github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-05 10:19:50 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #121177 from jsafrane/move-warning-metric

Browse Source 
Move SELinux warning metric to be counted once per pod
This commit is contained in:
Kubernetes Prow Robot 2023-10-25 19:02:37 +02:00 committed by GitHub
commit aa28e6ebd9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 41 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
pkg/kubelet/volumemanager/cache/desired_state_of_world.go vendored
View File

@ -306,7 +306,7 @@ func (dsw *desiredStateOfWorld) AddPodToVolume(
} }
klog.V(4).InfoS("expected volume SELinux label context", "volume", volumeSpec.Name(), "label", seLinuxFileLabel) klog.V(4).InfoS("expected volume SELinux label context", "volume", volumeSpec.Name(), "label", seLinuxFileLabel)
if vol, volumeExists := dsw.volumesToMount[volumeName]; !volumeExists { if _, volumeExists := dsw.volumesToMount[volumeName]; !volumeExists {
var sizeLimit *resource.Quantity var sizeLimit *resource.Quantity
if volumeSpec.Volume != nil { if volumeSpec.Volume != nil {
if util.IsLocalEphemeralVolume(*volumeSpec.Volume) { if util.IsLocalEphemeralVolume(*volumeSpec.Volume) {
@ -350,12 +350,21 @@ func (dsw *desiredStateOfWorld) AddPodToVolume(
} }
} }
dsw.volumesToMount[volumeName] = vmt dsw.volumesToMount[volumeName] = vmt
} else { }
// volume exists
oldPodMount, ok := dsw.volumesToMount[volumeName].podsToMount[podName]
mountRequestTime := time.Now()
if ok && !volumePlugin.RequiresRemount(volumeSpec) {
mountRequestTime = oldPodMount.mountRequestTime
}
if !ok {
// The volume exists, but not with this pod.
// It will be added below as podToMount, now just report SELinux metric.
if pluginSupportsSELinuxContextMount { if pluginSupportsSELinuxContextMount {
if seLinuxFileLabel != vol.originalSELinuxLabel { existingVolume := dsw.volumesToMount[volumeName]
// TODO: update the error message after tests, e.g. add at least the conflicting pod names. if seLinuxFileLabel != existingVolume.originalSELinuxLabel {
fullErr := fmt.Errorf("conflicting SELinux labels of volume %s: %q and %q", volumeSpec.Name(), vol.originalSELinuxLabel, seLinuxFileLabel) fullErr := fmt.Errorf("conflicting SELinux labels of volume %s: %q and %q", volumeSpec.Name(), existingVolume.originalSELinuxLabel, seLinuxFileLabel)
supported := util.VolumeSupportsSELinuxMount(volumeSpec) supported := util.VolumeSupportsSELinuxMount(volumeSpec)
err := handleSELinuxMetricError( err := handleSELinuxMetricError(
fullErr, fullErr,
@ -369,12 +378,6 @@ func (dsw *desiredStateOfWorld) AddPodToVolume(
} }
} }
oldPodMount, ok := dsw.volumesToMount[volumeName].podsToMount[podName]
mountRequestTime := time.Now()
if ok && !volumePlugin.RequiresRemount(volumeSpec) {
mountRequestTime = oldPodMount.mountRequestTime
}
// Create new podToMount object. If it already exists, it is refreshed with // Create new podToMount object. If it already exists, it is refreshed with
// updated values (this is required for volumes that require remounting on // updated values (this is required for volumes that require remounting on
// pod update, like Downward API volumes). // pod update, like Downward API volumes).

20
pkg/kubelet/volumemanager/cache/desired_state_of_world_test.go vendored
View File

@ -612,12 +612,14 @@ func Test_AddPodToVolume_Positive_SELinuxNoRWOP(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxMountReadWriteOncePod, true)() defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxMountReadWriteOncePod, true)()
// Arrange // Arrange
plugins := []volume.VolumePlugin{ plugins := []volume.VolumePlugin{
&volumetesting.FakeBasicVolumePlugin{ &volumetesting.FakeDeviceMountableVolumePlugin{
FakeBasicVolumePlugin: volumetesting.FakeBasicVolumePlugin{
Plugin: volumetesting.FakeVolumePlugin{ Plugin: volumetesting.FakeVolumePlugin{
PluginName: "basic", PluginName: "basic",
SupportsSELinux: true, SupportsSELinux: true,
}, },
}, },
},
} }
volumePluginMgr := volume.VolumePluginMgr{} volumePluginMgr := volume.VolumePluginMgr{}
fakeVolumeHost := volumetesting.NewFakeVolumeHost(t, fakeVolumeHost := volumetesting.NewFakeVolumeHost(t,
@ -692,12 +694,14 @@ func Test_AddPodToVolume_Positive_NoSELinuxPlugin(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxMountReadWriteOncePod, true)() defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxMountReadWriteOncePod, true)()
// Arrange // Arrange
plugins := []volume.VolumePlugin{ plugins := []volume.VolumePlugin{
&volumetesting.FakeBasicVolumePlugin{ &volumetesting.FakeDeviceMountableVolumePlugin{
FakeBasicVolumePlugin: volumetesting.FakeBasicVolumePlugin{
Plugin: volumetesting.FakeVolumePlugin{ Plugin: volumetesting.FakeVolumePlugin{
PluginName: "basic", PluginName: "basic",
SupportsSELinux: false, SupportsSELinux: false,
}, },
}, },
},
} }
volumePluginMgr := volume.VolumePluginMgr{} volumePluginMgr := volume.VolumePluginMgr{}
fakeVolumeHost := volumetesting.NewFakeVolumeHost(t, fakeVolumeHost := volumetesting.NewFakeVolumeHost(t,
@ -773,12 +777,14 @@ func Test_AddPodToVolume_Positive_ExistingPodSameSELinuxRWOP(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxMountReadWriteOncePod, true)() defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxMountReadWriteOncePod, true)()
// Arrange // Arrange
plugins := []volume.VolumePlugin{ plugins := []volume.VolumePlugin{
&volumetesting.FakeBasicVolumePlugin{ &volumetesting.FakeDeviceMountableVolumePlugin{
FakeBasicVolumePlugin: volumetesting.FakeBasicVolumePlugin{
Plugin: volumetesting.FakeVolumePlugin{ Plugin: volumetesting.FakeVolumePlugin{
PluginName: "basic", PluginName: "basic",
SupportsSELinux: true, SupportsSELinux: true,
}, },
}, },
},
} }
volumePluginMgr := volume.VolumePluginMgr{} volumePluginMgr := volume.VolumePluginMgr{}
fakeVolumeHost := volumetesting.NewFakeVolumeHost(t, fakeVolumeHost := volumetesting.NewFakeVolumeHost(t,
@ -873,12 +879,14 @@ func Test_AddPodToVolume_Negative_ExistingPodDifferentSELinuxRWOP(t *testing.T)
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxMountReadWriteOncePod, true)() defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxMountReadWriteOncePod, true)()
// Arrange // Arrange
plugins := []volume.VolumePlugin{ plugins := []volume.VolumePlugin{
&volumetesting.FakeBasicVolumePlugin{ &volumetesting.FakeDeviceMountableVolumePlugin{
FakeBasicVolumePlugin: volumetesting.FakeBasicVolumePlugin{
Plugin: volumetesting.FakeVolumePlugin{ Plugin: volumetesting.FakeVolumePlugin{
PluginName: "basic", PluginName: "basic",
SupportsSELinux: true, SupportsSELinux: true,
}, },
}, },
},
} }
volumePluginMgr := volume.VolumePluginMgr{} volumePluginMgr := volume.VolumePluginMgr{}
fakeVolumeHost := volumetesting.NewFakeVolumeHost(t, fakeVolumeHost := volumetesting.NewFakeVolumeHost(t,
@ -957,7 +965,7 @@ func Test_AddPodToVolume_Negative_ExistingPodDifferentSELinuxRWOP(t *testing.T)
pod2.Name = "pod2" pod2.Name = "pod2"
pod2.UID = "pod2uid" pod2.UID = "pod2uid"
pod2.Spec.SecurityContext.SELinuxOptions = &seLinux2 pod2.Spec.SecurityContext.SELinuxOptions = &seLinux2
pod2Name := util.GetUniquePodName(pod) pod2Name := util.GetUniquePodName(pod2)
// Act // Act
_, err = dsw.AddPodToVolume( _, err = dsw.AddPodToVolume(
@ -967,7 +975,7 @@ func Test_AddPodToVolume_Negative_ExistingPodDifferentSELinuxRWOP(t *testing.T)
t.Fatalf("Second AddPodToVolume succeeded, expected a failure") t.Fatalf("Second AddPodToVolume succeeded, expected a failure")
} }
// Verify the original SELinux context is still in DSW // Verify the original SELinux context is still in DSW
verifyPodExistsInVolumeDsw(t, pod2Name, generatedVolumeName, "system_u:object_r:container_file_t:s0:c1,c2", dsw) verifyPodExistsInVolumeDsw(t, podName, generatedVolumeName, "system_u:object_r:container_file_t:s0:c1,c2", dsw)
} }
func verifyVolumeExistsDsw( func verifyVolumeExistsDsw(