Commit Graph

117 Commits (6201c0b84b090b596da2c7d7cf28e0e49c1d0ee8)

Author SHA1 Message Date
Jeff Grafton ef56a8d6bb Autogenerated: hack/update-bazel.sh 2018-02-16 13:43:01 -08:00
wackxu 9342eff20d rename func ValidatePodSecurityContext to ValidatePod 2018-02-14 10:55:50 +08:00
Di Xu 48388fec7e fix all the typos across the project 2018-02-11 11:04:14 +08:00
Slava Semushin 09333b3a5d selinux/mustrunas_test.go(TestMustRunAsValidate): add more test cases to improve code coverage. 2018-01-24 18:52:11 +01:00
Slava Semushin 26fb4ed5fc selinux/mustrunas_test.go(TestMustRunAsValidate): make PSP SeLinux options configurable. 2018-01-24 18:40:07 +01:00
Slava Semushin 3f261537b1 selinux/mustrunas_test.go(TestMustRunAsValidate): rename a member to make its meaning obvious. 2018-01-24 18:35:48 +01:00
Slava Semushin 2e55ffbbbf Update autogenerated files. 2018-01-24 18:33:25 +01:00
Slava Semushin 072214597c PSP: when comparing categories in SELinux levels, ignore its order. 2018-01-24 18:33:25 +01:00
linweibin fa8afc1d39 Remove unused code in UT files in pkg/ 2018-01-15 16:02:35 +08:00
Jeff Grafton efee0704c6 Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
Kubernetes Submit Queue 722cb7a758
Merge pull request #56774 from CaoShuFeng/mustrunas
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

rename mustrunas to capabilities

The file context has nothing to do with `mustrunas`, so it's quite
odd to use `mustrunas` as the file name. I guess it's copied from other
places.


**Release note**:
```release-note
NONE
```

fixes #57227
2017-12-15 06:31:42 -08:00
Kubernetes Submit Queue 45f983144f
Merge pull request #55504 from php-coder/cleanup_create_sc
Automatic merge from submit-queue (batch tested with PRs 55557, 55504, 56269, 55604, 56202). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create{Container,Pod}SecurityContext: modify a pod and don't return the annotations

**What this PR does / why we need it**:
Prior https://github.com/kubernetes/kubernetes/pull/52849 we couldn't modify a pod and had to return annotations from the methods. But now, as we always working with a copy of a pod, we can modify it directly and we don't need to copy&return annotations separately.

This PR simplifies the code by modifying a pod directly. Also it renames these methods and replaces returning of the `SecurityContext` by in-place modification.

In fact it reverts the changes from https://github.com/kubernetes/kubernetes/pull/30257

**Release note**:
```release-note
NONE
```

PTAL @liggitt @timstclair 
CC @simo5
2017-12-14 13:54:40 -08:00
Cao Shufeng 15ed07fb44 rename mustrunas to capabilities
The file context has nothing to do with `mustrunas`, so it's quite
odd to use `mustrunas` as the file name. I guess it's copied from other
places.
2017-12-04 16:16:06 +08:00
Haoran Wang 98faf6b39c support flexvlome in psp 2017-11-23 16:06:51 +08:00
Jordan Liggitt 6ccd7f6dc4
Add owners for podsecuritypolicy package 2017-11-22 13:17:43 -05:00
Vladimir Vivien af0c2bda94 CSI - API change for CSI volume source type
This commit tracks source code update to support the CSI volume source type additionn.
2017-11-17 19:17:42 -05:00
Doug MacEachern 7950609b31 Enforce use of fixed size int types in the API
Changes 'int' to 'int32', enforced by import_known_versions_test

Follow up to PR #53402
2017-11-13 11:28:59 -08:00
Slava Semushin a4a3c7938a CreateContainerSecurityContext: rename; modify its arguments intead of returning a copy. 2017-11-13 16:02:03 +01:00
Slava Semushin a31a14924d CreatePodSecurityContext: rename; modify its arguments instead of returning a copy. 2017-11-13 16:00:42 +01:00
Dr. Stefan Schimanski bec617f3cc Update generated files 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski 012b085ac8 pkg/apis/core: mechanical import fixes in dependencies 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski d13b936a2a pkg/apis/core: fixup conversion func names in dependencies 2017-11-09 12:14:07 +01:00
Jordan Liggitt a5f722e181
PodSecurityPolicy: avoid unnecessary securitycontext mutation 2017-10-16 02:22:10 -04:00
Jordan Liggitt fef3b03188
PodSecurityPolicy: pass effective runAsNonRoot and runAsUser to user validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt e34a00d14f
PodSecurityPolicy: pass effective selinux options to validate 2017-10-16 02:21:11 -04:00
Jordan Liggitt 5dc4da7c6a
PodSecurityPolicy: limit validation to provided groups 2017-10-16 02:21:11 -04:00
Jordan Liggitt 9e34f2b968
PodSecurityPolicy: pass effective capabilities to validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt abc7c077e1
PodSecurityPolicy: avoid unnecessary mutation of supplemental groups 2017-10-16 02:21:10 -04:00
Jordan Liggitt cfb490e3a1
PodSecurityPolicy: avoid unnecessary mutation of container capabilities 2017-10-16 02:21:10 -04:00
Jordan Liggitt 59510caaf3
PodSecurityPolicy: only set runAsNonRoot when runAsUser is nil 2017-10-16 02:21:10 -04:00
Jordan Liggitt b45b809f4c
PodSecurityPolicy: Do not mutate nil privileged field to false 2017-10-16 02:21:10 -04:00
Jeff Grafton aee5f457db update BUILD files 2017-10-15 18:18:13 -07:00
Di Xu 5e96f7cae9 enable to specific unconfined AppArmor profile 2017-09-28 10:06:36 +08:00
Kubernetes Submit Queue 1b7cd72261 Merge pull request #50378 from php-coder/improve_unit_tests
Automatic merge from submit-queue (batch tested with PRs 50378, 51463, 50006, 51962, 51673). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

provider_test.go: use existing method instead of own copy of it

**What this PR does / why we need it**:
This PR removes duplicated definition of the `defaultPod()` function and also updates a comment.

**Release note**:
```release-note
NONE
```
2017-09-23 04:02:49 -07:00
Slava Semushin 7ab69d16bd Update autogenerated files. 2017-09-06 12:18:09 +02:00
Slava Semushin 9015a82692 PodSecurityPolicy.allowedCapabilities: add support for using * to allow to request any capabilities.
Also modify "privileged" PSP to use it and allow privileged users to use
any capabilities.
2017-09-06 12:18:09 +02:00
Kubernetes Submit Queue d56b676100 Merge pull request #51408 from feiskyer/magic
Automatic merge from submit-queue (batch tested with PRs 50719, 51216, 50212, 51408, 51381)

Use constants instead of magic string for runtime names

**What this PR does / why we need it**:

Use constants instead of magic string for runtime names.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51678

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-08-31 21:09:17 -07:00
Pengfei Ni d88fe3c0ca run hack/update-bazel.sh 2017-08-26 22:55:49 +08:00
Pengfei Ni 9dd589c035 Use constants instead of magic string for runtime names 2017-08-26 22:44:27 +08:00
Josh Horwitz fab6044a31 Allow PSP's to specify a whitelist of allowed paths for host volume
removed files not supposed to be there
2017-08-25 21:35:55 -04:00
Pengfei Ni 15b9871d50 Allow remote runtimes to pass apparmor host validation 2017-08-24 09:18:46 +08:00
Slava Semushin 93a9186e8e provider_test.go: use existing method instead of own copy of it.
Also:
- rename variables according to its meaning
- improve godoc comment
2017-08-18 17:45:36 +02:00
Jeff Grafton a7f49c906d Use buildozer to delete licenses() rules except under third_party/ 2017-08-11 09:32:39 -07:00
Jeff Grafton 33276f06be Use buildozer to remove deprecated automanaged tags 2017-08-11 09:31:50 -07:00
Jeff Grafton cf55f9ed45 Autogenerate BUILD files 2017-08-11 09:30:23 -07:00
Jess Frazelle 0f349cc61f
allowPrivilegeEscalation: modify api types & add functionality
Signed-off-by: Jess Frazelle <acidburn@google.com>
2017-07-24 12:52:41 -04:00
xiangpengzhao 01daf707c5 Refactor: pkg/util into sub-pkgs 2017-07-18 14:34:08 +08:00
Kubernetes Submit Queue 35794a8f2d Merge pull request #47638 from xilabao/update-hostports-log
Automatic merge from submit-queue (batch tested with PRs 47417, 47638, 46930)

update the err of hostPorts in psp

**What this PR does / why we need it**:
change `Allowed ports: [{8000 8080}]` to `Allowed ports: [8000-8080]`

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-07-16 16:33:03 -07:00
Tim Allclair a2f2e1d491 Name change: s/timstclair/tallclair/ 2017-07-10 14:05:46 -07:00
xilabao c9b772e9a9 update the err of hostPorts in psp 2017-06-23 09:27:50 +08:00