github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 02:41:25 +00:00
Code Issues Projects Releases Wiki Activity

Add a SecurityContextDeny feature gate disabled by default

Browse Source 
Put plugin registration behind the feature gate.
This commit is contained in:
mtardy 2023-03-10 18:01:48 +01:00
parent 5049382a81
commit 36a2156033
2 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/features/kube_features.go
View File

@ -691,6 +691,14 @@ const (
// Enables the use of `RuntimeDefault` as the default seccomp profile for all workloads. // Enables the use of `RuntimeDefault` as the default seccomp profile for all workloads.
SeccompDefault featuregate.Feature = "SeccompDefault" SeccompDefault featuregate.Feature = "SeccompDefault"
// owner: @mtardy
// alpha: v1.0
//
// Putting this admission plugin behind a feature gate is part of the
// deprecation process. For details about the removal see:
// https://github.com/kubernetes/kubernetes/issues/111516
SecurityContextDeny featuregate.Feature = "SecurityContextDeny"
// owner: @maplain @andrewsykim // owner: @maplain @andrewsykim
// kep: https://kep.k8s.io/2086 // kep: https://kep.k8s.io/2086
// alpha: v1.21 // alpha: v1.21
@ -1022,6 +1030,8 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS
SeccompDefault: {Default: true, PreRelease: featuregate.Beta}, SeccompDefault: {Default: true, PreRelease: featuregate.Beta},
SecurityContextDeny: {Default: false, PreRelease: featuregate.Alpha},
ServiceIPStaticSubrange: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.28 ServiceIPStaticSubrange: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.28
ServiceInternalTrafficPolicy: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.28 ServiceInternalTrafficPolicy: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.28

12
plugin/pkg/admission/securitycontext/scdeny/admission.go
View File

@ -23,17 +23,25 @@ import (
apierrors "k8s.io/apimachinery/pkg/api/errors" apierrors "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/admission"
utilfeature "k8s.io/apiserver/pkg/util/feature"
"k8s.io/klog/v2" "k8s.io/klog/v2"
api "k8s.io/kubernetes/pkg/apis/core" api "k8s.io/kubernetes/pkg/apis/core"
"k8s.io/kubernetes/pkg/features"
) )
// PluginName indicates name of admission plugin. // PluginName indicates name of admission plugin.
const PluginName = "SecurityContextDeny" const PluginName = "SecurityContextDeny"
const docLink = "https://k8s.io/docs/reference/access-authn-authz/admission-controllers/#securitycontextdeny"
// Register registers a plugin // Register registers a plugin
func Register(plugins *admission.Plugins) { func Register(plugins *admission.Plugins) {
plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) { plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
if utilfeature.DefaultFeatureGate.Enabled(features.SecurityContextDeny) {
return NewSecurityContextDeny(), nil return NewSecurityContextDeny(), nil
} else {
return nil, fmt.Errorf("%s admission controller is an alpha feature, planned to be removed, and requires the SecurityContextDeny feature gate to be enabled, see %s for more information", PluginName, docLink)
}
}) })
} }
@ -49,8 +57,8 @@ func NewSecurityContextDeny() *Plugin {
// DEPRECATED: SecurityContextDeny will be removed in favor of PodSecurity admission. // DEPRECATED: SecurityContextDeny will be removed in favor of PodSecurity admission.
klog.Warningf("%s admission controller is deprecated. "+ klog.Warningf("%s admission controller is deprecated. "+
"Please remove this controller from your configuration files and scripts. "+ "Please remove this controller from your configuration files and scripts. "+
"See https://k8s.io/docs/reference/access-authn-authz/admission-controllers/#securitycontextdeny for more information.", "See %s for more information.",
PluginName) PluginName, docLink)
return &Plugin{ return &Plugin{
Handler: admission.NewHandler(admission.Create, admission.Update), Handler: admission.NewHandler(admission.Create, admission.Update),
} }