github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 04:33:26 +00:00
Code Issues Projects Releases Wiki Activity

remove featuregate for sysctl

Browse Source 
Co-authored-by: Skyler Clark <wgahnagl@protonmail.com>
This commit is contained in:
pacoxu 2021-02-22 14:00:17 +08:00 committed by Skyler Clark
parent b1f2960160
commit 3de4dd841f
No known key found for this signature in database
GPG Key ID: 29DFC2CA7266C03B
4 changed files with 10 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/api/pod/util.go
View File

@ -447,12 +447,6 @@ func dropDisabledFields(
} }
} }
if !utilfeature.DefaultFeatureGate.Enabled(features.Sysctls) && !sysctlsInUse(oldPodSpec) {
if podSpec.SecurityContext != nil {
podSpec.SecurityContext.Sysctls = nil
}
}
if !utilfeature.DefaultFeatureGate.Enabled(features.LocalStorageCapacityIsolation) && !emptyDirSizeLimitInUse(oldPodSpec) { if !utilfeature.DefaultFeatureGate.Enabled(features.LocalStorageCapacityIsolation) && !emptyDirSizeLimitInUse(oldPodSpec) {
for i := range podSpec.Volumes { for i := range podSpec.Volumes {
if podSpec.Volumes[i].EmptyDir != nil { if podSpec.Volumes[i].EmptyDir != nil {
@ -648,16 +642,6 @@ func podPriorityInUse(podSpec *api.PodSpec) bool {
return false return false
} }
func sysctlsInUse(podSpec *api.PodSpec) bool {
if podSpec == nil {
return false
}
if podSpec.SecurityContext != nil && podSpec.SecurityContext.Sysctls != nil {
return true
}
return false
}
// emptyDirSizeLimitInUse returns true if any pod's EmptyDir volumes use SizeLimit. // emptyDirSizeLimitInUse returns true if any pod's EmptyDir volumes use SizeLimit.
func emptyDirSizeLimitInUse(podSpec *api.PodSpec) bool { func emptyDirSizeLimitInUse(podSpec *api.PodSpec) bool {
if podSpec == nil { if podSpec == nil {

14
pkg/api/podsecuritypolicy/util.go
View File

@ -28,10 +28,6 @@ func DropDisabledFields(pspSpec, oldPSPSpec *policy.PodSecurityPolicySpec) {
if !utilfeature.DefaultFeatureGate.Enabled(features.ProcMountType) && !allowedProcMountTypesInUse(oldPSPSpec) { if !utilfeature.DefaultFeatureGate.Enabled(features.ProcMountType) && !allowedProcMountTypesInUse(oldPSPSpec) {
pspSpec.AllowedProcMountTypes = nil pspSpec.AllowedProcMountTypes = nil
} }
if !utilfeature.DefaultFeatureGate.Enabled(features.Sysctls) && !sysctlsInUse(oldPSPSpec) {
pspSpec.AllowedUnsafeSysctls = nil
pspSpec.ForbiddenSysctls = nil
}
if !utilfeature.DefaultFeatureGate.Enabled(features.CSIInlineVolume) { if !utilfeature.DefaultFeatureGate.Enabled(features.CSIInlineVolume) {
pspSpec.AllowedCSIDrivers = nil pspSpec.AllowedCSIDrivers = nil
} }
@ -49,13 +45,3 @@ func allowedProcMountTypesInUse(oldPSPSpec *policy.PodSecurityPolicySpec) bool {
return false return false
} }
func sysctlsInUse(oldPSPSpec *policy.PodSecurityPolicySpec) bool {
if oldPSPSpec == nil {
return false
}
if oldPSPSpec.AllowedUnsafeSysctls != nil || oldPSPSpec.ForbiddenSysctls != nil {
return true
}
return false
}

16
pkg/kubelet/kubelet.go
View File

@ -775,16 +775,14 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration,
klet.evictionManager = evictionManager klet.evictionManager = evictionManager
klet.admitHandlers.AddPodAdmitHandler(evictionAdmitHandler) klet.admitHandlers.AddPodAdmitHandler(evictionAdmitHandler)
if utilfeature.DefaultFeatureGate.Enabled(features.Sysctls) { // Safe, whitelisted sysctls can always be used as unsafe sysctls in the spec.
// Safe, whitelisted sysctls can always be used as unsafe sysctls in the spec. // Hence, we concatenate those two lists.
// Hence, we concatenate those two lists. safeAndUnsafeSysctls := append(sysctlwhitelist.SafeSysctlWhitelist(), allowedUnsafeSysctls...)
safeAndUnsafeSysctls := append(sysctlwhitelist.SafeSysctlWhitelist(), allowedUnsafeSysctls...) sysctlsWhitelist, err := sysctl.NewWhitelist(safeAndUnsafeSysctls)
sysctlsWhitelist, err := sysctl.NewWhitelist(safeAndUnsafeSysctls) if err != nil {
if err != nil { return nil, err
return nil, err
}
klet.admitHandlers.AddPodAdmitHandler(sysctlsWhitelist)
} }
klet.admitHandlers.AddPodAdmitHandler(sysctlsWhitelist)
// enable active deadline handler // enable active deadline handler
activeDeadlineHandler, err := newActiveDeadlineHandler(klet.statusManager, kubeDeps.Recorder, klet.clock) activeDeadlineHandler, err := newActiveDeadlineHandler(klet.statusManager, kubeDeps.Recorder, klet.clock)

10
pkg/kubelet/kuberuntime/kuberuntime_sandbox.go
View File

@ -25,10 +25,8 @@ import (
v1 "k8s.io/api/core/v1" v1 "k8s.io/api/core/v1"
kubetypes "k8s.io/apimachinery/pkg/types" kubetypes "k8s.io/apimachinery/pkg/types"
utilfeature "k8s.io/apiserver/pkg/util/feature"
runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1alpha2" runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
"k8s.io/klog/v2" "k8s.io/klog/v2"
"k8s.io/kubernetes/pkg/features"
kubecontainer "k8s.io/kubernetes/pkg/kubelet/container" kubecontainer "k8s.io/kubernetes/pkg/kubelet/container"
"k8s.io/kubernetes/pkg/kubelet/types" "k8s.io/kubernetes/pkg/kubelet/types"
"k8s.io/kubernetes/pkg/kubelet/util" "k8s.io/kubernetes/pkg/kubelet/util"
@ -166,11 +164,9 @@ func (m *kubeGenericRuntimeManager) generatePodSandboxLinuxConfig(pod *v1.Pod) (
} }
sysctls := make(map[string]string) sysctls := make(map[string]string)
if utilfeature.DefaultFeatureGate.Enabled(features.Sysctls) { if pod.Spec.SecurityContext != nil {
if pod.Spec.SecurityContext != nil { for _, c := range pod.Spec.SecurityContext.Sysctls {
for _, c := range pod.Spec.SecurityContext.Sysctls { sysctls[c.Name] = c.Value
sysctls[c.Name] = c.Value
}
} }
} }