From ca8cffef242d4a57ead2dfb35958ea8ae7d01901 Mon Sep 17 00:00:00 2001 From: Michael Taufen Date: Fri, 17 Nov 2017 17:43:00 -0800 Subject: [PATCH] seccomp is an alpha feature and not feature gated Move SeccompProfileRoot to KubeletFlags and document flag as alpha --- cmd/kubelet/app/options/options.go | 6 +++++- cmd/kubelet/app/server.go | 9 ++++++--- pkg/kubelet/apis/kubeletconfig/helpers.go | 1 - pkg/kubelet/apis/kubeletconfig/helpers_test.go | 1 - pkg/kubelet/apis/kubeletconfig/types.go | 2 -- pkg/kubelet/apis/kubeletconfig/v1alpha1/defaults.go | 4 ---- pkg/kubelet/apis/kubeletconfig/v1alpha1/types.go | 2 -- .../kubeletconfig/v1alpha1/zz_generated.conversion.go | 2 -- pkg/kubelet/kubelet.go | 8 +++++--- 9 files changed, 16 insertions(+), 19 deletions(-) diff --git a/cmd/kubelet/app/options/options.go b/cmd/kubelet/app/options/options.go index e7d0e8ab7e0..9b17a098729 100644 --- a/cmd/kubelet/app/options/options.go +++ b/cmd/kubelet/app/options/options.go @@ -20,6 +20,7 @@ package options import ( "fmt" _ "net/http/pprof" + "path/filepath" "runtime" "strings" @@ -154,6 +155,8 @@ type KubeletFlags struct { // This will cause the kubelet to listen to inotify events on the lock file, // releasing it and exiting when another process tries to open that file. ExitOnLockContention bool + // seccompProfileRoot is the directory path for seccomp profiles. + SeccompProfileRoot string // DEPRECATED FLAGS // minimumGCAge is the minimum age for a finished container before it is @@ -214,6 +217,7 @@ func NewKubeletFlags() *KubeletFlags { NodeLabels: make(map[string]string), VolumePluginDir: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/", RegisterNode: true, + SeccompProfileRoot: filepath.Join(v1alpha1.DefaultRootDir, "seccomp"), } } @@ -338,6 +342,7 @@ func (f *KubeletFlags) AddFlags(fs *pflag.FlagSet) { fs.StringVar(&f.VolumePluginDir, "volume-plugin-dir", f.VolumePluginDir, " The full path of the directory in which to search for additional third party volume plugins") fs.StringVar(&f.LockFilePath, "lock-file", f.LockFilePath, " The path to file for kubelet to use as a lock file.") fs.BoolVar(&f.ExitOnLockContention, "exit-on-lock-contention", f.ExitOnLockContention, "Whether kubelet should exit upon lock-file contention.") + fs.StringVar(&f.SeccompProfileRoot, "seccomp-profile-root", f.SeccompProfileRoot, " Directory path for seccomp profiles.") // DEPRECATED FLAGS fs.DurationVar(&f.MinimumGCAge.Duration, "minimum-container-ttl-duration", f.MinimumGCAge.Duration, "Minimum age for a finished container before it is garbage collected. Examples: '300ms', '10s' or '2h45m'") @@ -405,7 +410,6 @@ func AddKubeletConfigFlags(fs *pflag.FlagSet, c *kubeletconfig.KubeletConfigurat "are generated for the public address and saved to the directory passed to --cert-dir.") fs.StringVar(&c.TLSPrivateKeyFile, "tls-private-key-file", c.TLSPrivateKeyFile, "File containing x509 private key matching --tls-cert-file.") - fs.StringVar(&c.SeccompProfileRoot, "seccomp-profile-root", c.SeccompProfileRoot, "Directory path for seccomp profiles.") fs.BoolVar(&c.AllowPrivileged, "allow-privileged", c.AllowPrivileged, "If true, allow containers to request privileged mode.") fs.StringSliceVar(&c.HostNetworkSources, "host-network-sources", c.HostNetworkSources, "Comma-separated list of sources from which the Kubelet allows pods to use of host network.") fs.StringSliceVar(&c.HostPIDSources, "host-pid-sources", c.HostPIDSources, "Comma-separated list of sources from which the Kubelet allows pods to use the host pid namespace.") diff --git a/cmd/kubelet/app/server.go b/cmd/kubelet/app/server.go index c9534d35067..d9f46853672 100644 --- a/cmd/kubelet/app/server.go +++ b/cmd/kubelet/app/server.go @@ -728,7 +728,8 @@ func RunKubelet(kubeFlags *options.KubeletFlags, kubeCfg *kubeletconfiginternal. kubeFlags.RegisterSchedulable, kubeFlags.NonMasqueradeCIDR, kubeFlags.KeepTerminatedPodVolumes, - kubeFlags.NodeLabels) + kubeFlags.NodeLabels, + kubeFlags.SeccompProfileRoot) if err != nil { return fmt.Errorf("failed to create kubelet: %v", err) } @@ -800,7 +801,8 @@ func CreateAndInitKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, registerSchedulable bool, nonMasqueradeCIDR string, keepTerminatedPodVolumes bool, - nodeLabels map[string]string) (k kubelet.Bootstrap, err error) { + nodeLabels map[string]string, + seccompProfileRoot string) (k kubelet.Bootstrap, err error) { // TODO: block until all sources have delivered at least one update to the channel, or break the sync loop // up into "per source" synchronizations @@ -832,7 +834,8 @@ func CreateAndInitKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, registerSchedulable, nonMasqueradeCIDR, keepTerminatedPodVolumes, - nodeLabels) + nodeLabels, + seccompProfileRoot) if err != nil { return nil, err } diff --git a/pkg/kubelet/apis/kubeletconfig/helpers.go b/pkg/kubelet/apis/kubeletconfig/helpers.go index e8b5c439858..392dd4ea2c5 100644 --- a/pkg/kubelet/apis/kubeletconfig/helpers.go +++ b/pkg/kubelet/apis/kubeletconfig/helpers.go @@ -25,7 +25,6 @@ func KubeletConfigurationPathRefs(kc *KubeletConfiguration) []*string { paths = append(paths, &kc.Authentication.X509.ClientCAFile) paths = append(paths, &kc.TLSCertFile) paths = append(paths, &kc.TLSPrivateKeyFile) - paths = append(paths, &kc.SeccompProfileRoot) paths = append(paths, &kc.ResolverConfig) return paths } diff --git a/pkg/kubelet/apis/kubeletconfig/helpers_test.go b/pkg/kubelet/apis/kubeletconfig/helpers_test.go index 3cde31ddee4..5bf10e67a3a 100644 --- a/pkg/kubelet/apis/kubeletconfig/helpers_test.go +++ b/pkg/kubelet/apis/kubeletconfig/helpers_test.go @@ -132,7 +132,6 @@ var ( "Authentication.X509.ClientCAFile", "TLSCertFile", "TLSPrivateKeyFile", - "SeccompProfileRoot", "ResolverConfig", ) diff --git a/pkg/kubelet/apis/kubeletconfig/types.go b/pkg/kubelet/apis/kubeletconfig/types.go index ef44ccde126..3b7f42509a5 100644 --- a/pkg/kubelet/apis/kubeletconfig/types.go +++ b/pkg/kubelet/apis/kubeletconfig/types.go @@ -89,8 +89,6 @@ type KubeletConfiguration struct { Authentication KubeletAuthentication // authorization specifies how requests to the Kubelet's server are authorized Authorization KubeletAuthorization - // seccompProfileRoot is the directory path for seccomp profiles. - SeccompProfileRoot string // allowPrivileged enables containers to request privileged mode. // Defaults to false. AllowPrivileged bool diff --git a/pkg/kubelet/apis/kubeletconfig/v1alpha1/defaults.go b/pkg/kubelet/apis/kubeletconfig/v1alpha1/defaults.go index e53665a90c1..e14cdf3fff0 100644 --- a/pkg/kubelet/apis/kubeletconfig/v1alpha1/defaults.go +++ b/pkg/kubelet/apis/kubeletconfig/v1alpha1/defaults.go @@ -17,7 +17,6 @@ limitations under the License. package v1alpha1 import ( - "path/filepath" "time" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -177,9 +176,6 @@ func SetDefaults_KubeletConfiguration(obj *KubeletConfiguration) { if obj.SerializeImagePulls == nil { obj.SerializeImagePulls = boolVar(true) } - if obj.SeccompProfileRoot == "" { - obj.SeccompProfileRoot = filepath.Join(DefaultRootDir, "seccomp") - } if obj.StreamingConnectionIdleTimeout == zeroDuration { obj.StreamingConnectionIdleTimeout = metav1.Duration{Duration: 4 * time.Hour} } diff --git a/pkg/kubelet/apis/kubeletconfig/v1alpha1/types.go b/pkg/kubelet/apis/kubeletconfig/v1alpha1/types.go index 4880b83794e..0c661f8a0ee 100644 --- a/pkg/kubelet/apis/kubeletconfig/v1alpha1/types.go +++ b/pkg/kubelet/apis/kubeletconfig/v1alpha1/types.go @@ -89,8 +89,6 @@ type KubeletConfiguration struct { Authentication KubeletAuthentication `json:"authentication"` // authorization specifies how requests to the Kubelet's server are authorized Authorization KubeletAuthorization `json:"authorization"` - // seccompProfileRoot is the directory path for seccomp profiles. - SeccompProfileRoot string `json:"seccompProfileRoot"` // allowPrivileged enables containers to request privileged mode. // Defaults to false. AllowPrivileged *bool `json:"allowPrivileged"` diff --git a/pkg/kubelet/apis/kubeletconfig/v1alpha1/zz_generated.conversion.go b/pkg/kubelet/apis/kubeletconfig/v1alpha1/zz_generated.conversion.go index d4a086bcf35..b4701bb564c 100644 --- a/pkg/kubelet/apis/kubeletconfig/v1alpha1/zz_generated.conversion.go +++ b/pkg/kubelet/apis/kubeletconfig/v1alpha1/zz_generated.conversion.go @@ -163,7 +163,6 @@ func autoConvert_v1alpha1_KubeletConfiguration_To_kubeletconfig_KubeletConfigura if err := Convert_v1alpha1_KubeletAuthorization_To_kubeletconfig_KubeletAuthorization(&in.Authorization, &out.Authorization, s); err != nil { return err } - out.SeccompProfileRoot = in.SeccompProfileRoot if err := v1.Convert_Pointer_bool_To_bool(&in.AllowPrivileged, &out.AllowPrivileged, s); err != nil { return err } @@ -289,7 +288,6 @@ func autoConvert_kubeletconfig_KubeletConfiguration_To_v1alpha1_KubeletConfigura if err := Convert_kubeletconfig_KubeletAuthorization_To_v1alpha1_KubeletAuthorization(&in.Authorization, &out.Authorization, s); err != nil { return err } - out.SeccompProfileRoot = in.SeccompProfileRoot if err := v1.Convert_bool_To_Pointer_bool(&in.AllowPrivileged, &out.AllowPrivileged, s); err != nil { return err } diff --git a/pkg/kubelet/kubelet.go b/pkg/kubelet/kubelet.go index 9b6ed93ee9b..68aef5b2078 100644 --- a/pkg/kubelet/kubelet.go +++ b/pkg/kubelet/kubelet.go @@ -218,7 +218,8 @@ type Builder func(kubeCfg *kubeletconfiginternal.KubeletConfiguration, registerSchedulable bool, nonMasqueradeCIDR string, keepTerminatedPodVolumes bool, - nodeLabels map[string]string) (Bootstrap, error) + nodeLabels map[string]string, + seccompProfileRoot string) (Bootstrap, error) // Dependencies is a bin for things we might consider "injected dependencies" -- objects constructed // at runtime that are necessary for running the Kubelet. This is a temporary solution for grouping @@ -344,7 +345,8 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, registerSchedulable bool, nonMasqueradeCIDR string, keepTerminatedPodVolumes bool, - nodeLabels map[string]string) (*Kubelet, error) { + nodeLabels map[string]string, + seccompProfileRoot string) (*Kubelet, error) { if rootDirectory == "" { return nil, fmt.Errorf("invalid root directory %q", rootDirectory) } @@ -658,7 +660,7 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, runtime, err := kuberuntime.NewKubeGenericRuntimeManager( kubecontainer.FilterEventRecorder(kubeDeps.Recorder), klet.livenessManager, - kubeCfg.SeccompProfileRoot, + seccompProfileRoot, containerRefManager, machineInfo, klet,