github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-04 18:00:08 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #22402 from erictune/psp-simplify

Browse Source 
Auto commit by PR queue bot
This commit is contained in:
k8s-merge-robot 2016-03-05 07:55:19 -08:00
commit b198c820cd
15 changed files with 169 additions and 169 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/api/testing/fuzzer.go
View File

@ -408,10 +408,10 @@ func FuzzerFor(t *testing.T, version unversioned.GroupVersion, src rand.Source)
}, },
func(psp *extensions.PodSecurityPolicySpec, c fuzz.Continue) { func(psp *extensions.PodSecurityPolicySpec, c fuzz.Continue) {
c.FuzzNoCustom(psp) // fuzz self without calling this function again c.FuzzNoCustom(psp) // fuzz self without calling this function again
userTypes := []extensions.RunAsUserStrategy{extensions.RunAsUserStrategyMustRunAsNonRoot, extensions.RunAsUserStrategyMustRunAs, extensions.RunAsUserStrategyRunAsAny} runAsUserRules := []extensions.RunAsUserStrategy{extensions.RunAsUserStrategyMustRunAsNonRoot, extensions.RunAsUserStrategyMustRunAs, extensions.RunAsUserStrategyRunAsAny}
psp.RunAsUser.Type = userTypes[c.Rand.Intn(len(userTypes))] psp.RunAsUser.Rule = runAsUserRules[c.Rand.Intn(len(runAsUserRules))]
seLinuxTypes := []extensions.SELinuxContextStrategy{extensions.SELinuxStrategyRunAsAny, extensions.SELinuxStrategyMustRunAs} seLinuxRules := []extensions.SELinuxStrategy{extensions.SELinuxStrategyRunAsAny, extensions.SELinuxStrategyMustRunAs}
psp.SELinuxContext.Type = seLinuxTypes[c.Rand.Intn(len(seLinuxTypes))] psp.SELinux.Rule = seLinuxRules[c.Rand.Intn(len(seLinuxRules))]
}, },
) )
return f return f

60
pkg/apis/extensions/types.generated.go
View File

@ -15629,7 +15629,7 @@ func (x *PodSecurityPolicySpec) CodecEncodeSelf(e *codec1978.Encoder) {
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
if yyq2[7] { if yyq2[7] {
yy25 := &x.SELinuxContext yy25 := &x.SELinux
yy25.CodecEncodeSelf(e) yy25.CodecEncodeSelf(e)
} else { } else {
r.EncodeNil() r.EncodeNil()
@ -15637,9 +15637,9 @@ func (x *PodSecurityPolicySpec) CodecEncodeSelf(e *codec1978.Encoder) {
} else { } else {
if yyq2[7] { if yyq2[7] {
z.EncSendContainerState(codecSelfer_containerMapKey1234) z.EncSendContainerState(codecSelfer_containerMapKey1234)
r.EncodeString(codecSelferC_UTF81234, string("seLinuxContext")) r.EncodeString(codecSelferC_UTF81234, string("seLinux"))
z.EncSendContainerState(codecSelfer_containerMapValue1234) z.EncSendContainerState(codecSelfer_containerMapValue1234)
yy27 := &x.SELinuxContext yy27 := &x.SELinux
yy27.CodecEncodeSelf(e) yy27.CodecEncodeSelf(e)
} }
} }
@ -15781,11 +15781,11 @@ func (x *PodSecurityPolicySpec) codecDecodeSelfFromMap(l int, d *codec1978.Decod
} else { } else {
x.HostIPC = bool(r.DecodeBool()) x.HostIPC = bool(r.DecodeBool())
} }
case "seLinuxContext": case "seLinux":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.SELinuxContext = SELinuxContextStrategyOptions{} x.SELinux = SELinuxStrategyOptions{}
} else { } else {
yyv14 := &x.SELinuxContext yyv14 := &x.SELinux
yyv14.CodecDecodeSelf(d) yyv14.CodecDecodeSelf(d)
} }
case "runAsUser": case "runAsUser":
@ -15951,9 +15951,9 @@ func (x *PodSecurityPolicySpec) codecDecodeSelfFromArray(l int, d *codec1978.Dec
} }
z.DecSendContainerState(codecSelfer_containerArrayElem1234) z.DecSendContainerState(codecSelfer_containerArrayElem1234)
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.SELinuxContext = SELinuxContextStrategyOptions{} x.SELinux = SELinuxStrategyOptions{}
} else { } else {
yyv27 := &x.SELinuxContext yyv27 := &x.SELinux
yyv27.CodecDecodeSelf(d) yyv27.CodecDecodeSelf(d)
} }
yyj16++ yyj16++
@ -16218,7 +16218,7 @@ func (x *FSType) CodecDecodeSelf(d *codec1978.Decoder) {
} }
} }
func (x *SELinuxContextStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) { func (x *SELinuxStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperEncoder(e) z, r := codec1978.GenHelperEncoder(e)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -16251,12 +16251,12 @@ func (x *SELinuxContextStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) {
} }
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
x.Type.CodecEncodeSelf(e) x.Rule.CodecEncodeSelf(e)
} else { } else {
z.EncSendContainerState(codecSelfer_containerMapKey1234) z.EncSendContainerState(codecSelfer_containerMapKey1234)
r.EncodeString(codecSelferC_UTF81234, string("type")) r.EncodeString(codecSelferC_UTF81234, string("rule"))
z.EncSendContainerState(codecSelfer_containerMapValue1234) z.EncSendContainerState(codecSelfer_containerMapValue1234)
x.Type.CodecEncodeSelf(e) x.Rule.CodecEncodeSelf(e)
} }
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
@ -16290,7 +16290,7 @@ func (x *SELinuxContextStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) {
} }
} }
func (x *SELinuxContextStrategyOptions) CodecDecodeSelf(d *codec1978.Decoder) { func (x *SELinuxStrategyOptions) CodecDecodeSelf(d *codec1978.Decoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperDecoder(d) z, r := codec1978.GenHelperDecoder(d)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -16320,7 +16320,7 @@ func (x *SELinuxContextStrategyOptions) CodecDecodeSelf(d *codec1978.Decoder) {
} }
} }
func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromMap(l int, d *codec1978.Decoder) { func (x *SELinuxStrategyOptions) codecDecodeSelfFromMap(l int, d *codec1978.Decoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperDecoder(d) z, r := codec1978.GenHelperDecoder(d)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -16342,11 +16342,11 @@ func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromMap(l int, d *codec19
yys3 := string(yys3Slc) yys3 := string(yys3Slc)
z.DecSendContainerState(codecSelfer_containerMapValue1234) z.DecSendContainerState(codecSelfer_containerMapValue1234)
switch yys3 { switch yys3 {
case "type": case "rule":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.Type = "" x.Rule = ""
} else { } else {
x.Type = SELinuxContextStrategy(r.DecodeString()) x.Rule = SELinuxStrategy(r.DecodeString())
} }
case "seLinuxOptions": case "seLinuxOptions":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
@ -16366,7 +16366,7 @@ func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromMap(l int, d *codec19
z.DecSendContainerState(codecSelfer_containerMapEnd1234) z.DecSendContainerState(codecSelfer_containerMapEnd1234)
} }
func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromArray(l int, d *codec1978.Decoder) { func (x *SELinuxStrategyOptions) codecDecodeSelfFromArray(l int, d *codec1978.Decoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperDecoder(d) z, r := codec1978.GenHelperDecoder(d)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -16385,9 +16385,9 @@ func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromArray(l int, d *codec
} }
z.DecSendContainerState(codecSelfer_containerArrayElem1234) z.DecSendContainerState(codecSelfer_containerArrayElem1234)
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.Type = "" x.Rule = ""
} else { } else {
x.Type = SELinuxContextStrategy(r.DecodeString()) x.Rule = SELinuxStrategy(r.DecodeString())
} }
yyj6++ yyj6++
if yyhl6 { if yyhl6 {
@ -16426,7 +16426,7 @@ func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromArray(l int, d *codec
z.DecSendContainerState(codecSelfer_containerArrayEnd1234) z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
} }
func (x SELinuxContextStrategy) CodecEncodeSelf(e *codec1978.Encoder) { func (x SELinuxStrategy) CodecEncodeSelf(e *codec1978.Encoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperEncoder(e) z, r := codec1978.GenHelperEncoder(e)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -16439,7 +16439,7 @@ func (x SELinuxContextStrategy) CodecEncodeSelf(e *codec1978.Encoder) {
} }
} }
func (x *SELinuxContextStrategy) CodecDecodeSelf(d *codec1978.Decoder) { func (x *SELinuxStrategy) CodecDecodeSelf(d *codec1978.Decoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperDecoder(d) z, r := codec1978.GenHelperDecoder(d)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -16485,12 +16485,12 @@ func (x *RunAsUserStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) {
} }
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
x.Type.CodecEncodeSelf(e) x.Rule.CodecEncodeSelf(e)
} else { } else {
z.EncSendContainerState(codecSelfer_containerMapKey1234) z.EncSendContainerState(codecSelfer_containerMapKey1234)
r.EncodeString(codecSelferC_UTF81234, string("type")) r.EncodeString(codecSelferC_UTF81234, string("rule"))
z.EncSendContainerState(codecSelfer_containerMapValue1234) z.EncSendContainerState(codecSelfer_containerMapValue1234)
x.Type.CodecEncodeSelf(e) x.Rule.CodecEncodeSelf(e)
} }
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
@ -16586,11 +16586,11 @@ func (x *RunAsUserStrategyOptions) codecDecodeSelfFromMap(l int, d *codec1978.De
yys3 := string(yys3Slc) yys3 := string(yys3Slc)
z.DecSendContainerState(codecSelfer_containerMapValue1234) z.DecSendContainerState(codecSelfer_containerMapValue1234)
switch yys3 { switch yys3 {
case "type": case "rule":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.Type = "" x.Rule = ""
} else { } else {
x.Type = RunAsUserStrategy(r.DecodeString()) x.Rule = RunAsUserStrategy(r.DecodeString())
} }
case "ranges": case "ranges":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
@ -16630,9 +16630,9 @@ func (x *RunAsUserStrategyOptions) codecDecodeSelfFromArray(l int, d *codec1978.
} }
z.DecSendContainerState(codecSelfer_containerArrayElem1234) z.DecSendContainerState(codecSelfer_containerArrayElem1234)
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.Type = "" x.Rule = ""
} else { } else {
x.Type = RunAsUserStrategy(r.DecodeString()) x.Rule = RunAsUserStrategy(r.DecodeString())
} }
yyj7++ yyj7++
if yyhl7 { if yyhl7 {

28
pkg/apis/extensions/types.go
View File

@ -845,8 +845,8 @@ type PodSecurityPolicySpec struct {
HostPID bool `json:"hostPID,omitempty"` HostPID bool `json:"hostPID,omitempty"`
// HostIPC determines if the policy allows the use of HostIPC in the pod spec. // HostIPC determines if the policy allows the use of HostIPC in the pod spec.
HostIPC bool `json:"hostIPC,omitempty"` HostIPC bool `json:"hostIPC,omitempty"`
// SELinuxContext is the strategy that will dictate the allowable labels that may be set. // SELinux is the strategy that will dictate the allowable labels that may be set.
SELinuxContext SELinuxContextStrategyOptions `json:"seLinuxContext,omitempty"` SELinux SELinuxStrategyOptions `json:"seLinux,omitempty"`
// RunAsUser is the strategy that will dictate the allowable RunAsUser values that may be set. // RunAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.
RunAsUser RunAsUserStrategyOptions `json:"runAsUser,omitempty"` RunAsUser RunAsUserStrategyOptions `json:"runAsUser,omitempty"`
} }
@ -881,30 +881,30 @@ var (
FC FSType = "fc" FC FSType = "fc"
) )
// SELinuxContextStrategyOptions defines the strategy type and any options used to create the strategy. // SELinuxStrategyOptions defines the strategy type and any options used to create the strategy.
type SELinuxContextStrategyOptions struct { type SELinuxStrategyOptions struct {
// Type is the strategy that will dictate the allowable labels that may be set. // Rule is the strategy that will dictate the allowable labels that may be set.
Type SELinuxContextStrategy `json:"type"` Rule SELinuxStrategy `json:"rule"`
// seLinuxOptions required to run as; required for MustRunAs // seLinuxOptions required to run as; required for MustRunAs
// More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context // More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context
SELinuxOptions *api.SELinuxOptions `json:"seLinuxOptions,omitempty"` SELinuxOptions *api.SELinuxOptions `json:"seLinuxOptions,omitempty"`
} }
// SELinuxContextStrategyType denotes strategy types for generating SELinux options for a // SELinuxStrategy denotes strategy types for generating SELinux options for a
// SecurityContext. // Security.
type SELinuxContextStrategy string type SELinuxStrategy string
const ( const (
// container must have SELinux labels of X applied. // container must have SELinux labels of X applied.
SELinuxStrategyMustRunAs SELinuxContextStrategy = "MustRunAs" SELinuxStrategyMustRunAs SELinuxStrategy = "MustRunAs"
// container may make requests for any SELinux context labels. // container may make requests for any SELinux context labels.
SELinuxStrategyRunAsAny SELinuxContextStrategy = "RunAsAny" SELinuxStrategyRunAsAny SELinuxStrategy = "RunAsAny"
) )
// RunAsUserStrategyOptions defines the strategy type and any options used to create the strategy. // RunAsUserStrategyOptions defines the strategy type and any options used to create the strategy.
type RunAsUserStrategyOptions struct { type RunAsUserStrategyOptions struct {
// Type is the strategy that will dictate the allowable RunAsUser values that may be set. // Rule is the strategy that will dictate the allowable RunAsUser values that may be set.
Type RunAsUserStrategy `json:"type"` Rule RunAsUserStrategy `json:"rule"`
// Ranges are the allowed ranges of uids that may be used. // Ranges are the allowed ranges of uids that may be used.
Ranges []IDRange `json:"ranges,omitempty"` Ranges []IDRange `json:"ranges,omitempty"`
} }
@ -917,7 +917,7 @@ type IDRange struct {
Max int64 `json:"max"` Max int64 `json:"max"`
} }
// RunAsUserStrategyType denotes strategy types for generating RunAsUser values for a // RunAsUserStrategy denotes strategy types for generating RunAsUser values for a
// SecurityContext. // SecurityContext.
type RunAsUserStrategy string type RunAsUserStrategy string

32
pkg/apis/extensions/v1beta1/conversion_generated.go
View File

@ -3520,7 +3520,7 @@ func autoConvert_extensions_PodSecurityPolicySpec_To_v1beta1_PodSecurityPolicySp
} }
out.HostPID = in.HostPID out.HostPID = in.HostPID
out.HostIPC = in.HostIPC out.HostIPC = in.HostIPC
if err := Convert_extensions_SELinuxContextStrategyOptions_To_v1beta1_SELinuxContextStrategyOptions(&in.SELinuxContext, &out.SELinuxContext, s); err != nil { if err := Convert_extensions_SELinuxStrategyOptions_To_v1beta1_SELinuxStrategyOptions(&in.SELinux, &out.SELinux, s); err != nil {
return err return err
} }
if err := Convert_extensions_RunAsUserStrategyOptions_To_v1beta1_RunAsUserStrategyOptions(&in.RunAsUser, &out.RunAsUser, s); err != nil { if err := Convert_extensions_RunAsUserStrategyOptions_To_v1beta1_RunAsUserStrategyOptions(&in.RunAsUser, &out.RunAsUser, s); err != nil {
@ -3667,7 +3667,7 @@ func autoConvert_extensions_RunAsUserStrategyOptions_To_v1beta1_RunAsUserStrateg
if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found { if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {
defaulting.(func(*extensions.RunAsUserStrategyOptions))(in) defaulting.(func(*extensions.RunAsUserStrategyOptions))(in)
} }
out.Type = RunAsUserStrategy(in.Type) out.Rule = RunAsUserStrategy(in.Rule)
if in.Ranges != nil { if in.Ranges != nil {
out.Ranges = make([]IDRange, len(in.Ranges)) out.Ranges = make([]IDRange, len(in.Ranges))
for i := range in.Ranges { for i := range in.Ranges {
@ -3685,11 +3685,11 @@ func Convert_extensions_RunAsUserStrategyOptions_To_v1beta1_RunAsUserStrategyOpt
return autoConvert_extensions_RunAsUserStrategyOptions_To_v1beta1_RunAsUserStrategyOptions(in, out, s) return autoConvert_extensions_RunAsUserStrategyOptions_To_v1beta1_RunAsUserStrategyOptions(in, out, s)
} }
func autoConvert_extensions_SELinuxContextStrategyOptions_To_v1beta1_SELinuxContextStrategyOptions(in *extensions.SELinuxContextStrategyOptions, out *SELinuxContextStrategyOptions, s conversion.Scope) error { func autoConvert_extensions_SELinuxStrategyOptions_To_v1beta1_SELinuxStrategyOptions(in *extensions.SELinuxStrategyOptions, out *SELinuxStrategyOptions, s conversion.Scope) error {
if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found { if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {
defaulting.(func(*extensions.SELinuxContextStrategyOptions))(in) defaulting.(func(*extensions.SELinuxStrategyOptions))(in)
} }
out.Type = SELinuxContextStrategy(in.Type) out.Rule = SELinuxStrategy(in.Rule)
// unable to generate simple pointer conversion for api.SELinuxOptions -> v1.SELinuxOptions // unable to generate simple pointer conversion for api.SELinuxOptions -> v1.SELinuxOptions
if in.SELinuxOptions != nil { if in.SELinuxOptions != nil {
out.SELinuxOptions = new(v1.SELinuxOptions) out.SELinuxOptions = new(v1.SELinuxOptions)
@ -3702,8 +3702,8 @@ func autoConvert_extensions_SELinuxContextStrategyOptions_To_v1beta1_SELinuxCont
return nil return nil
} }
func Convert_extensions_SELinuxContextStrategyOptions_To_v1beta1_SELinuxContextStrategyOptions(in *extensions.SELinuxContextStrategyOptions, out *SELinuxContextStrategyOptions, s conversion.Scope) error { func Convert_extensions_SELinuxStrategyOptions_To_v1beta1_SELinuxStrategyOptions(in *extensions.SELinuxStrategyOptions, out *SELinuxStrategyOptions, s conversion.Scope) error {
return autoConvert_extensions_SELinuxContextStrategyOptions_To_v1beta1_SELinuxContextStrategyOptions(in, out, s) return autoConvert_extensions_SELinuxStrategyOptions_To_v1beta1_SELinuxStrategyOptions(in, out, s)
} }
func autoConvert_extensions_Scale_To_v1beta1_Scale(in *extensions.Scale, out *Scale, s conversion.Scope) error { func autoConvert_extensions_Scale_To_v1beta1_Scale(in *extensions.Scale, out *Scale, s conversion.Scope) error {
@ -4782,7 +4782,7 @@ func autoConvert_v1beta1_PodSecurityPolicySpec_To_extensions_PodSecurityPolicySp
} }
out.HostPID = in.HostPID out.HostPID = in.HostPID
out.HostIPC = in.HostIPC out.HostIPC = in.HostIPC
if err := Convert_v1beta1_SELinuxContextStrategyOptions_To_extensions_SELinuxContextStrategyOptions(&in.SELinuxContext, &out.SELinuxContext, s); err != nil { if err := Convert_v1beta1_SELinuxStrategyOptions_To_extensions_SELinuxStrategyOptions(&in.SELinux, &out.SELinux, s); err != nil {
return err return err
} }
if err := Convert_v1beta1_RunAsUserStrategyOptions_To_extensions_RunAsUserStrategyOptions(&in.RunAsUser, &out.RunAsUser, s); err != nil { if err := Convert_v1beta1_RunAsUserStrategyOptions_To_extensions_RunAsUserStrategyOptions(&in.RunAsUser, &out.RunAsUser, s); err != nil {
@ -4923,7 +4923,7 @@ func autoConvert_v1beta1_RunAsUserStrategyOptions_To_extensions_RunAsUserStrateg
if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found { if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {
defaulting.(func(*RunAsUserStrategyOptions))(in) defaulting.(func(*RunAsUserStrategyOptions))(in)
} }
out.Type = extensions.RunAsUserStrategy(in.Type) out.Rule = extensions.RunAsUserStrategy(in.Rule)
if in.Ranges != nil { if in.Ranges != nil {
out.Ranges = make([]extensions.IDRange, len(in.Ranges)) out.Ranges = make([]extensions.IDRange, len(in.Ranges))
for i := range in.Ranges { for i := range in.Ranges {
@ -4941,11 +4941,11 @@ func Convert_v1beta1_RunAsUserStrategyOptions_To_extensions_RunAsUserStrategyOpt
return autoConvert_v1beta1_RunAsUserStrategyOptions_To_extensions_RunAsUserStrategyOptions(in, out, s) return autoConvert_v1beta1_RunAsUserStrategyOptions_To_extensions_RunAsUserStrategyOptions(in, out, s)
} }
func autoConvert_v1beta1_SELinuxContextStrategyOptions_To_extensions_SELinuxContextStrategyOptions(in *SELinuxContextStrategyOptions, out *extensions.SELinuxContextStrategyOptions, s conversion.Scope) error { func autoConvert_v1beta1_SELinuxStrategyOptions_To_extensions_SELinuxStrategyOptions(in *SELinuxStrategyOptions, out *extensions.SELinuxStrategyOptions, s conversion.Scope) error {
if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found { if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {
defaulting.(func(*SELinuxContextStrategyOptions))(in) defaulting.(func(*SELinuxStrategyOptions))(in)
} }
out.Type = extensions.SELinuxContextStrategy(in.Type) out.Rule = extensions.SELinuxStrategy(in.Rule)
// unable to generate simple pointer conversion for v1.SELinuxOptions -> api.SELinuxOptions // unable to generate simple pointer conversion for v1.SELinuxOptions -> api.SELinuxOptions
if in.SELinuxOptions != nil { if in.SELinuxOptions != nil {
out.SELinuxOptions = new(api.SELinuxOptions) out.SELinuxOptions = new(api.SELinuxOptions)
@ -4958,8 +4958,8 @@ func autoConvert_v1beta1_SELinuxContextStrategyOptions_To_extensions_SELinuxCont
return nil return nil
} }
func Convert_v1beta1_SELinuxContextStrategyOptions_To_extensions_SELinuxContextStrategyOptions(in *SELinuxContextStrategyOptions, out *extensions.SELinuxContextStrategyOptions, s conversion.Scope) error { func Convert_v1beta1_SELinuxStrategyOptions_To_extensions_SELinuxStrategyOptions(in *SELinuxStrategyOptions, out *extensions.SELinuxStrategyOptions, s conversion.Scope) error {
return autoConvert_v1beta1_SELinuxContextStrategyOptions_To_extensions_SELinuxContextStrategyOptions(in, out, s) return autoConvert_v1beta1_SELinuxStrategyOptions_To_extensions_SELinuxStrategyOptions(in, out, s)
} }
func autoConvert_v1beta1_Scale_To_extensions_Scale(in *Scale, out *extensions.Scale, s conversion.Scope) error { func autoConvert_v1beta1_Scale_To_extensions_Scale(in *Scale, out *extensions.Scale, s conversion.Scope) error {
@ -5229,7 +5229,7 @@ func init() {
autoConvert_extensions_RollbackConfig_To_v1beta1_RollbackConfig, autoConvert_extensions_RollbackConfig_To_v1beta1_RollbackConfig,
autoConvert_extensions_RollingUpdateDeployment_To_v1beta1_RollingUpdateDeployment, autoConvert_extensions_RollingUpdateDeployment_To_v1beta1_RollingUpdateDeployment,
autoConvert_extensions_RunAsUserStrategyOptions_To_v1beta1_RunAsUserStrategyOptions, autoConvert_extensions_RunAsUserStrategyOptions_To_v1beta1_RunAsUserStrategyOptions,
autoConvert_extensions_SELinuxContextStrategyOptions_To_v1beta1_SELinuxContextStrategyOptions, autoConvert_extensions_SELinuxStrategyOptions_To_v1beta1_SELinuxStrategyOptions,
autoConvert_extensions_ScaleSpec_To_v1beta1_ScaleSpec, autoConvert_extensions_ScaleSpec_To_v1beta1_ScaleSpec,
autoConvert_extensions_ScaleStatus_To_v1beta1_ScaleStatus, autoConvert_extensions_ScaleStatus_To_v1beta1_ScaleStatus,
autoConvert_extensions_Scale_To_v1beta1_Scale, autoConvert_extensions_Scale_To_v1beta1_Scale,
@ -5334,7 +5334,7 @@ func init() {
autoConvert_v1beta1_RollbackConfig_To_extensions_RollbackConfig, autoConvert_v1beta1_RollbackConfig_To_extensions_RollbackConfig,
autoConvert_v1beta1_RollingUpdateDeployment_To_extensions_RollingUpdateDeployment, autoConvert_v1beta1_RollingUpdateDeployment_To_extensions_RollingUpdateDeployment,
autoConvert_v1beta1_RunAsUserStrategyOptions_To_extensions_RunAsUserStrategyOptions, autoConvert_v1beta1_RunAsUserStrategyOptions_To_extensions_RunAsUserStrategyOptions,
autoConvert_v1beta1_SELinuxContextStrategyOptions_To_extensions_SELinuxContextStrategyOptions, autoConvert_v1beta1_SELinuxStrategyOptions_To_extensions_SELinuxStrategyOptions,
autoConvert_v1beta1_ScaleSpec_To_extensions_ScaleSpec, autoConvert_v1beta1_ScaleSpec_To_extensions_ScaleSpec,
autoConvert_v1beta1_ScaleStatus_To_extensions_ScaleStatus, autoConvert_v1beta1_ScaleStatus_To_extensions_ScaleStatus,
autoConvert_v1beta1_Scale_To_extensions_Scale, autoConvert_v1beta1_Scale_To_extensions_Scale,

10
pkg/apis/extensions/v1beta1/deep_copy_generated.go
View File

@ -1678,7 +1678,7 @@ func deepCopy_v1beta1_PodSecurityPolicySpec(in PodSecurityPolicySpec, out *PodSe
} }
out.HostPID = in.HostPID out.HostPID = in.HostPID
out.HostIPC = in.HostIPC out.HostIPC = in.HostIPC
if err := deepCopy_v1beta1_SELinuxContextStrategyOptions(in.SELinuxContext, &out.SELinuxContext, c); err != nil { if err := deepCopy_v1beta1_SELinuxStrategyOptions(in.SELinux, &out.SELinux, c); err != nil {
return err return err
} }
if err := deepCopy_v1beta1_RunAsUserStrategyOptions(in.RunAsUser, &out.RunAsUser, c); err != nil { if err := deepCopy_v1beta1_RunAsUserStrategyOptions(in.RunAsUser, &out.RunAsUser, c); err != nil {
@ -1788,7 +1788,7 @@ func deepCopy_v1beta1_RollingUpdateDeployment(in RollingUpdateDeployment, out *R
} }
func deepCopy_v1beta1_RunAsUserStrategyOptions(in RunAsUserStrategyOptions, out *RunAsUserStrategyOptions, c *conversion.Cloner) error { func deepCopy_v1beta1_RunAsUserStrategyOptions(in RunAsUserStrategyOptions, out *RunAsUserStrategyOptions, c *conversion.Cloner) error {
out.Type = in.Type out.Rule = in.Rule
if in.Ranges != nil { if in.Ranges != nil {
out.Ranges = make([]IDRange, len(in.Ranges)) out.Ranges = make([]IDRange, len(in.Ranges))
for i := range in.Ranges { for i := range in.Ranges {
@ -1802,8 +1802,8 @@ func deepCopy_v1beta1_RunAsUserStrategyOptions(in RunAsUserStrategyOptions, out
return nil return nil
} }
func deepCopy_v1beta1_SELinuxContextStrategyOptions(in SELinuxContextStrategyOptions, out *SELinuxContextStrategyOptions, c *conversion.Cloner) error { func deepCopy_v1beta1_SELinuxStrategyOptions(in SELinuxStrategyOptions, out *SELinuxStrategyOptions, c *conversion.Cloner) error {
out.Type = in.Type out.Rule = in.Rule
if in.SELinuxOptions != nil { if in.SELinuxOptions != nil {
out.SELinuxOptions = new(v1.SELinuxOptions) out.SELinuxOptions = new(v1.SELinuxOptions)
if err := deepCopy_v1_SELinuxOptions(*in.SELinuxOptions, out.SELinuxOptions, c); err != nil { if err := deepCopy_v1_SELinuxOptions(*in.SELinuxOptions, out.SELinuxOptions, c); err != nil {
@ -2045,7 +2045,7 @@ func init() {
deepCopy_v1beta1_RollbackConfig, deepCopy_v1beta1_RollbackConfig,
deepCopy_v1beta1_RollingUpdateDeployment, deepCopy_v1beta1_RollingUpdateDeployment,
deepCopy_v1beta1_RunAsUserStrategyOptions, deepCopy_v1beta1_RunAsUserStrategyOptions,
deepCopy_v1beta1_SELinuxContextStrategyOptions, deepCopy_v1beta1_SELinuxStrategyOptions,
deepCopy_v1beta1_Scale, deepCopy_v1beta1_Scale,
deepCopy_v1beta1_ScaleSpec, deepCopy_v1beta1_ScaleSpec,
deepCopy_v1beta1_ScaleStatus, deepCopy_v1beta1_ScaleStatus,

60
pkg/apis/extensions/v1beta1/types.generated.go
View File

@ -16958,7 +16958,7 @@ func (x *PodSecurityPolicySpec) CodecEncodeSelf(e *codec1978.Encoder) {
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
if yyq2[7] { if yyq2[7] {
yy25 := &x.SELinuxContext yy25 := &x.SELinux
yy25.CodecEncodeSelf(e) yy25.CodecEncodeSelf(e)
} else { } else {
r.EncodeNil() r.EncodeNil()
@ -16966,9 +16966,9 @@ func (x *PodSecurityPolicySpec) CodecEncodeSelf(e *codec1978.Encoder) {
} else { } else {
if yyq2[7] { if yyq2[7] {
z.EncSendContainerState(codecSelfer_containerMapKey1234) z.EncSendContainerState(codecSelfer_containerMapKey1234)
r.EncodeString(codecSelferC_UTF81234, string("seLinuxContext")) r.EncodeString(codecSelferC_UTF81234, string("seLinux"))
z.EncSendContainerState(codecSelfer_containerMapValue1234) z.EncSendContainerState(codecSelfer_containerMapValue1234)
yy27 := &x.SELinuxContext yy27 := &x.SELinux
yy27.CodecEncodeSelf(e) yy27.CodecEncodeSelf(e)
} }
} }
@ -17110,11 +17110,11 @@ func (x *PodSecurityPolicySpec) codecDecodeSelfFromMap(l int, d *codec1978.Decod
} else { } else {
x.HostIPC = bool(r.DecodeBool()) x.HostIPC = bool(r.DecodeBool())
} }
case "seLinuxContext": case "seLinux":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.SELinuxContext = SELinuxContextStrategyOptions{} x.SELinux = SELinuxStrategyOptions{}
} else { } else {
yyv14 := &x.SELinuxContext yyv14 := &x.SELinux
yyv14.CodecDecodeSelf(d) yyv14.CodecDecodeSelf(d)
} }
case "runAsUser": case "runAsUser":
@ -17280,9 +17280,9 @@ func (x *PodSecurityPolicySpec) codecDecodeSelfFromArray(l int, d *codec1978.Dec
} }
z.DecSendContainerState(codecSelfer_containerArrayElem1234) z.DecSendContainerState(codecSelfer_containerArrayElem1234)
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.SELinuxContext = SELinuxContextStrategyOptions{} x.SELinux = SELinuxStrategyOptions{}
} else { } else {
yyv27 := &x.SELinuxContext yyv27 := &x.SELinux
yyv27.CodecDecodeSelf(d) yyv27.CodecDecodeSelf(d)
} }
yyj16++ yyj16++
@ -17547,7 +17547,7 @@ func (x *HostPortRange) codecDecodeSelfFromArray(l int, d *codec1978.Decoder) {
z.DecSendContainerState(codecSelfer_containerArrayEnd1234) z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
} }
func (x *SELinuxContextStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) { func (x *SELinuxStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperEncoder(e) z, r := codec1978.GenHelperEncoder(e)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -17580,12 +17580,12 @@ func (x *SELinuxContextStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) {
} }
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
x.Type.CodecEncodeSelf(e) x.Rule.CodecEncodeSelf(e)
} else { } else {
z.EncSendContainerState(codecSelfer_containerMapKey1234) z.EncSendContainerState(codecSelfer_containerMapKey1234)
r.EncodeString(codecSelferC_UTF81234, string("type")) r.EncodeString(codecSelferC_UTF81234, string("rule"))
z.EncSendContainerState(codecSelfer_containerMapValue1234) z.EncSendContainerState(codecSelfer_containerMapValue1234)
x.Type.CodecEncodeSelf(e) x.Rule.CodecEncodeSelf(e)
} }
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
@ -17619,7 +17619,7 @@ func (x *SELinuxContextStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) {
} }
} }
func (x *SELinuxContextStrategyOptions) CodecDecodeSelf(d *codec1978.Decoder) { func (x *SELinuxStrategyOptions) CodecDecodeSelf(d *codec1978.Decoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperDecoder(d) z, r := codec1978.GenHelperDecoder(d)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -17649,7 +17649,7 @@ func (x *SELinuxContextStrategyOptions) CodecDecodeSelf(d *codec1978.Decoder) {
} }
} }
func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromMap(l int, d *codec1978.Decoder) { func (x *SELinuxStrategyOptions) codecDecodeSelfFromMap(l int, d *codec1978.Decoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperDecoder(d) z, r := codec1978.GenHelperDecoder(d)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -17671,11 +17671,11 @@ func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromMap(l int, d *codec19
yys3 := string(yys3Slc) yys3 := string(yys3Slc)
z.DecSendContainerState(codecSelfer_containerMapValue1234) z.DecSendContainerState(codecSelfer_containerMapValue1234)
switch yys3 { switch yys3 {
case "type": case "rule":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.Type = "" x.Rule = ""
} else { } else {
x.Type = SELinuxContextStrategy(r.DecodeString()) x.Rule = SELinuxStrategy(r.DecodeString())
} }
case "seLinuxOptions": case "seLinuxOptions":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
@ -17695,7 +17695,7 @@ func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromMap(l int, d *codec19
z.DecSendContainerState(codecSelfer_containerMapEnd1234) z.DecSendContainerState(codecSelfer_containerMapEnd1234)
} }
func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromArray(l int, d *codec1978.Decoder) { func (x *SELinuxStrategyOptions) codecDecodeSelfFromArray(l int, d *codec1978.Decoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperDecoder(d) z, r := codec1978.GenHelperDecoder(d)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -17714,9 +17714,9 @@ func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromArray(l int, d *codec
} }
z.DecSendContainerState(codecSelfer_containerArrayElem1234) z.DecSendContainerState(codecSelfer_containerArrayElem1234)
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.Type = "" x.Rule = ""
} else { } else {
x.Type = SELinuxContextStrategy(r.DecodeString()) x.Rule = SELinuxStrategy(r.DecodeString())
} }
yyj6++ yyj6++
if yyhl6 { if yyhl6 {
@ -17755,7 +17755,7 @@ func (x *SELinuxContextStrategyOptions) codecDecodeSelfFromArray(l int, d *codec
z.DecSendContainerState(codecSelfer_containerArrayEnd1234) z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
} }
func (x SELinuxContextStrategy) CodecEncodeSelf(e *codec1978.Encoder) { func (x SELinuxStrategy) CodecEncodeSelf(e *codec1978.Encoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperEncoder(e) z, r := codec1978.GenHelperEncoder(e)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -17768,7 +17768,7 @@ func (x SELinuxContextStrategy) CodecEncodeSelf(e *codec1978.Encoder) {
} }
} }
func (x *SELinuxContextStrategy) CodecDecodeSelf(d *codec1978.Decoder) { func (x *SELinuxStrategy) CodecDecodeSelf(d *codec1978.Decoder) {
var h codecSelfer1234 var h codecSelfer1234
z, r := codec1978.GenHelperDecoder(d) z, r := codec1978.GenHelperDecoder(d)
_, _, _ = h, z, r _, _, _ = h, z, r
@ -17814,12 +17814,12 @@ func (x *RunAsUserStrategyOptions) CodecEncodeSelf(e *codec1978.Encoder) {
} }
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
x.Type.CodecEncodeSelf(e) x.Rule.CodecEncodeSelf(e)
} else { } else {
z.EncSendContainerState(codecSelfer_containerMapKey1234) z.EncSendContainerState(codecSelfer_containerMapKey1234)
r.EncodeString(codecSelferC_UTF81234, string("type")) r.EncodeString(codecSelferC_UTF81234, string("rule"))
z.EncSendContainerState(codecSelfer_containerMapValue1234) z.EncSendContainerState(codecSelfer_containerMapValue1234)
x.Type.CodecEncodeSelf(e) x.Rule.CodecEncodeSelf(e)
} }
if yyr2 || yy2arr2 { if yyr2 || yy2arr2 {
z.EncSendContainerState(codecSelfer_containerArrayElem1234) z.EncSendContainerState(codecSelfer_containerArrayElem1234)
@ -17915,11 +17915,11 @@ func (x *RunAsUserStrategyOptions) codecDecodeSelfFromMap(l int, d *codec1978.De
yys3 := string(yys3Slc) yys3 := string(yys3Slc)
z.DecSendContainerState(codecSelfer_containerMapValue1234) z.DecSendContainerState(codecSelfer_containerMapValue1234)
switch yys3 { switch yys3 {
case "type": case "rule":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.Type = "" x.Rule = ""
} else { } else {
x.Type = RunAsUserStrategy(r.DecodeString()) x.Rule = RunAsUserStrategy(r.DecodeString())
} }
case "ranges": case "ranges":
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
@ -17959,9 +17959,9 @@ func (x *RunAsUserStrategyOptions) codecDecodeSelfFromArray(l int, d *codec1978.
} }
z.DecSendContainerState(codecSelfer_containerArrayElem1234) z.DecSendContainerState(codecSelfer_containerArrayElem1234)
if r.TryDecodeAsNil() { if r.TryDecodeAsNil() {
x.Type = "" x.Rule = ""
} else { } else {
x.Type = RunAsUserStrategy(r.DecodeString()) x.Rule = RunAsUserStrategy(r.DecodeString())
} }
yyj7++ yyj7++
if yyhl7 { if yyhl7 {

24
pkg/apis/extensions/v1beta1/types.go
View File

@ -932,8 +932,8 @@ type PodSecurityPolicySpec struct {
HostPID bool `json:"hostPID,omitempty"` HostPID bool `json:"hostPID,omitempty"`
// hostIPC determines if the policy allows the use of HostIPC in the pod spec. // hostIPC determines if the policy allows the use of HostIPC in the pod spec.
HostIPC bool `json:"hostIPC,omitempty"` HostIPC bool `json:"hostIPC,omitempty"`
// seLinuxContext is the strategy that will dictate the allowable labels that may be set. // seLinux is the strategy that will dictate the allowable labels that may be set.
SELinuxContext SELinuxContextStrategyOptions `json:"seLinuxContext,omitempty"` SELinux SELinuxStrategyOptions `json:"seLinux,omitempty"`
// runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set. // runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.
RunAsUser RunAsUserStrategyOptions `json:"runAsUser,omitempty"` RunAsUser RunAsUserStrategyOptions `json:"runAsUser,omitempty"`
} }
@ -968,30 +968,30 @@ type HostPortRange struct {
Max int32 `json:"max"` Max int32 `json:"max"`
} }
// SELinux Context Strategy Options defines the strategy type and any options used to create the strategy. // SELinux Strategy Options defines the strategy type and any options used to create the strategy.
type SELinuxContextStrategyOptions struct { type SELinuxStrategyOptions struct {
// type is the strategy that will dictate the allowable labels that may be set. // type is the strategy that will dictate the allowable labels that may be set.
Type SELinuxContextStrategy `json:"type"` Rule SELinuxStrategy `json:"rule"`
// seLinuxOptions required to run as; required for MustRunAs // seLinuxOptions required to run as; required for MustRunAs
// More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context // More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context
SELinuxOptions *v1.SELinuxOptions `json:"seLinuxOptions,omitempty"` SELinuxOptions *v1.SELinuxOptions `json:"seLinuxOptions,omitempty"`
} }
// SELinux Context Strategy Type denotes strategy types for generating SELinux options for a // SELinuxStrategy denotes strategy types for generating SELinux options for a
// Security Context. // Security Context.
type SELinuxContextStrategy string type SELinuxStrategy string
const ( const (
// container must have SELinux labels of X applied. // container must have SELinux labels of X applied.
SELinuxStrategyMustRunAs SELinuxContextStrategy = "MustRunAs" SELinuxStrategyMustRunAs SELinuxStrategy = "MustRunAs"
// container may make requests for any SELinux context labels. // container may make requests for any SELinux context labels.
SELinuxStrategyRunAsAny SELinuxContextStrategy = "RunAsAny" SELinuxStrategyRunAsAny SELinuxStrategy = "RunAsAny"
) )
// Run A sUser Strategy Options defines the strategy type and any options used to create the strategy. // Run A sUser Strategy Options defines the strategy type and any options used to create the strategy.
type RunAsUserStrategyOptions struct { type RunAsUserStrategyOptions struct {
// type is the strategy that will dictate the allowable RunAsUser values that may be set. // Rule is the strategy that will dictate the allowable RunAsUser values that may be set.
Type RunAsUserStrategy `json:"type"` Rule RunAsUserStrategy `json:"rule"`
// Ranges are the allowed ranges of uids that may be used. // Ranges are the allowed ranges of uids that may be used.
Ranges []IDRange `json:"ranges,omitempty"` Ranges []IDRange `json:"ranges,omitempty"`
} }
@ -1004,7 +1004,7 @@ type IDRange struct {
Max int64 `json:"max"` Max int64 `json:"max"`
} }
// Run As User Strategy Type denotes strategy types for generating RunAsUser values for a // RunAsUserStrategy denotes strategy types for generating RunAsUser values for a
// Security Context. // Security Context.
type RunAsUserStrategy string type RunAsUserStrategy string

32
pkg/apis/extensions/v1beta1/types_swagger_doc_generated.go
View File

@ -468,16 +468,16 @@ func (PodSecurityPolicyList) SwaggerDoc() map[string]string {
} }
var map_PodSecurityPolicySpec = map[string]string{ var map_PodSecurityPolicySpec = map[string]string{
"": "Pod Security Policy Spec defines the policy enforced.", "": "Pod Security Policy Spec defines the policy enforced.",
"privileged": "privileged determines if a pod can request to be run as privileged.", "privileged": "privileged determines if a pod can request to be run as privileged.",
"capabilities": "capabilities is a list of capabilities that can be added.", "capabilities": "capabilities is a list of capabilities that can be added.",
"volumes": "volumes is a white list of allowed volume plugins. Empty indicates that all plugins may be used.", "volumes": "volumes is a white list of allowed volume plugins. Empty indicates that all plugins may be used.",
"hostNetwork": "hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.", "hostNetwork": "hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.",
"hostPorts": "hostPorts determines which host port ranges are allowed to be exposed.", "hostPorts": "hostPorts determines which host port ranges are allowed to be exposed.",
"hostPID": "hostPID determines if the policy allows the use of HostPID in the pod spec.", "hostPID": "hostPID determines if the policy allows the use of HostPID in the pod spec.",
"hostIPC": "hostIPC determines if the policy allows the use of HostIPC in the pod spec.", "hostIPC": "hostIPC determines if the policy allows the use of HostIPC in the pod spec.",
"seLinuxContext": "seLinuxContext is the strategy that will dictate the allowable labels that may be set.", "seLinux": "seLinux is the strategy that will dictate the allowable labels that may be set.",
"runAsUser": "runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.", "runAsUser": "runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.",
} }
func (PodSecurityPolicySpec) SwaggerDoc() map[string]string { func (PodSecurityPolicySpec) SwaggerDoc() map[string]string {
@ -554,7 +554,7 @@ func (RollingUpdateDeployment) SwaggerDoc() map[string]string {
var map_RunAsUserStrategyOptions = map[string]string{ var map_RunAsUserStrategyOptions = map[string]string{
"": "Run A sUser Strategy Options defines the strategy type and any options used to create the strategy.", "": "Run A sUser Strategy Options defines the strategy type and any options used to create the strategy.",
"type": "type is the strategy that will dictate the allowable RunAsUser values that may be set.", "rule": "Rule is the strategy that will dictate the allowable RunAsUser values that may be set.",
"ranges": "Ranges are the allowed ranges of uids that may be used.", "ranges": "Ranges are the allowed ranges of uids that may be used.",
} }
@ -562,14 +562,14 @@ func (RunAsUserStrategyOptions) SwaggerDoc() map[string]string {
return map_RunAsUserStrategyOptions return map_RunAsUserStrategyOptions
} }
var map_SELinuxContextStrategyOptions = map[string]string{ var map_SELinuxStrategyOptions = map[string]string{
"": "SELinux Context Strategy Options defines the strategy type and any options used to create the strategy.", "": "SELinux Strategy Options defines the strategy type and any options used to create the strategy.",
"type": "type is the strategy that will dictate the allowable labels that may be set.", "rule": "type is the strategy that will dictate the allowable labels that may be set.",
"seLinuxOptions": "seLinuxOptions required to run as; required for MustRunAs More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context", "seLinuxOptions": "seLinuxOptions required to run as; required for MustRunAs More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context",
} }
func (SELinuxContextStrategyOptions) SwaggerDoc() map[string]string { func (SELinuxStrategyOptions) SwaggerDoc() map[string]string {
return map_SELinuxContextStrategyOptions return map_SELinuxStrategyOptions
} }
var map_Scale = map[string]string{ var map_Scale = map[string]string{

22
pkg/apis/extensions/validation/validation.go
View File

@ -759,21 +759,21 @@ func ValidatePodSecurityPolicySpec(spec *extensions.PodSecurityPolicySpec, fldPa
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
allErrs = append(allErrs, validatePSPRunAsUser(fldPath.Child("runAsUser"), &spec.RunAsUser)...) allErrs = append(allErrs, validatePSPRunAsUser(fldPath.Child("runAsUser"), &spec.RunAsUser)...)
allErrs = append(allErrs, validatePSPSELinuxContext(fldPath.Child("seLinuxContext"), &spec.SELinuxContext)...) allErrs = append(allErrs, validatePSPSELinux(fldPath.Child("seLinux"), &spec.SELinux)...)
allErrs = append(allErrs, validatePodSecurityPolicyVolumes(fldPath, spec.Volumes)...) allErrs = append(allErrs, validatePodSecurityPolicyVolumes(fldPath, spec.Volumes)...)
return allErrs return allErrs
} }
// validatePSPSELinuxContext validates the SELinuxContext fields of PodSecurityPolicy. // validatePSPSELinux validates the SELinux fields of PodSecurityPolicy.
func validatePSPSELinuxContext(fldPath *field.Path, seLinuxContext *extensions.SELinuxContextStrategyOptions) field.ErrorList { func validatePSPSELinux(fldPath *field.Path, seLinux *extensions.SELinuxStrategyOptions) field.ErrorList {
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
// ensure the selinux strategy has a valid type // ensure the selinux strategy has a valid rule
supportedSELinuxContextTypes := sets.NewString(string(extensions.SELinuxStrategyMustRunAs), supportedSELinuxRules := sets.NewString(string(extensions.SELinuxStrategyMustRunAs),
string(extensions.SELinuxStrategyRunAsAny)) string(extensions.SELinuxStrategyRunAsAny))
if !supportedSELinuxContextTypes.Has(string(seLinuxContext.Type)) { if !supportedSELinuxRules.Has(string(seLinux.Rule)) {
allErrs = append(allErrs, field.NotSupported(fldPath.Child("type"), seLinuxContext.Type, supportedSELinuxContextTypes.List())) allErrs = append(allErrs, field.NotSupported(fldPath.Child("rule"), seLinux.Rule, supportedSELinuxRules.List()))
} }
return allErrs return allErrs
@ -783,12 +783,12 @@ func validatePSPSELinuxContext(fldPath *field.Path, seLinuxContext *extensions.S
func validatePSPRunAsUser(fldPath *field.Path, runAsUser *extensions.RunAsUserStrategyOptions) field.ErrorList { func validatePSPRunAsUser(fldPath *field.Path, runAsUser *extensions.RunAsUserStrategyOptions) field.ErrorList {
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
// ensure the user strategy has a valid type // ensure the user strategy has a valid rule
supportedRunAsUserTypes := sets.NewString(string(extensions.RunAsUserStrategyMustRunAs), supportedRunAsUserRules := sets.NewString(string(extensions.RunAsUserStrategyMustRunAs),
string(extensions.RunAsUserStrategyMustRunAsNonRoot), string(extensions.RunAsUserStrategyMustRunAsNonRoot),
string(extensions.RunAsUserStrategyRunAsAny)) string(extensions.RunAsUserStrategyRunAsAny))
if !supportedRunAsUserTypes.Has(string(runAsUser.Type)) { if !supportedRunAsUserRules.Has(string(runAsUser.Rule)) {
allErrs = append(allErrs, field.NotSupported(fldPath.Child("type"), runAsUser.Type, supportedRunAsUserTypes.List())) allErrs = append(allErrs, field.NotSupported(fldPath.Child("rule"), runAsUser.Rule, supportedRunAsUserRules.List()))
} }
// validate range settings // validate range settings

32
pkg/apis/extensions/validation/validation_test.go
View File

@ -1898,27 +1898,27 @@ func TestValidatePodSecurityPolicy(t *testing.T) {
return &extensions.PodSecurityPolicy{ return &extensions.PodSecurityPolicy{
ObjectMeta: api.ObjectMeta{Name: "foo"}, ObjectMeta: api.ObjectMeta{Name: "foo"},
Spec: extensions.PodSecurityPolicySpec{ Spec: extensions.PodSecurityPolicySpec{
SELinuxContext: extensions.SELinuxContextStrategyOptions{ SELinux: extensions.SELinuxStrategyOptions{
Type: extensions.SELinuxStrategyRunAsAny, Rule: extensions.SELinuxStrategyRunAsAny,
}, },
RunAsUser: extensions.RunAsUserStrategyOptions{ RunAsUser: extensions.RunAsUserStrategyOptions{
Type: extensions.RunAsUserStrategyRunAsAny, Rule: extensions.RunAsUserStrategyRunAsAny,
}, },
}, },
} }
} }
noUserOptions := validSCC() noUserOptions := validSCC()
noUserOptions.Spec.RunAsUser.Type = "" noUserOptions.Spec.RunAsUser.Rule = ""
noSELinuxOptions := validSCC() noSELinuxOptions := validSCC()
noSELinuxOptions.Spec.SELinuxContext.Type = "" noSELinuxOptions.Spec.SELinux.Rule = ""
invalidUserStratType := validSCC() invalidUserStratRule := validSCC()
invalidUserStratType.Spec.RunAsUser.Type = "invalid" invalidUserStratRule.Spec.RunAsUser.Rule = "invalid"
invalidSELinuxStratType := validSCC() invalidSELinuxStratRule := validSCC()
invalidSELinuxStratType.Spec.SELinuxContext.Type = "invalid" invalidSELinuxStratRule.Spec.SELinux.Rule = "invalid"
missingObjectMetaName := validSCC() missingObjectMetaName := validSCC()
missingObjectMetaName.ObjectMeta.Name = "" missingObjectMetaName.ObjectMeta.Name = ""
@ -1950,12 +1950,12 @@ func TestValidatePodSecurityPolicy(t *testing.T) {
scc: noSELinuxOptions, scc: noSELinuxOptions,
errorDetail: "supported values: MustRunAs, RunAsAny", errorDetail: "supported values: MustRunAs, RunAsAny",
}, },
"invalid user strategy type": { "invalid user strategy rule": {
scc: invalidUserStratType, scc: invalidUserStratRule,
errorDetail: "supported values: MustRunAs, MustRunAsNonRoot, RunAsAny", errorDetail: "supported values: MustRunAs, MustRunAsNonRoot, RunAsAny",
}, },
"invalid selinux strategy type": { "invalid selinux strategy rule": {
scc: invalidSELinuxStratType, scc: invalidSELinuxStratRule,
errorDetail: "supported values: MustRunAs, RunAsAny", errorDetail: "supported values: MustRunAs, RunAsAny",
}, },
"missing object meta name": { "missing object meta name": {
@ -1983,17 +1983,17 @@ func TestValidatePodSecurityPolicy(t *testing.T) {
} }
mustRunAs := validSCC() mustRunAs := validSCC()
mustRunAs.Spec.RunAsUser.Type = extensions.RunAsUserStrategyMustRunAs mustRunAs.Spec.RunAsUser.Rule = extensions.RunAsUserStrategyMustRunAs
mustRunAs.Spec.RunAsUser.Ranges = []extensions.IDRange{ mustRunAs.Spec.RunAsUser.Ranges = []extensions.IDRange{
{ {
Min: 1, Min: 1,
Max: 1, Max: 1,
}, },
} }
mustRunAs.Spec.SELinuxContext.Type = extensions.SELinuxStrategyMustRunAs mustRunAs.Spec.SELinux.Rule = extensions.SELinuxStrategyMustRunAs
runAsNonRoot := validSCC() runAsNonRoot := validSCC()
runAsNonRoot.Spec.RunAsUser.Type = extensions.RunAsUserStrategyMustRunAsNonRoot runAsNonRoot.Spec.RunAsUser.Rule = extensions.RunAsUserStrategyMustRunAsNonRoot
successCases := map[string]struct { successCases := map[string]struct {
scc *extensions.PodSecurityPolicy scc *extensions.PodSecurityPolicy

4
pkg/kubectl/resource_printer.go
View File

@ -1669,8 +1669,8 @@ func printConfigMapList(list *api.ConfigMapList, w io.Writer, options PrintOptio
func printPodSecurityPolicy(item *extensions.PodSecurityPolicy, w io.Writer, options PrintOptions) error { func printPodSecurityPolicy(item *extensions.PodSecurityPolicy, w io.Writer, options PrintOptions) error {
_, err := fmt.Fprintf(w, "%s\t%t\t%v\t%t\t%s\t%s\n", item.Name, item.Spec.Privileged, _, err := fmt.Fprintf(w, "%s\t%t\t%v\t%t\t%s\t%s\n", item.Name, item.Spec.Privileged,
item.Spec.Capabilities, item.Spec.Volumes, item.Spec.SELinuxContext.Type, item.Spec.Capabilities, item.Spec.Volumes, item.Spec.SELinux.Rule,
item.Spec.RunAsUser.Type) item.Spec.RunAsUser.Rule)
return err return err
} }

6
pkg/registry/podsecuritypolicy/etcd/etcd_test.go
View File

@ -43,11 +43,11 @@ func validNewPodSecurityPolicy() *extensions.PodSecurityPolicy {
Name: "foo", Name: "foo",
}, },
Spec: extensions.PodSecurityPolicySpec{ Spec: extensions.PodSecurityPolicySpec{
SELinuxContext: extensions.SELinuxContextStrategyOptions{ SELinux: extensions.SELinuxStrategyOptions{
Type: extensions.SELinuxStrategyRunAsAny, Rule: extensions.SELinuxStrategyRunAsAny,
}, },
RunAsUser: extensions.RunAsUserStrategyOptions{ RunAsUser: extensions.RunAsUserStrategyOptions{
Type: extensions.RunAsUserStrategyRunAsAny, Rule: extensions.RunAsUserStrategyRunAsAny,
}, },
}, },
} }

8
pkg/securitycontext/util.go
View File

@ -47,16 +47,16 @@ func HasCapabilitiesRequest(container *api.Container) bool {
return len(container.SecurityContext.Capabilities.Add) > 0 || len(container.SecurityContext.Capabilities.Drop) > 0 return len(container.SecurityContext.Capabilities.Add) > 0 || len(container.SecurityContext.Capabilities.Drop) > 0
} }
const expectedSELinuxContextFields = 4 const expectedSELinuxFields = 4
// ParseSELinuxOptions parses a string containing a full SELinux context // ParseSELinuxOptions parses a string containing a full SELinux context
// (user, role, type, and level) into an SELinuxOptions object. If the // (user, role, type, and level) into an SELinuxOptions object. If the
// context is malformed, an error is returned. // context is malformed, an error is returned.
func ParseSELinuxOptions(context string) (*api.SELinuxOptions, error) { func ParseSELinuxOptions(context string) (*api.SELinuxOptions, error) {
fields := strings.SplitN(context, ":", expectedSELinuxContextFields) fields := strings.SplitN(context, ":", expectedSELinuxFields)
if len(fields) != expectedSELinuxContextFields { if len(fields) != expectedSELinuxFields {
return nil, fmt.Errorf("expected %v fields in selinuxcontext; got %v (context: %v)", expectedSELinuxContextFields, len(fields), context) return nil, fmt.Errorf("expected %v fields in selinux; got %v (context: %v)", expectedSELinuxFields, len(fields), context)
} }
return &api.SELinuxOptions{ return &api.SELinuxOptions{

6
pkg/volume/empty_dir/empty_dir.go
View File

@ -200,7 +200,7 @@ func (ed *emptyDir) SetUpAt(dir string, fsGroup *int64) error {
// setupTmpfs creates a tmpfs mount at the specified directory with the // setupTmpfs creates a tmpfs mount at the specified directory with the
// specified SELinux context. // specified SELinux context.
func (ed *emptyDir) setupTmpfs(dir string, selinuxContext string) error { func (ed *emptyDir) setupTmpfs(dir string, selinux string) error {
if ed.mounter == nil { if ed.mounter == nil {
return fmt.Errorf("memory storage requested, but mounter is nil") return fmt.Errorf("memory storage requested, but mounter is nil")
} }
@ -221,8 +221,8 @@ func (ed *emptyDir) setupTmpfs(dir string, selinuxContext string) error {
// By default a tmpfs mount will receive a different SELinux context // By default a tmpfs mount will receive a different SELinux context
// which is not readable from the SELinux context of a docker container. // which is not readable from the SELinux context of a docker container.
var opts []string var opts []string
if selinuxContext != "" { if selinux != "" {
opts = []string{fmt.Sprintf("rootcontext=\"%v\"", selinuxContext)} opts = []string{fmt.Sprintf("rootcontext=\"%v\"", selinux)}
} else { } else {
opts = []string{} opts = []string{}
} }

6
pkg/volume/empty_dir/empty_dir_test.go
View File

@ -88,7 +88,7 @@ func TestPluginRootContextSet(t *testing.T) {
doTestPlugin(t, pluginTestConfig{ doTestPlugin(t, pluginTestConfig{
medium: api.StorageMediumDefault, medium: api.StorageMediumDefault,
rootContext: "user:role:type:range", rootContext: "user:role:type:range",
expectedSELinuxContext: "user:role:type:range", expectedSELinux: "user:role:type:range",
expectedSetupMounts: 0, expectedSetupMounts: 0,
expectedTeardownMounts: 0}) expectedTeardownMounts: 0})
} }
@ -101,7 +101,7 @@ func TestPluginTmpfs(t *testing.T) {
doTestPlugin(t, pluginTestConfig{ doTestPlugin(t, pluginTestConfig{
medium: api.StorageMediumMemory, medium: api.StorageMediumMemory,
rootContext: "user:role:type:range", rootContext: "user:role:type:range",
expectedSELinuxContext: "user:role:type:range", expectedSELinux: "user:role:type:range",
expectedSetupMounts: 1, expectedSetupMounts: 1,
shouldBeMountedBeforeTeardown: true, shouldBeMountedBeforeTeardown: true,
expectedTeardownMounts: 1}) expectedTeardownMounts: 1})
@ -112,7 +112,7 @@ type pluginTestConfig struct {
rootContext string rootContext string
SELinuxOptions *api.SELinuxOptions SELinuxOptions *api.SELinuxOptions
idempotent bool idempotent bool
expectedSELinuxContext string expectedSELinux string
expectedSetupMounts int expectedSetupMounts int
shouldBeMountedBeforeTeardown bool shouldBeMountedBeforeTeardown bool
expectedTeardownMounts int expectedTeardownMounts int