github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-04 09:49:50 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #130394 from Barakmor1/psa

Browse Source 
[BugFix]Allow ImageVolume for Restricted PSA profiles
This commit is contained in:
Kubernetes Prow Robot 2025-02-24 09:26:35 -08:00 committed by GitHub
commit 3985b78f06
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
staging/src/k8s.io/pod-security-admission/policy/check_restrictedVolumes.go
View File

@ -36,6 +36,7 @@ limits usage of inline pod volume sources to:
* csi * csi
* persistentVolumeClaim * persistentVolumeClaim
* ephemeral * ephemeral
* image
**Restricted Fields:** **Restricted Fields:**
@ -95,6 +96,7 @@ func restrictedVolumes_1_0(podMetadata *metav1.ObjectMeta, podSpec *corev1.PodSp
volume.DownwardAPI != nil, volume.DownwardAPI != nil,
volume.EmptyDir != nil, volume.EmptyDir != nil,
volume.Ephemeral != nil, volume.Ephemeral != nil,
volume.Image != nil,
volume.PersistentVolumeClaim != nil, volume.PersistentVolumeClaim != nil,
volume.Projected != nil, volume.Projected != nil,
volume.Secret != nil: volume.Secret != nil:

1
staging/src/k8s.io/pod-security-admission/policy/check_restrictedVolumes_test.go
View File

@ -42,6 +42,7 @@ func TestRestrictedVolumes(t *testing.T) {
{Name: "a6", VolumeSource: corev1.VolumeSource{Projected: &corev1.ProjectedVolumeSource{}}}, {Name: "a6", VolumeSource: corev1.VolumeSource{Projected: &corev1.ProjectedVolumeSource{}}},
{Name: "a7", VolumeSource: corev1.VolumeSource{CSI: &corev1.CSIVolumeSource{}}}, {Name: "a7", VolumeSource: corev1.VolumeSource{CSI: &corev1.CSIVolumeSource{}}},
{Name: "a8", VolumeSource: corev1.VolumeSource{Ephemeral: &corev1.EphemeralVolumeSource{}}}, {Name: "a8", VolumeSource: corev1.VolumeSource{Ephemeral: &corev1.EphemeralVolumeSource{}}},
{Name: "a9", VolumeSource: corev1.VolumeSource{Image: &corev1.ImageVolumeSource{}}},
// known restricted types // known restricted types
{Name: "b1", VolumeSource: corev1.VolumeSource{HostPath: &corev1.HostPathVolumeSource{}}}, {Name: "b1", VolumeSource: corev1.VolumeSource{HostPath: &corev1.HostPathVolumeSource{}}},