rancher/rke
1
0
Fork 0
mirror of https://github.com/rancher/rke.git synced 2025-09-06 09:20:06 +00:00
Code Issues Releases Wiki Activity

add checks for PSP resources in the cluster

Browse Source
This commit is contained in:
Jiaqi Luo
2022-12-28 12:54:17 -07:00
parent fc16be2c65
commit aa5c21bd30
2 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
cluster/validation.go
View File

@@ -6,6 +6,8 @@ import (
"fmt" "fmt"
"strings" "strings"
"github.com/rancher/rke/k8s"
"github.com/blang/semver" "github.com/blang/semver"
"github.com/rancher/rke/log" "github.com/rancher/rke/log"
"github.com/rancher/rke/metadata" "github.com/rancher/rke/metadata"
@@ -674,6 +676,30 @@ func validatePodSecurityPolicy(c *Cluster) error {
return errors.New("PodSecurityPolicy has been removed and can not be enabled since k8s v1.25") return errors.New("PodSecurityPolicy has been removed and can not be enabled since k8s v1.25")
} }
} }
// check if there is any PSP resource when upgrading a cluster to k8s v1.25 and above
if parsedRangeAtLeast125(parsedVersion) {
kubeClient, err := k8s.NewClient(c.LocalKubeConfigPath, c.K8sWrapTransport)
if err != nil {
// we can not tell this is invoked when creating a new cluster or updating an existing one, so skip this check
logrus.Warnf("Skip the check for PSP resource due to the failire of initializing the kubernetes client")
return nil
}
pspList, _ := k8s.GetPSPList(kubeClient)
// ignore the error because the "no such resource type" error is definitely returned in k8s v1.25 and above
items := pspList.Items
if len(items) == 0 {
return nil
}
// a PSP "psp.flannel.unprivileged" from old Flannel templates is created when using Flannel as the network plugin
// we should ignore it if it is the only one PSP in the cluster
if len(items) == 1 && items[0].Name == "psp.flannel.unprivileged" && c.Network.Plugin == FlannelNetworkPlugin {
return nil
}
msg := fmt.Sprintf("PodSecurityPolicy(PSP) resource is detected in the cluster, "+
"please remove them before upgrading the cluster version to %s", c.Version)
return errors.New(msg)
}
return nil return nil
} }

6
k8s/psp.go
View File

@@ -30,3 +30,9 @@ func updatePodSecurityPolicy(k8sClient *kubernetes.Clientset, p interface{}) err
return nil return nil
} }
// GetPSPList returns the PodSecurityPolicyList containing all PSPs in the cluster and an error.
// The list could be empty if there is no PSP in the cluster.
func GetPSPList(k8sClient *kubernetes.Clientset) (*v1beta1.PodSecurityPolicyList, error) {
return k8sClient.PolicyV1beta1().PodSecurityPolicies().List(context.TODO(), metav1.ListOptions{})
}