github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-30 23:15:14 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #51347 from Random-Liu/fix-no-new-privs

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 50889, 51347, 50582, 51297, 51264)

Fix NoNewPrivs and also allow remote runtime to provide the support.

Fixes https://github.com/kubernetes/kubernetes/issues/51319.

This PR:
1) Let kubelet admit remote runtime for `NoNewPrivis` container runtime.
2) Fix a `NoNewPrivis` bug which checks wrong runtime type.

/cc @kubernetes/sig-node-bugs @jessfraz
This commit is contained in:
Kubernetes Submit Queue 2017-08-25 22:43:28 -07:00 committed by GitHub
commit ea206bbe29
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/kubelet/lifecycle/handlers.go
View File

@ -187,6 +187,11 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult
return PodAdmitResult{Admit: true}
}
// Always admit for remote runtime.
if a.Runtime.Type() == kubetypes.RemoteContainerRuntime {
return PodAdmitResult{Admit: true}
}
// Make sure it is either docker or rkt runtimes.
if a.Runtime.Type() != kubetypes.DockerContainerRuntime && a.Runtime.Type() != kubetypes.RktContainerRuntime {
return PodAdmitResult{
@ -196,7 +201,7 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult
}
}
if a.Runtime.Type() != kubetypes.DockerContainerRuntime {
if a.Runtime.Type() == kubetypes.DockerContainerRuntime {
// Make sure docker api version is valid.
rversion, err := a.Runtime.APIVersion()
if err != nil {
@ -206,7 +211,7 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult
Message: fmt.Sprintf("Cannot enforce NoNewPrivs: %v", err),
}
}
v, err := rversion.Compare("1.23")
v, err := rversion.Compare("1.23.0")
if err != nil {
return PodAdmitResult{
Admit: false,