From e102633ae82b2a90e946c8bc6fbd99eb5dd0efb4 Mon Sep 17 00:00:00 2001 From: Zhen Wang Date: Thu, 19 Apr 2018 10:39:53 -0700 Subject: [PATCH] Change docker/default to runtime/default --- pkg/apis/core/annotation_key_constants.go | 7 ++++++ pkg/apis/core/validation/validation.go | 2 +- pkg/apis/core/validation/validation_test.go | 12 +++++++++- pkg/apis/policy/validation/validation_test.go | 6 ++--- .../apis/cri/runtime/v1alpha2/api.pb.go | 4 ++-- .../apis/cri/runtime/v1alpha2/api.proto | 4 ++-- pkg/kubelet/dockershim/BUILD | 7 +++++- pkg/kubelet/dockershim/helpers_linux.go | 3 ++- pkg/kubelet/dockershim/helpers_linux_test.go | 7 +++++- pkg/kubelet/kuberuntime/helpers_test.go | 23 +++++++++++++++---- .../api/core/v1/annotation_key_constants.go | 7 ++++++ test/e2e/auth/pod_security_policy.go | 10 ++++---- test/e2e/node/security_context.go | 6 ++--- test/test_owners.csv | 2 +- 14 files changed, 75 insertions(+), 25 deletions(-) diff --git a/pkg/apis/core/annotation_key_constants.go b/pkg/apis/core/annotation_key_constants.go index 131fdd9905e..cfebd86a4b1 100644 --- a/pkg/apis/core/annotation_key_constants.go +++ b/pkg/apis/core/annotation_key_constants.go @@ -45,6 +45,13 @@ const ( // to one container of a pod. SeccompContainerAnnotationKeyPrefix string = "container.seccomp.security.alpha.kubernetes.io/" + // SeccompProfileRuntimeDefault represents the default seccomp profile used by container runtime. + SeccompProfileRuntimeDefault string = "runtime/default" + + // DeprecatedSeccompProfileDockerDefault represents the default seccomp profile used by docker. + // This is now deprecated and should be replaced by SeccompProfileRuntimeDefault. + DeprecatedSeccompProfileDockerDefault string = "docker/default" + // PreferAvoidPodsAnnotationKey represents the key of preferAvoidPods data (json serialized) // in the Annotations of a Node. PreferAvoidPodsAnnotationKey string = "scheduler.alpha.kubernetes.io/preferAvoidPods" diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index bcef7e324c5..92f9b0ff81a 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -3173,7 +3173,7 @@ func validatePodAffinity(podAffinity *core.PodAffinity, fldPath *field.Path) fie } func ValidateSeccompProfile(p string, fldPath *field.Path) field.ErrorList { - if p == "docker/default" { + if p == core.SeccompProfileRuntimeDefault || p == core.DeprecatedSeccompProfileDockerDefault { return nil } if p == "unconfined" { diff --git a/pkg/apis/core/validation/validation_test.go b/pkg/apis/core/validation/validation_test.go index 8d15e052ee8..5b662075634 100644 --- a/pkg/apis/core/validation/validation_test.go +++ b/pkg/apis/core/validation/validation_test.go @@ -6276,12 +6276,22 @@ func TestValidatePod(t *testing.T) { }, Spec: extendPodSpecwithTolerations(validPodSpec(nil), []core.Toleration{{Key: "node.kubernetes.io/not-ready", Operator: "Exists", Effect: "NoExecute", TolerationSeconds: &[]int64{-2}[0]}}), }, + { // runtime default seccomp profile + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + Annotations: map[string]string{ + core.SeccompPodAnnotationKey: core.SeccompProfileRuntimeDefault, + }, + }, + Spec: validPodSpec(nil), + }, { // docker default seccomp profile ObjectMeta: metav1.ObjectMeta{ Name: "123", Namespace: "ns", Annotations: map[string]string{ - core.SeccompPodAnnotationKey: "docker/default", + core.SeccompPodAnnotationKey: core.DeprecatedSeccompProfileDockerDefault, }, }, Spec: validPodSpec(nil), diff --git a/pkg/apis/policy/validation/validation_test.go b/pkg/apis/policy/validation/validation_test.go index 2d0e943f91f..0f1c58212f2 100644 --- a/pkg/apis/policy/validation/validation_test.go +++ b/pkg/apis/policy/validation/validation_test.go @@ -336,7 +336,7 @@ func TestValidatePodSecurityPolicy(t *testing.T) { } invalidSeccompAllowed := validPSP() invalidSeccompAllowed.Annotations = map[string]string{ - seccomp.AllowedProfilesAnnotationKey: "docker/default,not-good", + seccomp.AllowedProfilesAnnotationKey: api.SeccompProfileRuntimeDefault + ",not-good", } invalidAllowedHostPathMissingPath := validPSP() @@ -566,8 +566,8 @@ func TestValidatePodSecurityPolicy(t *testing.T) { validSeccomp := validPSP() validSeccomp.Annotations = map[string]string{ - seccomp.DefaultProfileAnnotationKey: "docker/default", - seccomp.AllowedProfilesAnnotationKey: "docker/default,unconfined,localhost/foo,*", + seccomp.DefaultProfileAnnotationKey: api.SeccompProfileRuntimeDefault, + seccomp.AllowedProfilesAnnotationKey: api.SeccompProfileRuntimeDefault + ",unconfined,localhost/foo,*", } validDefaultAllowPrivilegeEscalation := validPSP() diff --git a/pkg/kubelet/apis/cri/runtime/v1alpha2/api.pb.go b/pkg/kubelet/apis/cri/runtime/v1alpha2/api.pb.go index 7c1e4d2da6e..826b3ec483b 100644 --- a/pkg/kubelet/apis/cri/runtime/v1alpha2/api.pb.go +++ b/pkg/kubelet/apis/cri/runtime/v1alpha2/api.pb.go @@ -572,7 +572,7 @@ type LinuxSandboxSecurityContext struct { // privileged containers are expected to be run. Privileged bool `protobuf:"varint,6,opt,name=privileged,proto3" json:"privileged,omitempty"` // Seccomp profile for the sandbox, candidate values are: - // * docker/default: the default profile for the docker container runtime + // * runtime/default: the default profile for the container runtime // * unconfined: unconfined profile, ie, no seccomp sandboxing // * localhost/: the profile installed on the node. // is the full path of the profile. @@ -1487,7 +1487,7 @@ type LinuxContainerSecurityContext struct { // http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference ApparmorProfile string `protobuf:"bytes,9,opt,name=apparmor_profile,json=apparmorProfile,proto3" json:"apparmor_profile,omitempty"` // Seccomp profile for the container, candidate values are: - // * docker/default: the default profile for the docker container runtime + // * runtime/default: the default profile for the container runtime // * unconfined: unconfined profile, ie, no seccomp sandboxing // * localhost/: the profile installed on the node. // is the full path of the profile. diff --git a/pkg/kubelet/apis/cri/runtime/v1alpha2/api.proto b/pkg/kubelet/apis/cri/runtime/v1alpha2/api.proto index 5a3a90917d0..d7cb2491eab 100644 --- a/pkg/kubelet/apis/cri/runtime/v1alpha2/api.proto +++ b/pkg/kubelet/apis/cri/runtime/v1alpha2/api.proto @@ -252,7 +252,7 @@ message LinuxSandboxSecurityContext { // privileged containers are expected to be run. bool privileged = 6; // Seccomp profile for the sandbox, candidate values are: - // * docker/default: the default profile for the docker container runtime + // * runtime/default: the default profile for the container runtime // * unconfined: unconfined profile, ie, no seccomp sandboxing // * localhost/: the profile installed on the node. // is the full path of the profile. @@ -577,7 +577,7 @@ message LinuxContainerSecurityContext { // http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference string apparmor_profile = 9; // Seccomp profile for the container, candidate values are: - // * docker/default: the default profile for the docker container runtime + // * runtime/default: the default profile for the container runtime // * unconfined: unconfined profile, ie, no seccomp sandboxing // * localhost/: the profile installed on the node. // is the full path of the profile. diff --git a/pkg/kubelet/dockershim/BUILD b/pkg/kubelet/dockershim/BUILD index ea7f430fdf5..2bf4edff4e3 100644 --- a/pkg/kubelet/dockershim/BUILD +++ b/pkg/kubelet/dockershim/BUILD @@ -167,7 +167,12 @@ go_test( "//vendor/github.com/stretchr/testify/assert:go_default_library", "//vendor/github.com/stretchr/testify/require:go_default_library", "//vendor/k8s.io/apimachinery/pkg/util/clock:go_default_library", - ], + ] + select({ + "@io_bazel_rules_go//go/platform:linux": [ + "//vendor/k8s.io/api/core/v1:go_default_library", + ], + "//conditions:default": [], + }), ) filegroup( diff --git a/pkg/kubelet/dockershim/helpers_linux.go b/pkg/kubelet/dockershim/helpers_linux.go index a73c241ccd0..5d231ea82a2 100644 --- a/pkg/kubelet/dockershim/helpers_linux.go +++ b/pkg/kubelet/dockershim/helpers_linux.go @@ -30,6 +30,7 @@ import ( "github.com/blang/semver" dockertypes "github.com/docker/docker/api/types" dockercontainer "github.com/docker/docker/api/types/container" + "k8s.io/api/core/v1" runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2" ) @@ -53,7 +54,7 @@ func getSeccompDockerOpts(seccompProfile string) ([]dockerOpt, error) { return defaultSeccompOpt, nil } - if seccompProfile == "docker/default" { + if seccompProfile == v1.SeccompProfileRuntimeDefault || seccompProfile == v1.DeprecatedSeccompProfileDockerDefault { // return nil so docker will load the default seccomp profile return nil, nil } diff --git a/pkg/kubelet/dockershim/helpers_linux_test.go b/pkg/kubelet/dockershim/helpers_linux_test.go index c7aa670831e..2f7ddb5329e 100644 --- a/pkg/kubelet/dockershim/helpers_linux_test.go +++ b/pkg/kubelet/dockershim/helpers_linux_test.go @@ -27,6 +27,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "k8s.io/api/core/v1" ) func TestGetSeccompSecurityOpts(t *testing.T) { @@ -44,7 +45,11 @@ func TestGetSeccompSecurityOpts(t *testing.T) { expectedOpts: []string{"seccomp=unconfined"}, }, { msg: "Seccomp default", - seccompProfile: "docker/default", + seccompProfile: v1.SeccompProfileRuntimeDefault, + expectedOpts: nil, + }, { + msg: "Seccomp deprecated default", + seccompProfile: v1.DeprecatedSeccompProfileDockerDefault, expectedOpts: nil, }} diff --git a/pkg/kubelet/kuberuntime/helpers_test.go b/pkg/kubelet/kuberuntime/helpers_test.go index 47379620022..f10fc04a236 100644 --- a/pkg/kubelet/kuberuntime/helpers_test.go +++ b/pkg/kubelet/kuberuntime/helpers_test.go @@ -231,20 +231,35 @@ func TestGetSeccompProfileFromAnnotations(t *testing.T) { containerName: "container1", expectedProfile: "", }, + { + description: "pod runtime/default seccomp profile should return runtime/default", + annotation: map[string]string{ + v1.SeccompPodAnnotationKey: v1.SeccompProfileRuntimeDefault, + }, + expectedProfile: v1.SeccompProfileRuntimeDefault, + }, { description: "pod docker/default seccomp profile should return docker/default", annotation: map[string]string{ - v1.SeccompPodAnnotationKey: "docker/default", + v1.SeccompPodAnnotationKey: v1.DeprecatedSeccompProfileDockerDefault, }, - expectedProfile: "docker/default", + expectedProfile: v1.DeprecatedSeccompProfileDockerDefault, + }, + { + description: "pod runtime/default seccomp profile with containerName should return runtime/default", + annotation: map[string]string{ + v1.SeccompPodAnnotationKey: v1.SeccompProfileRuntimeDefault, + }, + containerName: "container1", + expectedProfile: v1.SeccompProfileRuntimeDefault, }, { description: "pod docker/default seccomp profile with containerName should return docker/default", annotation: map[string]string{ - v1.SeccompPodAnnotationKey: "docker/default", + v1.SeccompPodAnnotationKey: v1.DeprecatedSeccompProfileDockerDefault, }, containerName: "container1", - expectedProfile: "docker/default", + expectedProfile: v1.DeprecatedSeccompProfileDockerDefault, }, { description: "pod unconfined seccomp profile should return unconfined", diff --git a/staging/src/k8s.io/api/core/v1/annotation_key_constants.go b/staging/src/k8s.io/api/core/v1/annotation_key_constants.go index de4e3cee447..95fff364283 100644 --- a/staging/src/k8s.io/api/core/v1/annotation_key_constants.go +++ b/staging/src/k8s.io/api/core/v1/annotation_key_constants.go @@ -45,6 +45,13 @@ const ( // to one container of a pod. SeccompContainerAnnotationKeyPrefix string = "container.seccomp.security.alpha.kubernetes.io/" + // SeccompProfileRuntimeDefault represents the default seccomp profile used by container runtime. + SeccompProfileRuntimeDefault string = "runtime/default" + + // DeprecatedSeccompProfileDockerDefault represents the default seccomp profile used by docker. + // This is now deprecated and should be replaced by SeccompProfileRuntimeDefault. + DeprecatedSeccompProfileDockerDefault string = "docker/default" + // PreferAvoidPodsAnnotationKey represents the key of preferAvoidPods data (json serialized) // in the Annotations of a Node. PreferAvoidPodsAnnotationKey string = "scheduler.alpha.kubernetes.io/preferAvoidPods" diff --git a/test/e2e/auth/pod_security_policy.go b/test/e2e/auth/pod_security_policy.go index faf7437d6c4..3f5a37f723c 100644 --- a/test/e2e/auth/pod_security_policy.go +++ b/test/e2e/auth/pod_security_policy.go @@ -316,7 +316,7 @@ func restrictedPod(f *framework.Framework, name string) *v1.Pod { ObjectMeta: metav1.ObjectMeta{ Name: name, Annotations: map[string]string{ - v1.SeccompPodAnnotationKey: "docker/default", + v1.SeccompPodAnnotationKey: v1.SeccompProfileRuntimeDefault, apparmor.ContainerAnnotationKeyPrefix + "pause": apparmor.ProfileRuntimeDefault, }, }, @@ -374,8 +374,8 @@ func restrictedPSPInPolicy(name string) *policy.PodSecurityPolicy { ObjectMeta: metav1.ObjectMeta{ Name: name, Annotations: map[string]string{ - seccomp.AllowedProfilesAnnotationKey: "docker/default", - seccomp.DefaultProfileAnnotationKey: "docker/default", + seccomp.AllowedProfilesAnnotationKey: v1.SeccompProfileRuntimeDefault, + seccomp.DefaultProfileAnnotationKey: v1.SeccompProfileRuntimeDefault, apparmor.AllowedProfilesAnnotationKey: apparmor.ProfileRuntimeDefault, apparmor.DefaultProfileAnnotationKey: apparmor.ProfileRuntimeDefault, }, @@ -429,8 +429,8 @@ func restrictedPSP(name string) *extensionsv1beta1.PodSecurityPolicy { ObjectMeta: metav1.ObjectMeta{ Name: name, Annotations: map[string]string{ - seccomp.AllowedProfilesAnnotationKey: "docker/default", - seccomp.DefaultProfileAnnotationKey: "docker/default", + seccomp.AllowedProfilesAnnotationKey: v1.SeccompProfileRuntimeDefault, + seccomp.DefaultProfileAnnotationKey: v1.SeccompProfileRuntimeDefault, apparmor.AllowedProfilesAnnotationKey: apparmor.ProfileRuntimeDefault, apparmor.DefaultProfileAnnotationKey: apparmor.ProfileRuntimeDefault, }, diff --git a/test/e2e/node/security_context.go b/test/e2e/node/security_context.go index 08d5e13e7a3..d9cab6a2116 100644 --- a/test/e2e/node/security_context.go +++ b/test/e2e/node/security_context.go @@ -144,7 +144,7 @@ var _ = SIGDescribe("Security Context [Feature:SecurityContext]", func() { // TODO: port to SecurityContext as soon as seccomp is out of alpha pod := scTestPod(false, false) pod.Annotations[v1.SeccompContainerAnnotationKeyPrefix+"test-container"] = "unconfined" - pod.Annotations[v1.SeccompPodAnnotationKey] = "docker/default" + pod.Annotations[v1.SeccompPodAnnotationKey] = v1.SeccompProfileRuntimeDefault pod.Spec.Containers[0].Command = []string{"grep", "ecc", "/proc/self/status"} f.TestContainerOutput(v1.SeccompPodAnnotationKey, pod, 0, []string{"0"}) // seccomp disabled }) @@ -157,10 +157,10 @@ var _ = SIGDescribe("Security Context [Feature:SecurityContext]", func() { f.TestContainerOutput(v1.SeccompPodAnnotationKey, pod, 0, []string{"0"}) // seccomp disabled }) - It("should support seccomp alpha docker/default annotation [Feature:Seccomp]", func() { + It("should support seccomp alpha runtime/default annotation [Feature:Seccomp]", func() { // TODO: port to SecurityContext as soon as seccomp is out of alpha pod := scTestPod(false, false) - pod.Annotations[v1.SeccompContainerAnnotationKeyPrefix+"test-container"] = "docker/default" + pod.Annotations[v1.SeccompContainerAnnotationKeyPrefix+"test-container"] = v1.SeccompProfileRuntimeDefault pod.Spec.Containers[0].Command = []string{"grep", "ecc", "/proc/self/status"} f.TestContainerOutput(v1.SeccompPodAnnotationKey, pod, 0, []string{"2"}) // seccomp filtered }) diff --git a/test/test_owners.csv b/test/test_owners.csv index 7e7a7e44638..4018f595709 100644 --- a/test/test_owners.csv +++ b/test/test_owners.csv @@ -449,7 +449,7 @@ Secrets should be consumable via the environment,ixdy,1,apps Security Context should support container.SecurityContext.RunAsUser,alex-mohr,1,apps Security Context should support pod.Spec.SecurityContext.RunAsUser,bgrant0607,1,apps Security Context should support pod.Spec.SecurityContext.SupplementalGroups,rrati,0,apps -Security Context should support seccomp alpha docker/default annotation,freehan,1,apps +Security Context should support seccomp alpha runtime/default annotation,freehan,1,apps Security Context should support seccomp alpha unconfined annotation on the container,childsb,1,apps Security Context should support seccomp alpha unconfined annotation on the pod,krousey,1,apps Security Context should support seccomp default which is unconfined,lavalamp,1,apps