github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-31 15:25:57 +00:00
Code Issues Projects Releases Wiki Activity

Default to sandbox Seccomp field instead of SeccompProfilePath

Browse Source 
The seccomp field is the new default since a couple of releases, means
we can stop using `SeccompProfilePath`.

Follow-up on https://github.com/kubernetes/kubernetes/pull/96281

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
This commit is contained in:
Sascha Grunert 2023-02-20 10:48:23 +01:00
parent 9e356a4132
commit 58923c9f1a
No known key found for this signature in database
GPG Key ID: 09D97D153EF94D93
2 changed files with 8 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/kubelet/kuberuntime/kuberuntime_sandbox.go
View File

@ -168,11 +168,8 @@ func (m *kubeGenericRuntimeManager) generatePodSandboxLinuxConfig(pod *v1.Pod) (
SecurityContext: &runtimeapi.LinuxSandboxSecurityContext{
Privileged: kubecontainer.HasPrivilegedContainer(pod),
// TODO: Deprecated, remove after we switch to Seccomp field
// Forcing sandbox to run as `runtime/default` allow users to
// use least privileged seccomp profiles at pod level. Issue #84623
SeccompProfilePath: v1.SeccompProfileRuntimeDefault,
Seccomp: &runtimeapi.SecurityProfile{
ProfileType: runtimeapi.SecurityProfile_RuntimeDefault,
},

16
pkg/kubelet/kuberuntime/kuberuntime_sandbox_test.go
View File

@ -67,39 +67,39 @@ func TestGeneratePodSandboxLinuxConfigSeccomp(t *testing.T) {
tests := []struct {
description string
pod *v1.Pod
expectedProfile string
expectedProfile v1.SeccompProfileType
}{
{
description: "no seccomp defined at pod level should return runtime/default",
pod: newSeccompPod(nil, nil, "", "runtime/default"),
expectedProfile: "runtime/default",
expectedProfile: v1.SeccompProfileTypeRuntimeDefault,
},
{
description: "seccomp field defined at pod level should not be honoured",
pod: newSeccompPod(&v1.SeccompProfile{Type: v1.SeccompProfileTypeUnconfined}, nil, "", ""),
expectedProfile: "runtime/default",
expectedProfile: v1.SeccompProfileTypeRuntimeDefault,
},
{
description: "seccomp field defined at container level should not be honoured",
pod: newSeccompPod(nil, &v1.SeccompProfile{Type: v1.SeccompProfileTypeUnconfined}, "", ""),
expectedProfile: "runtime/default",
expectedProfile: v1.SeccompProfileTypeRuntimeDefault,
},
{
description: "seccomp annotation defined at pod level should not be honoured",
pod: newSeccompPod(nil, nil, "unconfined", ""),
expectedProfile: "runtime/default",
expectedProfile: v1.SeccompProfileTypeRuntimeDefault,
},
{
description: "seccomp annotation defined at container level should not be honoured",
pod: newSeccompPod(nil, nil, "", "unconfined"),
expectedProfile: "runtime/default",
expectedProfile: v1.SeccompProfileTypeRuntimeDefault,
},
}
for i, test := range tests {
config, _ := m.generatePodSandboxLinuxConfig(test.pod)
actualProfile := config.SecurityContext.SeccompProfilePath
assert.Equal(t, test.expectedProfile, actualProfile, "TestCase[%d]: %s", i, test.description)
actualProfile := config.SecurityContext.Seccomp.ProfileType.String()
assert.EqualValues(t, test.expectedProfile, actualProfile, "TestCase[%d]: %s", i, test.description)
}
}