github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-23 19:56:01 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #107426 from yanghesong/remove_validate_runtime

Browse Source 
Remove runtime in validate
This commit is contained in:
Kubernetes Prow Robot 2022-01-11 20:50:36 -08:00 committed by GitHub
commit b5103f6117
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 5 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/kubelet/kubelet.go
View File

@ -834,7 +834,7 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration,
if sysruntime.GOOS == "linux" { if sysruntime.GOOS == "linux" {
// AppArmor is a Linux kernel security module and it does not support other operating systems. // AppArmor is a Linux kernel security module and it does not support other operating systems.
klet.appArmorValidator = apparmor.NewValidator(containerRuntime) klet.appArmorValidator = apparmor.NewValidator()
klet.softAdmitHandlers.AddPodAdmitHandler(lifecycle.NewAppArmorAdmitHandler(klet.appArmorValidator)) klet.softAdmitHandlers.AddPodAdmitHandler(lifecycle.NewAppArmorAdmitHandler(klet.appArmorValidator))
} }
klet.softAdmitHandlers.AddPodAdmitHandler(lifecycle.NewNoNewPrivsAdmitHandler(klet.containerRuntime)) klet.softAdmitHandlers.AddPodAdmitHandler(lifecycle.NewNoNewPrivsAdmitHandler(klet.containerRuntime))

12
pkg/security/apparmor/validate.go
View File

@ -29,7 +29,6 @@ import (
utilfeature "k8s.io/apiserver/pkg/util/feature" utilfeature "k8s.io/apiserver/pkg/util/feature"
podutil "k8s.io/kubernetes/pkg/api/v1/pod" podutil "k8s.io/kubernetes/pkg/api/v1/pod"
"k8s.io/kubernetes/pkg/features" "k8s.io/kubernetes/pkg/features"
kubetypes "k8s.io/kubernetes/pkg/kubelet/types"
utilpath "k8s.io/utils/path" utilpath "k8s.io/utils/path"
) )
@ -44,8 +43,8 @@ type Validator interface {
} }
// NewValidator is in order to find AppArmor FS // NewValidator is in order to find AppArmor FS
func NewValidator(runtime string) Validator { func NewValidator() Validator {
if err := validateHost(runtime); err != nil { if err := validateHost(); err != nil {
return &validator{validateHostErr: err} return &validator{validateHostErr: err}
} }
appArmorFS, err := getAppArmorFS() appArmorFS, err := getAppArmorFS()
@ -90,7 +89,7 @@ func (v *validator) ValidateHost() error {
} }
// Verify that the host and runtime is capable of enforcing AppArmor profiles. // Verify that the host and runtime is capable of enforcing AppArmor profiles.
func validateHost(runtime string) error { func validateHost() error {
// Check feature-gates // Check feature-gates
if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) { if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) {
return errors.New("AppArmor disabled by feature-gate") return errors.New("AppArmor disabled by feature-gate")
@ -106,11 +105,6 @@ func validateHost(runtime string) error {
return errors.New("AppArmor is not enabled on the host") return errors.New("AppArmor is not enabled on the host")
} }
// Check runtime support. Currently only Docker is supported.
if runtime != kubetypes.DockerContainerRuntime && runtime != kubetypes.RemoteContainerRuntime {
return fmt.Errorf("AppArmor is only enabled for 'docker' and 'remote' runtimes. Found: %q", runtime)
}
return nil return nil
} }

3
pkg/security/apparmor/validate_test.go
View File

@ -43,8 +43,7 @@ func TestValidateHost(t *testing.T) {
// The test should be manually run if modifying the getAppArmorFS function. // The test should be manually run if modifying the getAppArmorFS function.
t.Skip() t.Skip()
assert.NoError(t, validateHost("docker")) assert.NoError(t, validateHost())
assert.Error(t, validateHost("rkt"))
} }
func TestValidateProfileFormat(t *testing.T) { func TestValidateProfileFormat(t *testing.T) {