Commit Graph

44 Commits (b15056010789632ae0f905f0919e514c8ea23c02)

Author SHA1 Message Date
yue9944882 e2c61169b1 externalize psp admission controller 2018-10-24 00:22:07 +08:00
Mayank Kumar bc3e3afc46 api changes for psp runasgroup policy 2018-10-09 17:32:09 -07:00
Jess Frazelle 30dcca6233
ProcMount: add api options and feature gate
Signed-off-by: Jess Frazelle <acidburn@microsoft.com>
2018-08-30 11:40:02 -04:00
Tim Allclair 5ace0f03d8
Cleanup & fix PodSecurityPolicy field path usage 2018-07-18 17:47:32 -07:00
Josh Horwitz c7fbcf35da Add support for enforcing read only host paths in PSPs. 2018-06-04 19:10:37 -04:00
Slava Semushin 8a7d5707d5 PSP: move internal types from extensions to policy. 2018-04-11 18:35:09 +02:00
Kubernetes Submit Queue c014cc2740
Merge pull request #56848 from CaoShuFeng/duplicated-validation-psp
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove duplicated validation from podsecuritypolicy

**Release note**:
```release-note
NONE
```
2018-03-26 00:13:08 -07:00
wackxu 9342eff20d rename func ValidatePodSecurityContext to ValidatePod 2018-02-14 10:55:50 +08:00
Kubernetes Submit Queue 45f983144f
Merge pull request #55504 from php-coder/cleanup_create_sc
Automatic merge from submit-queue (batch tested with PRs 55557, 55504, 56269, 55604, 56202). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create{Container,Pod}SecurityContext: modify a pod and don't return the annotations

**What this PR does / why we need it**:
Prior https://github.com/kubernetes/kubernetes/pull/52849 we couldn't modify a pod and had to return annotations from the methods. But now, as we always working with a copy of a pod, we can modify it directly and we don't need to copy&return annotations separately.

This PR simplifies the code by modifying a pod directly. Also it renames these methods and replaces returning of the `SecurityContext` by in-place modification.

In fact it reverts the changes from https://github.com/kubernetes/kubernetes/pull/30257

**Release note**:
```release-note
NONE
```

PTAL @liggitt @timstclair 
CC @simo5
2017-12-14 13:54:40 -08:00
Cao Shufeng 16999f172d remove duplicated validation from podsecuritypolicy 2017-12-05 19:13:44 +08:00
Haoran Wang 98faf6b39c support flexvlome in psp 2017-11-23 16:06:51 +08:00
Doug MacEachern 7950609b31 Enforce use of fixed size int types in the API
Changes 'int' to 'int32', enforced by import_known_versions_test

Follow up to PR #53402
2017-11-13 11:28:59 -08:00
Slava Semushin a4a3c7938a CreateContainerSecurityContext: rename; modify its arguments intead of returning a copy. 2017-11-13 16:02:03 +01:00
Slava Semushin a31a14924d CreatePodSecurityContext: rename; modify its arguments instead of returning a copy. 2017-11-13 16:00:42 +01:00
Dr. Stefan Schimanski 012b085ac8 pkg/apis/core: mechanical import fixes in dependencies 2017-11-09 12:14:08 +01:00
Jordan Liggitt a5f722e181
PodSecurityPolicy: avoid unnecessary securitycontext mutation 2017-10-16 02:22:10 -04:00
Jordan Liggitt fef3b03188
PodSecurityPolicy: pass effective runAsNonRoot and runAsUser to user validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt e34a00d14f
PodSecurityPolicy: pass effective selinux options to validate 2017-10-16 02:21:11 -04:00
Jordan Liggitt 9e34f2b968
PodSecurityPolicy: pass effective capabilities to validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt abc7c077e1
PodSecurityPolicy: avoid unnecessary mutation of supplemental groups 2017-10-16 02:21:10 -04:00
Jordan Liggitt 59510caaf3
PodSecurityPolicy: only set runAsNonRoot when runAsUser is nil 2017-10-16 02:21:10 -04:00
Jordan Liggitt b45b809f4c
PodSecurityPolicy: Do not mutate nil privileged field to false 2017-10-16 02:21:10 -04:00
Kubernetes Submit Queue 1b7cd72261 Merge pull request #50378 from php-coder/improve_unit_tests
Automatic merge from submit-queue (batch tested with PRs 50378, 51463, 50006, 51962, 51673). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

provider_test.go: use existing method instead of own copy of it

**What this PR does / why we need it**:
This PR removes duplicated definition of the `defaultPod()` function and also updates a comment.

**Release note**:
```release-note
NONE
```
2017-09-23 04:02:49 -07:00
Josh Horwitz fab6044a31 Allow PSP's to specify a whitelist of allowed paths for host volume
removed files not supposed to be there
2017-08-25 21:35:55 -04:00
Slava Semushin 93a9186e8e provider_test.go: use existing method instead of own copy of it.
Also:
- rename variables according to its meaning
- improve godoc comment
2017-08-18 17:45:36 +02:00
Jess Frazelle 0f349cc61f
allowPrivilegeEscalation: modify api types & add functionality
Signed-off-by: Jess Frazelle <acidburn@google.com>
2017-07-24 12:52:41 -04:00
Kubernetes Submit Queue 35794a8f2d Merge pull request #47638 from xilabao/update-hostports-log
Automatic merge from submit-queue (batch tested with PRs 47417, 47638, 46930)

update the err of hostPorts in psp

**What this PR does / why we need it**:
change `Allowed ports: [{8000 8080}]` to `Allowed ports: [8000-8080]`

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-07-16 16:33:03 -07:00
Tim Allclair a2f2e1d491 Name change: s/timstclair/tallclair/ 2017-07-10 14:05:46 -07:00
xilabao c9b772e9a9 update the err of hostPorts in psp 2017-06-23 09:27:50 +08:00
Kubernetes Submit Queue 03014f486c Merge pull request #47824 from mbohlool/revert2
Automatic merge from submit-queue (batch tested with PRs 47851, 47824, 47858, 46099)

Revert 44714 manually

#44714 broke backward compatibility for old swagger spec that kubectl still uses. The decision on #47448 was to revert this change but the change was not automatically revertible. Here I semi-manually remove all references to UnixUserID and UnixGroupID and updated generated files accordingly.

Please wait for tests to pass then review that as there may still be tests that are failing.

Fixes #47448

Adding release note just because the original PR has a release note. If possible, we should remove both release notes as they cancel each other.

**Release note**: (removed by caesarxuchao)

UnixUserID and UnixGroupID is reverted back as int64 to keep backward compatibility.
2017-06-21 15:21:14 -07:00
Josh Horwitz b6e08ec39d Revert "Merge pull request #43946 from jhorwit2/jah/host-path-psp"
This reverts commit b5eadb5d6b, reversing
changes made to 1889d654f5.
2017-06-21 12:45:22 -04:00
mbohlool c91a12d205 Remove all references to types.UnixUserID and types.UnixGroupID 2017-06-21 04:09:07 -07:00
Quintin Lee 158f17b9bb PodSecurityPolicy should respect and validate user-supplied RunAsNonRoot fields. 2017-06-09 11:46:50 -07:00
Josh Horwitz f75b3f3d05 Added host path whitelist to psp 2017-05-29 13:03:25 -04:00
Jamie Hannaford 9440a68744 Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
deads2k 6a4d5cd7cc start the apimachinery repo 2017-01-11 09:09:48 -05:00
pweil- 49e14744db support seccomp in psp 2016-10-17 14:49:02 -04:00
Tim St. Clair 15d336272e
Fix PSP volumes error message 2016-09-01 15:55:34 -07:00
Dr. Stefan Schimanski ed36baed20 Add sysctl PodSecurityPolicy support 2016-08-25 13:22:01 +02:00
Tim St. Clair 293770ef31
AppArmor PodSecurityPolicy implementation 2016-08-21 23:10:45 -07:00
Tim St. Clair c99d7fddc1
Add alpha annotations support to the PodSecurityPolicy provider 2016-08-17 10:14:36 -07:00
Clayton Coleman affd79fdc0
InitContainers are not checked for hostPort ranges
PodSecurityPolicy must verify that host port ranges are guarded on init
containers.
2016-07-20 23:19:34 -04:00
David McMahon ef0c9f0c5b Remove "All rights reserved" from all the headers. 2016-06-29 17:47:36 -07:00
Paul Weil 56193b7140 PSP types 2016-05-11 18:07:35 -04:00