github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 20:53:33 +00:00
Code Issues Projects Releases Wiki Activity

Add namespace mode targeting to dockershim

Browse Source
This commit is contained in:
Lee Verberne 2019-11-03 17:13:32 +00:00
parent 4d4e111f01
commit d05bcf6800
2 changed files with 54 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
pkg/kubelet/dockershim/security_context.go
View File

@ -146,24 +146,23 @@ func modifyHostConfig(sc *runtimeapi.LinuxContainerSecurityContext, hostConfig *
// modifySandboxNamespaceOptions apply namespace options for sandbox // modifySandboxNamespaceOptions apply namespace options for sandbox
func modifySandboxNamespaceOptions(nsOpts *runtimeapi.NamespaceOption, hostConfig *dockercontainer.HostConfig, network *knetwork.PluginManager) { func modifySandboxNamespaceOptions(nsOpts *runtimeapi.NamespaceOption, hostConfig *dockercontainer.HostConfig, network *knetwork.PluginManager) {
// The sandbox's PID namespace is the one that's shared, so CONTAINER and POD are equivalent for it // The sandbox's PID namespace is the one that's shared, so CONTAINER and POD are equivalent for it
modifyCommonNamespaceOptions(nsOpts, hostConfig) if nsOpts.GetPid() == runtimeapi.NamespaceMode_NODE {
hostConfig.PidMode = namespaceModeHost
}
modifyHostOptionsForSandbox(nsOpts, network, hostConfig) modifyHostOptionsForSandbox(nsOpts, network, hostConfig)
} }
// modifyContainerNamespaceOptions apply namespace options for container // modifyContainerNamespaceOptions apply namespace options for container
func modifyContainerNamespaceOptions(nsOpts *runtimeapi.NamespaceOption, podSandboxID string, hostConfig *dockercontainer.HostConfig) { func modifyContainerNamespaceOptions(nsOpts *runtimeapi.NamespaceOption, podSandboxID string, hostConfig *dockercontainer.HostConfig) {
if nsOpts.GetPid() == runtimeapi.NamespaceMode_POD { switch nsOpts.GetPid() {
hostConfig.PidMode = dockercontainer.PidMode(fmt.Sprintf("container:%v", podSandboxID)) case runtimeapi.NamespaceMode_NODE:
}
modifyCommonNamespaceOptions(nsOpts, hostConfig)
modifyHostOptionsForContainer(nsOpts, podSandboxID, hostConfig)
}
// modifyCommonNamespaceOptions apply common namespace options for sandbox and container
func modifyCommonNamespaceOptions(nsOpts *runtimeapi.NamespaceOption, hostConfig *dockercontainer.HostConfig) {
if nsOpts.GetPid() == runtimeapi.NamespaceMode_NODE {
hostConfig.PidMode = namespaceModeHost hostConfig.PidMode = namespaceModeHost
case runtimeapi.NamespaceMode_POD:
hostConfig.PidMode = dockercontainer.PidMode(fmt.Sprintf("container:%v", podSandboxID))
case runtimeapi.NamespaceMode_TARGET:
hostConfig.PidMode = dockercontainer.PidMode(fmt.Sprintf("container:%v", nsOpts.GetTargetId()))
} }
modifyHostOptionsForContainer(nsOpts, podSandboxID, hostConfig)
} }
// modifyHostOptionsForSandbox applies NetworkMode/UTSMode to sandbox's dockercontainer.HostConfig. // modifyHostOptionsForSandbox applies NetworkMode/UTSMode to sandbox's dockercontainer.HostConfig.

44
pkg/kubelet/dockershim/security_context_test.go
View File

@ -345,6 +345,27 @@ func TestModifySandboxNamespaceOptions(t *testing.T) {
NetworkMode: "default", NetworkMode: "default",
}, },
}, },
{
name: "Pod PID NamespaceOption (for sandbox is same as container ns option)",
nsOpt: &runtimeapi.NamespaceOption{
Pid: runtimeapi.NamespaceMode_POD,
},
expected: &dockercontainer.HostConfig{
PidMode: "",
NetworkMode: "default",
},
},
{
name: "Target PID NamespaceOption (invalid for sandbox)",
nsOpt: &runtimeapi.NamespaceOption{
Pid: runtimeapi.NamespaceMode_TARGET,
TargetId: "same-container",
},
expected: &dockercontainer.HostConfig{
PidMode: "",
NetworkMode: "default",
},
},
} }
for _, tc := range cases { for _, tc := range cases {
dockerCfg := &dockercontainer.HostConfig{} dockerCfg := &dockercontainer.HostConfig{}
@ -395,6 +416,29 @@ func TestModifyContainerNamespaceOptions(t *testing.T) {
PidMode: namespaceModeHost, PidMode: namespaceModeHost,
}, },
}, },
{
name: "Pod PID NamespaceOption",
nsOpt: &runtimeapi.NamespaceOption{
Pid: runtimeapi.NamespaceMode_POD,
},
expected: &dockercontainer.HostConfig{
NetworkMode: dockercontainer.NetworkMode(sandboxNSMode),
IpcMode: dockercontainer.IpcMode(sandboxNSMode),
PidMode: dockercontainer.PidMode(sandboxNSMode),
},
},
{
name: "Target PID NamespaceOption",
nsOpt: &runtimeapi.NamespaceOption{
Pid: runtimeapi.NamespaceMode_TARGET,
TargetId: "some-container",
},
expected: &dockercontainer.HostConfig{
NetworkMode: dockercontainer.NetworkMode(sandboxNSMode),
IpcMode: dockercontainer.IpcMode(sandboxNSMode),
PidMode: dockercontainer.PidMode("container:some-container"),
},
},
} }
for _, tc := range cases { for _, tc := range cases {
dockerCfg := &dockercontainer.HostConfig{} dockerCfg := &dockercontainer.HostConfig{}