github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 04:33:26 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #86802 from Aresforchina/fix-staticcheck-test04

Browse Source 
make kubelet sysctl constants private
This commit is contained in:
Kubernetes Prow Robot 2020-06-19 04:37:59 -07:00 committed by GitHub
commit 2f2923fc33
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
pkg/kubelet/sysctl/namespace.go
View File

@ -25,28 +25,28 @@ type Namespace string
const ( const (
// the Linux IPC namespace // the Linux IPC namespace
IpcNamespace = Namespace("ipc") ipcNamespace = Namespace("ipc")
// the network namespace // the network namespace
NetNamespace = Namespace("net") netNamespace = Namespace("net")
// the zero value if no namespace is known // the zero value if no namespace is known
UnknownNamespace = Namespace("") unknownNamespace = Namespace("")
) )
var namespaces = map[string]Namespace{ var namespaces = map[string]Namespace{
"kernel.sem": IpcNamespace, "kernel.sem": ipcNamespace,
} }
var prefixNamespaces = map[string]Namespace{ var prefixNamespaces = map[string]Namespace{
"kernel.shm": IpcNamespace, "kernel.shm": ipcNamespace,
"kernel.msg": IpcNamespace, "kernel.msg": ipcNamespace,
"fs.mqueue.": IpcNamespace, "fs.mqueue.": ipcNamespace,
"net.": NetNamespace, "net.": netNamespace,
} }
// NamespacedBy returns the namespace of the Linux kernel for a sysctl, or // NamespacedBy returns the namespace of the Linux kernel for a sysctl, or
// UnknownNamespace if the sysctl is not known to be namespaced. // unknownNamespace if the sysctl is not known to be namespaced.
func NamespacedBy(val string) Namespace { func NamespacedBy(val string) Namespace {
if ns, found := namespaces[val]; found { if ns, found := namespaces[val]; found {
return ns return ns
@ -56,5 +56,5 @@ func NamespacedBy(val string) Namespace {
return ns return ns
} }
} }
return UnknownNamespace return unknownNamespace
} }

8
pkg/kubelet/sysctl/namespace_test.go
View File

@ -22,10 +22,10 @@ import (
func TestNamespacedBy(t *testing.T) { func TestNamespacedBy(t *testing.T) {
tests := map[string]Namespace{ tests := map[string]Namespace{
"kernel.shm_rmid_forced": IpcNamespace, "kernel.shm_rmid_forced": ipcNamespace,
"net.a.b.c": NetNamespace, "net.a.b.c": netNamespace,
"fs.mqueue.a.b.c": IpcNamespace, "fs.mqueue.a.b.c": ipcNamespace,
"foo": UnknownNamespace, "foo": unknownNamespace,
} }
for sysctl, ns := range tests { for sysctl, ns := range tests {

12
pkg/kubelet/sysctl/whitelist.go
View File

@ -58,13 +58,13 @@ func NewWhitelist(patterns []string) (*patternWhitelist, error) {
if strings.HasSuffix(s, "*") { if strings.HasSuffix(s, "*") {
prefix := s[:len(s)-1] prefix := s[:len(s)-1]
ns := NamespacedBy(prefix) ns := NamespacedBy(prefix)
if ns == UnknownNamespace { if ns == unknownNamespace {
return nil, fmt.Errorf("the sysctls %q are not known to be namespaced", s) return nil, fmt.Errorf("the sysctls %q are not known to be namespaced", s)
} }
w.prefixes[prefix] = ns w.prefixes[prefix] = ns
} else { } else {
ns := NamespacedBy(s) ns := NamespacedBy(s)
if ns == UnknownNamespace { if ns == unknownNamespace {
return nil, fmt.Errorf("the sysctl %q are not known to be namespaced", s) return nil, fmt.Errorf("the sysctl %q are not known to be namespaced", s)
} }
w.sysctls[s] = ns w.sysctls[s] = ns
@ -83,20 +83,20 @@ func NewWhitelist(patterns []string) (*patternWhitelist, error) {
func (w *patternWhitelist) validateSysctl(sysctl string, hostNet, hostIPC bool) error { func (w *patternWhitelist) validateSysctl(sysctl string, hostNet, hostIPC bool) error {
nsErrorFmt := "%q not allowed with host %s enabled" nsErrorFmt := "%q not allowed with host %s enabled"
if ns, found := w.sysctls[sysctl]; found { if ns, found := w.sysctls[sysctl]; found {
if ns == IpcNamespace && hostIPC { if ns == ipcNamespace && hostIPC {
return fmt.Errorf(nsErrorFmt, sysctl, ns) return fmt.Errorf(nsErrorFmt, sysctl, ns)
} }
if ns == NetNamespace && hostNet { if ns == netNamespace && hostNet {
return fmt.Errorf(nsErrorFmt, sysctl, ns) return fmt.Errorf(nsErrorFmt, sysctl, ns)
} }
return nil return nil
} }
for p, ns := range w.prefixes { for p, ns := range w.prefixes {
if strings.HasPrefix(sysctl, p) { if strings.HasPrefix(sysctl, p) {
if ns == IpcNamespace && hostIPC { if ns == ipcNamespace && hostIPC {
return fmt.Errorf(nsErrorFmt, sysctl, ns) return fmt.Errorf(nsErrorFmt, sysctl, ns)
} }
if ns == NetNamespace && hostNet { if ns == netNamespace && hostNet {
return fmt.Errorf(nsErrorFmt, sysctl, ns) return fmt.Errorf(nsErrorFmt, sysctl, ns)
} }
return nil return nil