Commit Graph

127 Commits (284e8182a402cfd545fc000fedaea071fed873b0)

Author SHA1 Message Date
Slava Semushin 6767e233ed Update generated files.
In order to make it compilable I had to remove these files manually:

pkg/client/listers/extensions/internalversion/podsecuritypolicy.go
pkg/client/informers/informers_generated/internalversion/extensions/internalversion/podsecuritypolicy.go
pkg/client/clientset_generated/internalclientset/typed/extensions/internalversion/podsecuritypolicy.go
pkg/client/clientset_generated/internalclientset/typed/extensions/internalversion/fake/fake_podsecuritypolicy.go
2018-04-11 18:35:24 +02:00
Slava Semushin 8a7d5707d5 PSP: move internal types from extensions to policy. 2018-04-11 18:35:09 +02:00
Christoph Blecker 857aac9ae4
Update gofmt for go1.10 2018-04-02 17:44:04 -07:00
Kubernetes Submit Queue 09170ab684
Merge pull request #61624 from jianglingxia/selinux2018032412
Automatic merge from submit-queue (batch tested with PRs 61644, 61624, 61743, 61019, 61287). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add a sceneo UT test to TestMustRunAsOptions

**What this PR does / why we need it**:
Add a sceneo UT test to TestMustRunAsOptions when the opts is nil
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-03-27 06:41:13 -07:00
Kubernetes Submit Queue c014cc2740
Merge pull request #56848 from CaoShuFeng/duplicated-validation-psp
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove duplicated validation from podsecuritypolicy

**Release note**:
```release-note
NONE
```
2018-03-26 00:13:08 -07:00
jianglingxia 25052c591a Add a sceneo UT test to TestMustRunAsOptions 2018-03-24 12:54:42 +08:00
Kubernetes Submit Queue 622ad35677
Merge pull request #61115 from php-coder/psp_fix_provider_error_msgs
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

PSP: fix strategy name in the error messages

**What this PR does / why we need it**:
This PR corrects strategy names in the error messages.
2018-03-21 04:37:58 -07:00
Slava Semushin cee37f2f72 Fix strategy name in the error messages. 2018-03-13 16:21:43 +01:00
Lennart Espe ba1ef7a6c4
Improve PodSecurityPolicy group validate error message on out-of-range group IDs 2018-03-09 18:30:13 +01:00
Jeff Grafton ef56a8d6bb Autogenerated: hack/update-bazel.sh 2018-02-16 13:43:01 -08:00
wackxu 9342eff20d rename func ValidatePodSecurityContext to ValidatePod 2018-02-14 10:55:50 +08:00
Di Xu 48388fec7e fix all the typos across the project 2018-02-11 11:04:14 +08:00
Slava Semushin 09333b3a5d selinux/mustrunas_test.go(TestMustRunAsValidate): add more test cases to improve code coverage. 2018-01-24 18:52:11 +01:00
Slava Semushin 26fb4ed5fc selinux/mustrunas_test.go(TestMustRunAsValidate): make PSP SeLinux options configurable. 2018-01-24 18:40:07 +01:00
Slava Semushin 3f261537b1 selinux/mustrunas_test.go(TestMustRunAsValidate): rename a member to make its meaning obvious. 2018-01-24 18:35:48 +01:00
Slava Semushin 2e55ffbbbf Update autogenerated files. 2018-01-24 18:33:25 +01:00
Slava Semushin 072214597c PSP: when comparing categories in SELinux levels, ignore its order. 2018-01-24 18:33:25 +01:00
linweibin fa8afc1d39 Remove unused code in UT files in pkg/ 2018-01-15 16:02:35 +08:00
Jeff Grafton efee0704c6 Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
Kubernetes Submit Queue 722cb7a758
Merge pull request #56774 from CaoShuFeng/mustrunas
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

rename mustrunas to capabilities

The file context has nothing to do with `mustrunas`, so it's quite
odd to use `mustrunas` as the file name. I guess it's copied from other
places.


**Release note**:
```release-note
NONE
```

fixes #57227
2017-12-15 06:31:42 -08:00
Kubernetes Submit Queue 45f983144f
Merge pull request #55504 from php-coder/cleanup_create_sc
Automatic merge from submit-queue (batch tested with PRs 55557, 55504, 56269, 55604, 56202). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create{Container,Pod}SecurityContext: modify a pod and don't return the annotations

**What this PR does / why we need it**:
Prior https://github.com/kubernetes/kubernetes/pull/52849 we couldn't modify a pod and had to return annotations from the methods. But now, as we always working with a copy of a pod, we can modify it directly and we don't need to copy&return annotations separately.

This PR simplifies the code by modifying a pod directly. Also it renames these methods and replaces returning of the `SecurityContext` by in-place modification.

In fact it reverts the changes from https://github.com/kubernetes/kubernetes/pull/30257

**Release note**:
```release-note
NONE
```

PTAL @liggitt @timstclair 
CC @simo5
2017-12-14 13:54:40 -08:00
Cao Shufeng 16999f172d remove duplicated validation from podsecuritypolicy 2017-12-05 19:13:44 +08:00
Cao Shufeng 15ed07fb44 rename mustrunas to capabilities
The file context has nothing to do with `mustrunas`, so it's quite
odd to use `mustrunas` as the file name. I guess it's copied from other
places.
2017-12-04 16:16:06 +08:00
Haoran Wang 98faf6b39c support flexvlome in psp 2017-11-23 16:06:51 +08:00
Jordan Liggitt 6ccd7f6dc4
Add owners for podsecuritypolicy package 2017-11-22 13:17:43 -05:00
Vladimir Vivien af0c2bda94 CSI - API change for CSI volume source type
This commit tracks source code update to support the CSI volume source type additionn.
2017-11-17 19:17:42 -05:00
Doug MacEachern 7950609b31 Enforce use of fixed size int types in the API
Changes 'int' to 'int32', enforced by import_known_versions_test

Follow up to PR #53402
2017-11-13 11:28:59 -08:00
Slava Semushin a4a3c7938a CreateContainerSecurityContext: rename; modify its arguments intead of returning a copy. 2017-11-13 16:02:03 +01:00
Slava Semushin a31a14924d CreatePodSecurityContext: rename; modify its arguments instead of returning a copy. 2017-11-13 16:00:42 +01:00
Dr. Stefan Schimanski bec617f3cc Update generated files 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski 012b085ac8 pkg/apis/core: mechanical import fixes in dependencies 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski d13b936a2a pkg/apis/core: fixup conversion func names in dependencies 2017-11-09 12:14:07 +01:00
Jordan Liggitt a5f722e181
PodSecurityPolicy: avoid unnecessary securitycontext mutation 2017-10-16 02:22:10 -04:00
Jordan Liggitt fef3b03188
PodSecurityPolicy: pass effective runAsNonRoot and runAsUser to user validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt e34a00d14f
PodSecurityPolicy: pass effective selinux options to validate 2017-10-16 02:21:11 -04:00
Jordan Liggitt 5dc4da7c6a
PodSecurityPolicy: limit validation to provided groups 2017-10-16 02:21:11 -04:00
Jordan Liggitt 9e34f2b968
PodSecurityPolicy: pass effective capabilities to validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt abc7c077e1
PodSecurityPolicy: avoid unnecessary mutation of supplemental groups 2017-10-16 02:21:10 -04:00
Jordan Liggitt cfb490e3a1
PodSecurityPolicy: avoid unnecessary mutation of container capabilities 2017-10-16 02:21:10 -04:00
Jordan Liggitt 59510caaf3
PodSecurityPolicy: only set runAsNonRoot when runAsUser is nil 2017-10-16 02:21:10 -04:00
Jordan Liggitt b45b809f4c
PodSecurityPolicy: Do not mutate nil privileged field to false 2017-10-16 02:21:10 -04:00
Jeff Grafton aee5f457db update BUILD files 2017-10-15 18:18:13 -07:00
Di Xu 5e96f7cae9 enable to specific unconfined AppArmor profile 2017-09-28 10:06:36 +08:00
Kubernetes Submit Queue 1b7cd72261 Merge pull request #50378 from php-coder/improve_unit_tests
Automatic merge from submit-queue (batch tested with PRs 50378, 51463, 50006, 51962, 51673). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

provider_test.go: use existing method instead of own copy of it

**What this PR does / why we need it**:
This PR removes duplicated definition of the `defaultPod()` function and also updates a comment.

**Release note**:
```release-note
NONE
```
2017-09-23 04:02:49 -07:00
Slava Semushin 7ab69d16bd Update autogenerated files. 2017-09-06 12:18:09 +02:00
Slava Semushin 9015a82692 PodSecurityPolicy.allowedCapabilities: add support for using * to allow to request any capabilities.
Also modify "privileged" PSP to use it and allow privileged users to use
any capabilities.
2017-09-06 12:18:09 +02:00
Kubernetes Submit Queue d56b676100 Merge pull request #51408 from feiskyer/magic
Automatic merge from submit-queue (batch tested with PRs 50719, 51216, 50212, 51408, 51381)

Use constants instead of magic string for runtime names

**What this PR does / why we need it**:

Use constants instead of magic string for runtime names.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51678

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-08-31 21:09:17 -07:00
Pengfei Ni d88fe3c0ca run hack/update-bazel.sh 2017-08-26 22:55:49 +08:00
Pengfei Ni 9dd589c035 Use constants instead of magic string for runtime names 2017-08-26 22:44:27 +08:00
Josh Horwitz fab6044a31 Allow PSP's to specify a whitelist of allowed paths for host volume
removed files not supposed to be there
2017-08-25 21:35:55 -04:00