github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-01-04 23:17:50 +00:00
Code Issues Projects Releases Wiki Activity

Define new type for storing volume fsgroupchangepolicy

Browse Source 
Address review comments for api change
This commit is contained in:
Hemant Kumar
2020-02-21 16:35:52 -05:00
parent b5b675491b
commit f7509d277e
7 changed files with 278 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
pkg/api/pod/util.go
View File

@@ -387,6 +387,8 @@ func dropDisabledFields(
dropDisabledRunAsGroupField(podSpec, oldPodSpec)
dropDisabledFSGroupFields(podSpec, oldPodSpec)
if !utilfeature.DefaultFeatureGate.Enabled(features.RuntimeClass) && !runtimeClassInUse(oldPodSpec) {
// Set RuntimeClassName to nil only if feature is disabled and it is not used
podSpec.RuntimeClassName = nil
@@ -447,6 +449,16 @@ func dropDisabledProcMountField(podSpec, oldPodSpec *api.PodSpec) {
}
}
func dropDisabledFSGroupFields(podSpec, oldPodSpec *api.PodSpec) {
if !utilfeature.DefaultFeatureGate.Enabled(features.ConfigurableFSGroupPolicy) && !fsGroupPolicyInUse(oldPodSpec) {
// if oldPodSpec had no FSGroupChangePolicy set then we should prevent new pod from having this field
// if ConfigurableFSGroupPolicy feature is disabled
if podSpec.SecurityContext != nil {
podSpec.SecurityContext.FSGroupChangePolicy = nil
}
}
}
// dropDisabledCSIVolumeSourceAlphaFields removes disabled alpha fields from []CSIVolumeSource.
// This should be called from PrepareForCreate/PrepareForUpdate for all pod specs resources containing a CSIVolumeSource
func dropDisabledCSIVolumeSourceAlphaFields(podSpec, oldPodSpec *api.PodSpec) {
@@ -464,6 +476,17 @@ func ephemeralContainersInUse(podSpec *api.PodSpec) bool {
return len(podSpec.EphemeralContainers) > 0
}
func fsGroupPolicyInUse(podSpec *api.PodSpec) bool {
if podSpec == nil {
return false
}
securityContext := podSpec.SecurityContext
if securityContext != nil && securityContext.FSGroupChangePolicy != nil {
return true
}
return false
}
// subpathInUse returns true if the pod spec is non-nil and has a volume mount that makes use of the subPath feature
func subpathInUse(podSpec *api.PodSpec) bool {
if podSpec == nil {