github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-09 05:01:46 +00:00
Code Issues Projects Releases Wiki Activity

Add seccomp enforcement and validation based on new GA fields

Browse Source 
Adds seccomp validation.

This ensures that field and annotation values must match when present.

Co-authored-by: Sascha Grunert <sgrunert@suse.com>
This commit is contained in:
Paulo Gomes
2020-06-24 21:37:49 +01:00
parent 865cbf0bdf
commit 8976e3620f
93 changed files with 17247 additions and 15078 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
plugin/pkg/admission/alwayspullimages/admission.go
View File

@@ -66,7 +66,7 @@ func (a *AlwaysPullImages) Admit(ctx context.Context, attributes admission.Attri
return apierrors.NewBadRequest("Resource was marked with kind Pod but was unable to be converted")
}
pods.VisitContainersWithPath(&pod.Spec, func(c *api.Container, _ *field.Path) bool {
pods.VisitContainersWithPath(&pod.Spec, field.NewPath("spec"), func(c *api.Container, _ *field.Path) bool {
c.ImagePullPolicy = api.PullAlways
return true
})
@@ -86,7 +86,7 @@ func (*AlwaysPullImages) Validate(ctx context.Context, attributes admission.Attr
}
var allErrs []error
pods.VisitContainersWithPath(&pod.Spec, func(c *api.Container, p *field.Path) bool {
pods.VisitContainersWithPath(&pod.Spec, field.NewPath("spec"), func(c *api.Container, p *field.Path) bool {
if c.ImagePullPolicy != api.PullAlways {
allErrs = append(allErrs, admission.NewForbidden(attributes,
field.NotSupported(p.Child("imagePullPolicy"), c.ImagePullPolicy, []string{string(api.PullAlways)}),

2
plugin/pkg/admission/podpreset/admission.go
View File

@@ -186,7 +186,7 @@ func safeToApplyPodPresetsOnPod(pod *api.Pod, podPresets []*settingsv1alpha1.Pod
if _, err := mergeVolumes(pod.Spec.Volumes, podPresets); err != nil {
errs = append(errs, err)
}
pods.VisitContainersWithPath(&pod.Spec, func(c *api.Container, _ *field.Path) bool {
pods.VisitContainersWithPath(&pod.Spec, field.NewPath("spec"), func(c *api.Container, _ *field.Path) bool {
if err := safeToApplyPodPresetsOnContainer(c, podPresets); err != nil {
errs = append(errs, err)
}