github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Adding a new `WindowsSecurityOptions` struct 

As outlined in the KEP at
https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20190418-windows-security-context.md
and improvements on it at
https://github.com/kubernetes/enhancements/pull/975

For now this struct is left empty, as discussed in the KEP (see above) and as
previously discussed with Jordan Liggitt.

It will allow adding GMSA and options as well as `RunAsUserName` options; both of which have already been pre-implemented respectively at
https://github.com/kubernetes/kubernetes/pull/75459
and https://github.com/kubernetes/kubernetes/pull/73609; and both of which
will need to be re-based to make use of the new struct.

Signed-off-by: Jean Rouge <rougej+github@gmail.com>
k3s-v1.15.3
Jean Rouge 2019-04-26 13:52:19 -07:00
parent 62219e1f66
commit d7aa31858e
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/apis/core/types.go
View File

@ -2733,6 +2733,9 @@ type PodSecurityContext struct {
// takes precedence for that container.
// +optional
SELinuxOptions *SELinuxOptions
// Windows security options.
// +optional
WindowsOptions *WindowsSecurityContextOptions
// The UID to run the entrypoint of the container process.
// Defaults to user specified in image metadata if unspecified.
// May also be set in SecurityContext. If set in both SecurityContext and
@ -4677,6 +4680,9 @@ type SecurityContext struct {
// PodSecurityContext, the value specified in SecurityContext takes precedence.
// +optional
SELinuxOptions *SELinuxOptions
// Windows security options.
// +optional
WindowsOptions *WindowsSecurityContextOptions
// The UID to run the entrypoint of the container process.
// Defaults to user specified in image metadata if unspecified.
// May also be set in PodSecurityContext. If set in both SecurityContext and
@ -4743,6 +4749,11 @@ type SELinuxOptions struct {
Level string
}
// WindowsSecurityContextOptions contain Windows-specific options and credentials.
type WindowsSecurityContextOptions struct {
// intentionally left empty for now
}
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// RangeAllocation is an opaque API object (not exposed to end users) that can be persisted to record

11
staging/src/k8s.io/api/core/v1/types.go
View File

@ -3000,6 +3000,9 @@ type PodSecurityContext struct {
// takes precedence for that container.
// +optional
SELinuxOptions *SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,1,opt,name=seLinuxOptions"`
// Windows security options.
// +optional
WindowsOptions *WindowsSecurityContextOptions `json:"windowsOptions,omitempty" protobuf:"bytes,8,opt,name=windowsOptions"`
// The UID to run the entrypoint of the container process.
// Defaults to user specified in image metadata if unspecified.
// May also be set in SecurityContext. If set in both SecurityContext and
@ -5267,6 +5270,9 @@ type SecurityContext struct {
// PodSecurityContext, the value specified in SecurityContext takes precedence.
// +optional
SELinuxOptions *SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,3,opt,name=seLinuxOptions"`
// Windows security options.
// +optional
WindowsOptions *WindowsSecurityContextOptions `json:"windowsOptions,omitempty" protobuf:"bytes,10,opt,name=windowsOptions"`
// The UID to run the entrypoint of the container process.
// Defaults to user specified in image metadata if unspecified.
// May also be set in PodSecurityContext. If set in both SecurityContext and
@ -5337,6 +5343,11 @@ type SELinuxOptions struct {
Level string `json:"level,omitempty" protobuf:"bytes,4,opt,name=level"`
}
// WindowsSecurityContextOptions contain Windows-specific options and credentials.
type WindowsSecurityContextOptions struct {
// intentionally left empty for now
}
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// RangeAllocation is not a public type.