mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-21 10:51:29 +00:00
Merge pull request #82133 from bclau/windows/run-as-username-fix
api: Loosens RunAsUserName validation
This commit is contained in:
commit
afa979c295
@ -5526,12 +5526,12 @@ func ValidateSecurityContext(sc *core.SecurityContext, fldPath *field.Path) fiel
|
||||
// is the max character length for the USER itself. Both the DOMAIN and USER have their
|
||||
// own restrictions, and more information about them can be found here:
|
||||
// https://support.microsoft.com/en-us/help/909264/naming-conventions-in-active-directory-for-computers-domains-sites-and
|
||||
// https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/new-localuser?view=powershell-5.1
|
||||
// https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/bb726984(v=technet.10)
|
||||
const (
|
||||
maxGMSACredentialSpecLengthInKiB = 64
|
||||
maxGMSACredentialSpecLength = maxGMSACredentialSpecLengthInKiB * 1024
|
||||
maxRunAsUserNameDomainLength = 256
|
||||
maxRunAsUserNameUserLength = 21
|
||||
maxRunAsUserNameUserLength = 104
|
||||
)
|
||||
|
||||
var (
|
||||
@ -5612,8 +5612,8 @@ func validateWindowsSecurityContextOptions(windowsOptions *core.WindowsSecurityC
|
||||
if l := len(user); l == 0 {
|
||||
errMsg := fmt.Sprintf("runAsUserName's User cannot be empty")
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath.Child("runAsUserName"), windowsOptions.RunAsUserName, errMsg))
|
||||
} else if l >= maxRunAsUserNameUserLength {
|
||||
errMsg := fmt.Sprintf("runAsUserName's User length must be under %d characters", maxRunAsUserNameUserLength)
|
||||
} else if l > maxRunAsUserNameUserLength {
|
||||
errMsg := fmt.Sprintf("runAsUserName's User length must not be longer than %d characters", maxRunAsUserNameUserLength)
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath.Child("runAsUserName"), windowsOptions.RunAsUserName, errMsg))
|
||||
}
|
||||
|
||||
|
@ -14204,9 +14204,9 @@ func TestValidateWindowsSecurityContextOptions(t *testing.T) {
|
||||
{
|
||||
testName: "RunAsUserName's User is too long",
|
||||
windowsOptions: &core.WindowsSecurityContextOptions{
|
||||
RunAsUserName: toPtr(strings.Repeat("a", maxRunAsUserNameUserLength)),
|
||||
RunAsUserName: toPtr(strings.Repeat("a", maxRunAsUserNameUserLength+1)),
|
||||
},
|
||||
expectedErrorSubstring: "runAsUserName's User length must be under",
|
||||
expectedErrorSubstring: "runAsUserName's User length must not be longer than",
|
||||
},
|
||||
{
|
||||
testName: "RunAsUserName's User cannot contain only spaces or periods",
|
||||
|
Loading…
Reference in New Issue
Block a user