github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-08-08 15:25:26 +00:00
Code Issues Projects Releases Wiki Activity

Use consistent helper for getting secret names from pod

Browse Source
This commit is contained in:
Jordan Liggitt
2017-02-23 00:35:44 -05:00
parent 2e12711160
commit a5526304bc
7 changed files with 205 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
plugin/pkg/admission/serviceaccount/BUILD
View File

@@ -17,6 +17,7 @@ go_library(
tags = ["automanaged"],
deps = [
"//pkg/api:go_default_library",
"//pkg/api/pod:go_default_library",
"//pkg/client/clientset_generated/internalclientset:go_default_library",
"//pkg/kubeapiserver/admission:go_default_library",
"//pkg/kubelet/types:go_default_library",

12
plugin/pkg/admission/serviceaccount/admission.go
View File

@@ -34,6 +34,7 @@ import (
"k8s.io/apiserver/pkg/storage/names"
"k8s.io/client-go/tools/cache"
"k8s.io/kubernetes/pkg/api"
podutil "k8s.io/kubernetes/pkg/api/pod"
"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
kubeapiserveradmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
kubelet "k8s.io/kubernetes/pkg/kubelet/types"
@@ -193,10 +194,13 @@ func (s *serviceAccount) Admit(a admission.Attributes) (err error) {
if len(pod.Spec.ServiceAccountName) != 0 {
return admission.NewForbidden(a, fmt.Errorf("a mirror pod may not reference service accounts"))
}
for _, volume := range pod.Spec.Volumes {
if volume.VolumeSource.Secret != nil {
return admission.NewForbidden(a, fmt.Errorf("a mirror pod may not reference secrets"))
}
hasSecrets := false
podutil.VisitPodSecretNames(pod, func(name string) bool {
hasSecrets = true
return false
})
if hasSecrets {
return admission.NewForbidden(a, fmt.Errorf("a mirror pod may not reference secrets"))
}
return nil
}