github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-16 15:20:17 +00:00
Code Issues Projects Releases Wiki Activity

Refactor func canRunPod

Browse Source
This commit is contained in:
xiangpengzhao 2016-06-16 21:36:07 -04:00
parent d82f3bf305
commit 28286d6890
1 changed files with 20 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
pkg/kubelet/util.go
View File

@ -27,7 +27,24 @@ import (
// Check whether we have the capabilities to run the specified pod.
func canRunPod(pod *api.Pod) error {
if pod.Spec.SecurityContext != nil && pod.Spec.SecurityContext.HostNetwork {
if !capabilities.Get().AllowPrivileged {
for _, container := range pod.Spec.Containers {
if securitycontext.HasPrivilegedRequest(&container) {
return fmt.Errorf("pod with UID %q specified privileged container, but is disallowed", pod.UID)
}
}
for _, container := range pod.Spec.InitContainers {
if securitycontext.HasPrivilegedRequest(&container) {
return fmt.Errorf("pod with UID %q specified privileged init container, but is disallowed", pod.UID)
}
}
}
if pod.Spec.SecurityContext == nil {
return nil
}
if pod.Spec.SecurityContext.HostNetwork {
allowed, err := allowHostNetwork(pod)
if err != nil {
return err
@ -37,7 +54,7 @@ func canRunPod(pod *api.Pod) error {
}
}
if pod.Spec.SecurityContext != nil && pod.Spec.SecurityContext.HostPID {
if pod.Spec.SecurityContext.HostPID {
allowed, err := allowHostPID(pod)
if err != nil {
return err
@ -47,7 +64,7 @@ func canRunPod(pod *api.Pod) error {
}
}
if pod.Spec.SecurityContext != nil && pod.Spec.SecurityContext.HostIPC {
if pod.Spec.SecurityContext.HostIPC {
allowed, err := allowHostIPC(pod)
if err != nil {
return err
@ -57,18 +74,6 @@ func canRunPod(pod *api.Pod) error {
}
}
if !capabilities.Get().AllowPrivileged {
for _, container := range pod.Spec.Containers {
if securitycontext.HasPrivilegedRequest(&container) {
return fmt.Errorf("pod with UID %q specified privileged container, but is disallowed", pod.UID)
}
}
for _, container := range pod.Spec.InitContainers {
if securitycontext.HasPrivilegedRequest(&container) {
return fmt.Errorf("pod with UID %q specified privileged container, but is disallowed", pod.UID)
}
}
}
return nil
}