github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-07 12:11:43 +00:00
Code Issues Projects Releases Wiki Activity

Add seccomp enforcement and validation based on new GA fields

Browse Source 
Adds seccomp validation.

This ensures that field and annotation values must match when present.

Co-authored-by: Sascha Grunert <sgrunert@suse.com>
This commit is contained in:
Paulo Gomes
2020-06-24 21:37:49 +01:00
parent 865cbf0bdf
commit 8976e3620f
93 changed files with 17247 additions and 15078 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
api/openapi-spec/swagger.json generated
View File

@@ -8384,6 +8384,10 @@
"$ref": "#/definitions/io.k8s.api.core.v1.SELinuxOptions",
"description": "The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container."
},
"seccompProfile": {
"$ref": "#/definitions/io.k8s.api.core.v1.SeccompProfile",
"description": "The seccomp options to use by the containers in this pod."
},
"supplementalGroups": {
"description": "A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container.",
"items": {
@@ -9476,6 +9480,31 @@
],
"type": "object"
},
"io.k8s.api.core.v1.SeccompProfile": {
"description": "SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.",
"properties": {
"localhostProfile": {
"description": "localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must only be set if type is \"Localhost\".",
"type": "string"
},
"type": {
"description": "type indicates which kind of seccomp profile will be applied. Valid options are:\n\nLocalhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.",
"type": "string"
}
},
"required": [
"type"
],
"type": "object",
"x-kubernetes-unions": [
{
"discriminator": "type",
"fields-to-discriminateBy": {
"localhostProfile": "LocalhostProfile"
}
}
]
},
"io.k8s.api.core.v1.Secret": {
"description": "Secret holds secret data of a certain type. The total bytes of the values in the Data field must be less than MaxSecretSize bytes.",
"properties": {
@@ -9696,6 +9725,10 @@
"$ref": "#/definitions/io.k8s.api.core.v1.SELinuxOptions",
"description": "The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence."
},
"seccompProfile": {
"$ref": "#/definitions/io.k8s.api.core.v1.SeccompProfile",
"description": "The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options."
},
"windowsOptions": {
"$ref": "#/definitions/io.k8s.api.core.v1.WindowsSecurityContextOptions",
"description": "The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence."