Add a flag to reject privileged containers in the apiserver.

pkg/api/validation/validation.go

@@ -21,6 +21,7 @@ import (
 
 	"github.com/GoogleCloudPlatform/kubernetes/pkg/api"
 	errs "github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/capabilities"
 	"github.com/GoogleCloudPlatform/kubernetes/pkg/labels"
 	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"
 )
@@ -226,12 +227,15 @@ func validateContainers(containers []api.Container, volumes util.StringSet) errs
 	for i := range containers {
 		cErrs := errs.ErrorList{}
 		ctr := &containers[i] // so we can set default values
+		capabilities := capabilities.GetCapabilities()
 		if len(ctr.Name) == 0 {
 			cErrs = append(cErrs, errs.NewFieldRequired("name", ctr.Name))
 		} else if !util.IsDNSLabel(ctr.Name) {
 			cErrs = append(cErrs, errs.NewFieldInvalid("name", ctr.Name))
 		} else if allNames.Has(ctr.Name) {
 			cErrs = append(cErrs, errs.NewFieldDuplicate("name", ctr.Name))
+		} else if ctr.Privileged && !capabilities.AllowPrivileged {
+			cErrs = append(cErrs, errs.NewFieldInvalid("privileged", ctr.Privileged))
 		} else {
 			allNames.Insert(ctr.Name)
 		}

pkg/api/validation/validation_test.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/GoogleCloudPlatform/kubernetes/pkg/api"
 	"github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/capabilities"
 	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"
 )
 
@@ -179,6 +180,9 @@ func TestValidateVolumeMounts(t *testing.T) {
 
 func TestValidateContainers(t *testing.T) {
 	volumes := util.StringSet{}
+	capabilities.SetCapabilitiesForTests(capabilities.Capabilities{
+		AllowPrivileged: true,
+	})
 
 	successCase := []api.Container{
 		{Name: "abc", Image: "image"},
@@ -193,11 +197,15 @@ func TestValidateContainers(t *testing.T) {
 				},
 			},
 		},
+		{Name: "abc-1234", Image: "image", Privileged: true},
 	}
 	if errs := validateContainers(successCase, volumes); len(errs) != 0 {
 		t.Errorf("expected success: %v", errs)
 	}
 
+	capabilities.SetCapabilitiesForTests(capabilities.Capabilities{
+		AllowPrivileged: false,
+	})
 	errorCases := map[string][]api.Container{
 		"zero-length name":     {{Name: "", Image: "image"}},
 		"name > 63 characters": {{Name: strings.Repeat("a", 64), Image: "image"}},
@@ -248,6 +256,9 @@ func TestValidateContainers(t *testing.T) {
 				},
 			},
 		},
+		"privilege disabled": {
+			{Name: "abc", Image: "image", Privileged: true},
+		},
 	}
 	for k, v := range errorCases {
 		if errs := validateContainers(v, volumes); len(errs) == 0 {