github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

PodSecurityPolicy: avoid unnecessary mutation of supplemental groups

pull/6/head
Jordan Liggitt 2017-10-15 22:48:36 -04:00
parent cfb490e3a1
commit abc7c077e1
No known key found for this signature in database
GPG Key ID: 39928704103C7229
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/security/podsecuritypolicy/group/runasany.go
View File

@ -34,7 +34,7 @@ func NewRunAsAny() (GroupStrategy, error) {
// Generate creates the group based on policy rules. This strategy returns an empty slice. // Generate creates the group based on policy rules. This strategy returns an empty slice.
func (s *runAsAny) Generate(pod *api.Pod) ([]int64, error) { func (s *runAsAny) Generate(pod *api.Pod) ([]int64, error) {
return []int64{}, nil return nil, nil
} }
// Generate a single value to be applied. This is used for FSGroup. This strategy returns nil. // Generate a single value to be applied. This is used for FSGroup. This strategy returns nil.

2
pkg/security/podsecuritypolicy/provider.go
View File

@ -80,7 +80,7 @@ func (s *simpleProvider) CreatePodSecurityContext(pod *api.Pod) (*api.PodSecurit
} }
annotations := maps.CopySS(pod.Annotations) annotations := maps.CopySS(pod.Annotations)
if len(sc.SupplementalGroups) == 0 { if sc.SupplementalGroups == nil {
supGroups, err := s.strategies.SupplementalGroupStrategy.Generate(pod) supGroups, err := s.strategies.SupplementalGroupStrategy.Generate(pod)
if err != nil { if err != nil {
return nil, nil, err return nil, nil, err

2
plugin/pkg/admission/security/podsecuritypolicy/admission_test.go
View File

@ -993,7 +993,7 @@ func TestAdmitSupplementalGroups(t *testing.T) {
pod: goodPod(), pod: goodPod(),
psps: []*extensions.PodSecurityPolicy{runAsAny}, psps: []*extensions.PodSecurityPolicy{runAsAny},
shouldPass: true, shouldPass: true,
expectedSupGroups: []int64{}, expectedSupGroups: nil,
expectedPSP: runAsAny.Name, expectedPSP: runAsAny.Name,
}, },
"runAsAny pod request": { "runAsAny pod request": {