.io/api/policy/v1beta1"
rbacv1 "k8s.io/api/rbac/v1" rbacv1 "k8s.io/api/rbac/v1"
apierrs "k8s.io/apimachinery/pkg/api/errors" apierrs "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@ -44,33 +44,33 @@ var (
) )
// privilegedPSP creates a PodSecurityPolicy that allows everything. // privilegedPSP creates a PodSecurityPolicy that allows everything.
func privilegedPSP(name string) *policy.PodSecurityPolicy { func privilegedPSP(name string) *policyv1beta1.PodSecurityPolicy {
allowPrivilegeEscalation := true allowPrivilegeEscalation := true
return &policy.PodSecurityPolicy{ return &policyv1beta1.PodSecurityPolicy{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
Annotations: map[string]string{seccomp.AllowedProfilesAnnotationKey: seccomp.AllowAny}, Annotations: map[string]string{seccomp.AllowedProfilesAnnotationKey: seccomp.AllowAny},
}, },
Spec: policy.PodSecurityPolicySpec{ Spec: policyv1beta1.PodSecurityPolicySpec{
Privileged: true, Privileged: true,
AllowPrivilegeEscalation: &allowPrivilegeEscalation, AllowPrivilegeEscalation: &allowPrivilegeEscalation,
AllowedCapabilities: []v1.Capability{"*"}, AllowedCapabilities: []v1.Capability{"*"},
Volumes: []policy.FSType{policy.All}, Volumes: []policyv1beta1.FSType{policyv1beta1.All},
HostNetwork: true, HostNetwork: true,
HostPorts: []policy.HostPortRange{{Min: 0, Max: 65535}}, HostPorts: []policyv1beta1.HostPortRange{{Min: 0, Max: 65535}},
HostIPC: true, HostIPC: true,
HostPID: true, HostPID: true,
RunAsUser: policy.RunAsUserStrategyOptions{ RunAsUser: policyv1beta1.RunAsUserStrategyOptions{
Rule: policy.RunAsUserStrategyRunAsAny, Rule: policyv1beta1.RunAsUserStrategyRunAsAny,
}, },
SELinux: policy.SELinuxStrategyOptions{ SELinux: policyv1beta1.SELinuxStrategyOptions{
Rule: policy.SELinuxStrategyRunAsAny, Rule: policyv1beta1.SELinuxStrategyRunAsAny,
}, },
SupplementalGroups: policy.SupplementalGroupsStrategyOptions{ SupplementalGroups: policyv1beta1.SupplementalGroupsStrategyOptions{
Rule: policy.SupplementalGroupsStrategyRunAsAny, Rule: policyv1beta1.SupplementalGroupsStrategyRunAsAny,
}, },
FSGroup: policy.FSGroupStrategyOptions{ FSGroup: policyv1beta1.FSGroupStrategyOptions{
Rule: policy.FSGroupStrategyRunAsAny, Rule: policyv1beta1.FSGroupStrategyRunAsAny,
}, },
ReadOnlyRootFilesystem: false, ReadOnlyRootFilesystem: false,
AllowedUnsafeSysctls: []string{"*"}, AllowedUnsafeSysctls: []string{"*"},

4
test/e2e/storage/pd.go
View File

@ -30,7 +30,7 @@ import (
"github.com/onsi/ginkgo" "github.com/onsi/ginkgo"
"github.com/onsi/gomega" "github.com/onsi/gomega"
v1 "k8s.io/api/core/v1" v1 "k8s.io/api/core/v1"
policy "k8s.io/api/policy/v1beta1" policyv1beta1 "k8s.io/api/policy/v1beta1"
"k8s.io/apimachinery/pkg/api/resource" "k8s.io/apimachinery/pkg/api/resource"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/types"
@ -411,7 +411,7 @@ var _ = utils.SIGDescribe("Pod Disks", func() {
framework.ExpectNoError(podClient.Delete(host0Pod.Name, metav1.NewDeleteOptions(0)), "Unable to delete host0Pod") framework.ExpectNoError(podClient.Delete(host0Pod.Name, metav1.NewDeleteOptions(0)), "Unable to delete host0Pod")
} else if disruptOp == evictPod { } else if disruptOp == evictPod {
evictTarget := &policy.Eviction{ evictTarget := &policyv1beta1.Eviction{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: host0Pod.Name, Name: host0Pod.Name,
Namespace: ns, Namespace: ns,