github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-03 17:30:00 +00:00
Code Issues Projects Releases Wiki Activity

Move to debian-base non-root image

Browse Source
This commit is contained in:
Tim Allclair 2019-05-24 11:57:43 -07:00
parent 6e78c5bdde
commit c851c480d3
5 changed files with 6 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
test/e2e/common/security_context.go
View File

@ -97,7 +97,7 @@ var _ = framework.KubeDescribe("Security Context", func() {
Context("When creating a container with runAsNonRoot", func() { Context("When creating a container with runAsNonRoot", func() {
rootImage := imageutils.GetE2EImage(imageutils.BusyBox) rootImage := imageutils.GetE2EImage(imageutils.BusyBox)
nonRootImage := imageutils.GetE2EImage(imageutils.BusyBoxUser) nonRootImage := imageutils.GetE2EImage(imageutils.NonRoot)
makeNonRootPod := func(podName, image string, userid *int64) *v1.Pod { makeNonRootPod := func(podName, image string, userid *int64) *v1.Pod {
return &v1.Pod{ return &v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{

5
test/images/busybox-user/BASEIMAGE
View File

@ -1,5 +0,0 @@
amd64=busybox
arm=arm32v6/busybox
arm64=arm64v8/busybox
ppc64le=ppc64le/busybox
s390x=s390x/busybox

4
test/images/busybox-user/Dockerfile → test/images/nonroot/Dockerfile
View File

@ -1,4 +1,4 @@
# Copyright 2016 The Kubernetes Authors. # Copyright 2019 The Kubernetes Authors.
# #
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
@ -12,6 +12,6 @@
# See the License for the specific language governing permissions and # See the License for the specific language governing permissions and
# limitations under the License. # limitations under the License.
FROM BASEIMAGE FROM k8s.gcr.io/debian-base:v1.0.0
USER 1234 USER 1234

0
test/images/busybox-user/VERSION → test/images/nonroot/VERSION
View File

6
test/utils/image/manifest.go
View File

@ -108,8 +108,6 @@ const (
AuditProxy AuditProxy
// BusyBox image // BusyBox image
BusyBox BusyBox
// BusyBox image with default user 1234
BusyBoxUser
// CheckMetadataConcealment image // CheckMetadataConcealment image
CheckMetadataConcealment CheckMetadataConcealment
// CudaVectorAdd image // CudaVectorAdd image
@ -164,6 +162,8 @@ const (
NginxNew NginxNew
// Nonewprivs image // Nonewprivs image
Nonewprivs Nonewprivs
// NonRoot runs with a default user of 1234
NonRoot
// NoSnatTest image // NoSnatTest image
NoSnatTest NoSnatTest
// NoSnatTestProxy image // NoSnatTestProxy image
@ -204,7 +204,6 @@ func initImageConfigs() map[int]Config {
configs[AppArmorLoader] = Config{e2eRegistry, "apparmor-loader", "1.0"} configs[AppArmorLoader] = Config{e2eRegistry, "apparmor-loader", "1.0"}
configs[AuditProxy] = Config{e2eRegistry, "audit-proxy", "1.0"} configs[AuditProxy] = Config{e2eRegistry, "audit-proxy", "1.0"}
configs[BusyBox] = Config{dockerLibraryRegistry, "busybox", "1.29"} configs[BusyBox] = Config{dockerLibraryRegistry, "busybox", "1.29"}
configs[BusyBoxUser] = Config{e2eRegistry, "busybox-user", "1.0"}
configs[CheckMetadataConcealment] = Config{e2eRegistry, "metadata-concealment", "1.2"} configs[CheckMetadataConcealment] = Config{e2eRegistry, "metadata-concealment", "1.2"}
configs[CudaVectorAdd] = Config{e2eRegistry, "cuda-vector-add", "1.0"} configs[CudaVectorAdd] = Config{e2eRegistry, "cuda-vector-add", "1.0"}
configs[CudaVectorAdd2] = Config{e2eRegistry, "cuda-vector-add", "2.0"} configs[CudaVectorAdd2] = Config{e2eRegistry, "cuda-vector-add", "2.0"}
@ -232,6 +231,7 @@ func initImageConfigs() map[int]Config {
configs[Nginx] = Config{dockerLibraryRegistry, "nginx", "1.14-alpine"} configs[Nginx] = Config{dockerLibraryRegistry, "nginx", "1.14-alpine"}
configs[NginxNew] = Config{dockerLibraryRegistry, "nginx", "1.15-alpine"} configs[NginxNew] = Config{dockerLibraryRegistry, "nginx", "1.15-alpine"}
configs[Nonewprivs] = Config{e2eRegistry, "nonewprivs", "1.0"} configs[Nonewprivs] = Config{e2eRegistry, "nonewprivs", "1.0"}
configs[NonRoot] = Config{e2eRegistry, "nonroot", "1.0"}
configs[NoSnatTest] = Config{e2eRegistry, "no-snat-test", "1.0"} configs[NoSnatTest] = Config{e2eRegistry, "no-snat-test", "1.0"}
configs[NoSnatTestProxy] = Config{e2eRegistry, "no-snat-test-proxy", "1.0"} configs[NoSnatTestProxy] = Config{e2eRegistry, "no-snat-test-proxy", "1.0"}
// Pause - when these values are updated, also update cmd/kubelet/app/options/container_runtime.go // Pause - when these values are updated, also update cmd/kubelet/app/options/container_runtime.go