github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-01 15:58:37 +00:00
Code Issues Projects Releases Wiki Activity

Append "AppArmor enabled" to the Node ready condition message

Browse Source
This commit is contained in:
Tim St. Clair 2016-08-29 17:54:15 -07:00
parent d0a2d17ec1
commit 3808243b9e
No known key found for this signature in database
GPG Key ID: 434D16BCEF479EAB
4 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/kubelet/kubelet.go
View File

@ -77,6 +77,7 @@ import (
"k8s.io/kubernetes/pkg/kubelet/util/sliceutils"
"k8s.io/kubernetes/pkg/kubelet/volumemanager"
"k8s.io/kubernetes/pkg/runtime"
"k8s.io/kubernetes/pkg/security/apparmor"
"k8s.io/kubernetes/pkg/types"
"k8s.io/kubernetes/pkg/util/bandwidth"
"k8s.io/kubernetes/pkg/util/clock"
@ -736,7 +737,8 @@ func NewMainKubelet(kubeCfg *componentconfig.KubeletConfiguration, kubeDeps *Kub
klet.AddPodSyncLoopHandler(activeDeadlineHandler)
klet.AddPodSyncHandler(activeDeadlineHandler)
klet.AddPodAdmitHandler(lifecycle.NewAppArmorAdmitHandler(kubeCfg.ContainerRuntime))
klet.appArmorValidator = apparmor.NewValidator(kubeCfg.ContainerRuntime)
klet.AddPodAdmitHandler(lifecycle.NewAppArmorAdmitHandler(klet.appArmorValidator))
// apply functional Option's
for _, opt := range kubeDeps.Options {
@ -1041,6 +1043,9 @@ type Kubelet struct {
// The bit of the fwmark space to mark packets for dropping.
iptablesDropBit int
// The AppArmor validator for checking whether AppArmor is supported.
appArmorValidator apparmor.Validator
}
// setupDataDirs creates:

7
pkg/kubelet/kubelet_node_status.go
View File

@ -489,6 +489,13 @@ func (kl *Kubelet) setNodeReadyCondition(node *api.Node) {
}
}
// Append AppArmor status if it's enabled.
// TODO(timstclair): This is a temporary message until node feature reporting is added.
if newNodeReadyCondition.Status == api.ConditionTrue &&
kl.appArmorValidator != nil && kl.appArmorValidator.ValidateHost() == nil {
newNodeReadyCondition.Message = fmt.Sprintf("%s. AppArmor enabled", newNodeReadyCondition.Message)
}
// Record any soft requirements that were not met in the container manager.
status := kl.containerManager.Status()
if status.SoftRequirements != nil {

4
pkg/kubelet/lifecycle/handlers.go
View File

@ -144,9 +144,9 @@ func getHttpRespBody(resp *http.Response) string {
return ""
}
func NewAppArmorAdmitHandler(runtime string) PodAdmitHandler {
func NewAppArmorAdmitHandler(validator apparmor.Validator) PodAdmitHandler {
return &appArmorAdmitHandler{
Validator: apparmor.NewValidator(runtime),
Validator: validator,
}
}

7
pkg/security/apparmor/validate.go
View File

@ -37,6 +37,7 @@ var isDisabledBuild bool
// Interface for validating that a pod with with an AppArmor profile can be run by a Node.
type Validator interface {
Validate(pod *api.Pod) error
ValidateHost() error
}
func NewValidator(runtime string) Validator {
@ -64,7 +65,7 @@ func (v *validator) Validate(pod *api.Pod) error {
return nil
}
if v.validateHostErr != nil {
if v.ValidateHost() != nil {
return v.validateHostErr
}
@ -87,6 +88,10 @@ func (v *validator) Validate(pod *api.Pod) error {
return nil
}
func (v *validator) ValidateHost() error {
return v.validateHostErr
}
// Verify that the host and runtime is capable of enforcing AppArmor profiles.
func validateHost(runtime string) error {
// Check feature-gates