github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-20 09:33:52 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #105885 from gnufied/move-configurable-fsgroup-ga

Browse Source 
Move configurable fsgroup to GA
This commit is contained in:
Kubernetes Prow Robot
2021-11-10 13:53:27 -08:00
committed by GitHub
parent 6b41d75794 27d1e9a4e2
commit dcf0a031e9
6 changed files with 3 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
pkg/api/pod/util.go
View File

@@ -571,8 +571,6 @@ func dropDisabledFields(
})
}
dropDisabledFSGroupFields(podSpec, oldPodSpec)
if !utilfeature.DefaultFeatureGate.Enabled(features.PodOverhead) && !overheadInUse(oldPodSpec) {
// Set Overhead to nil only if the feature is disabled and it is not used
podSpec.Overhead = nil
@@ -623,16 +621,6 @@ func dropDisabledProcMountField(podSpec, oldPodSpec *api.PodSpec) {
}
}
func dropDisabledFSGroupFields(podSpec, oldPodSpec *api.PodSpec) {
if !utilfeature.DefaultFeatureGate.Enabled(features.ConfigurableFSGroupPolicy) && !fsGroupPolicyInUse(oldPodSpec) {
// if oldPodSpec had no FSGroupChangePolicy set then we should prevent new pod from having this field
// if ConfigurableFSGroupPolicy feature is disabled
if podSpec.SecurityContext != nil {
podSpec.SecurityContext.FSGroupChangePolicy = nil
}
}
}
// dropDisabledCSIVolumeSourceAlphaFields removes disabled alpha fields from []CSIVolumeSource.
// This should be called from PrepareForCreate/PrepareForUpdate for all pod specs resources containing a CSIVolumeSource
func dropDisabledCSIVolumeSourceAlphaFields(podSpec, oldPodSpec *api.PodSpec) {
@@ -710,17 +698,6 @@ func ephemeralContainersInUse(podSpec *api.PodSpec) bool {
return len(podSpec.EphemeralContainers) > 0
}
func fsGroupPolicyInUse(podSpec *api.PodSpec) bool {
if podSpec == nil {
return false
}
securityContext := podSpec.SecurityContext
if securityContext != nil && securityContext.FSGroupChangePolicy != nil {
return true
}
return false
}
// overheadInUse returns true if the pod spec is non-nil and has Overhead set
func overheadInUse(podSpec *api.PodSpec) bool {
if podSpec == nil {

33
pkg/api/pod/util_test.go
View File

@@ -562,56 +562,24 @@ func TestDropFSGroupFields(t *testing.T) {
}
podInfos := []struct {
description string
featureEnabled bool
newPodHasFSGroupChangePolicy bool
pod func() *api.Pod
expectPolicyInPod bool
}{
{
description: "oldPod.FSGroupChangePolicy=nil, feature=true, newPod.FSGroupChangePolicy=true",
featureEnabled: true,
pod: nofsGroupPod,
newPodHasFSGroupChangePolicy: true,
expectPolicyInPod: true,
},
{
description: "oldPod=nil, feature=false, newPod.FSGroupChangePolicy=true",
featureEnabled: false,
pod: func() *api.Pod { return nil },
newPodHasFSGroupChangePolicy: true,
expectPolicyInPod: false,
},
{
description: "oldPod=nil, feature=true, newPod.FSGroupChangePolicy=true",
featureEnabled: true,
pod: func() *api.Pod { return nil },
newPodHasFSGroupChangePolicy: true,
expectPolicyInPod: true,
},
{
description: "oldPod.FSGroupChangePolicy=nil, feature=false, newPod.FSGroupChangePolicy=true",
featureEnabled: false,
pod: nofsGroupPod,
newPodHasFSGroupChangePolicy: true,
expectPolicyInPod: false,
},
{
description: "oldPod.FSGroupChangePolicy=true, feature=false, newPod.FSGroupChangePolicy=true",
featureEnabled: false,
pod: fsGroupPod,
newPodHasFSGroupChangePolicy: true,
expectPolicyInPod: true,
},
{
description: "oldPod.FSGroupChangePolicy=true, feature=false, newPod.FSGroupChangePolicy=false",
featureEnabled: false,
pod: fsGroupPod,
newPodHasFSGroupChangePolicy: false,
expectPolicyInPod: false,
},
{
description: "oldPod.FSGroupChangePolicy=true, feature=true, newPod.FSGroupChangePolicy=false",
featureEnabled: true,
pod: fsGroupPod,
newPodHasFSGroupChangePolicy: false,
expectPolicyInPod: false,
@@ -619,7 +587,6 @@ func TestDropFSGroupFields(t *testing.T) {
}
for _, podInfo := range podInfos {
t.Run(podInfo.description, func(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ConfigurableFSGroupPolicy, podInfo.featureEnabled)()
oldPod := podInfo.pod()
newPod := oldPod.DeepCopy()
if oldPod == nil && podInfo.newPodHasFSGroupChangePolicy {