Commit Graph

95 Commits (f34a24e98e7c837b567b78be3af958ac1156cd80)

Author SHA1 Message Date
Jordan Liggitt a5f722e181
PodSecurityPolicy: avoid unnecessary securitycontext mutation 2017-10-16 02:22:10 -04:00
Jordan Liggitt fef3b03188
PodSecurityPolicy: pass effective runAsNonRoot and runAsUser to user validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt e34a00d14f
PodSecurityPolicy: pass effective selinux options to validate 2017-10-16 02:21:11 -04:00
Jordan Liggitt 5dc4da7c6a
PodSecurityPolicy: limit validation to provided groups 2017-10-16 02:21:11 -04:00
Jordan Liggitt 9e34f2b968
PodSecurityPolicy: pass effective capabilities to validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt abc7c077e1
PodSecurityPolicy: avoid unnecessary mutation of supplemental groups 2017-10-16 02:21:10 -04:00
Jordan Liggitt cfb490e3a1
PodSecurityPolicy: avoid unnecessary mutation of container capabilities 2017-10-16 02:21:10 -04:00
Jordan Liggitt 59510caaf3
PodSecurityPolicy: only set runAsNonRoot when runAsUser is nil 2017-10-16 02:21:10 -04:00
Jordan Liggitt b45b809f4c
PodSecurityPolicy: Do not mutate nil privileged field to false 2017-10-16 02:21:10 -04:00
Jeff Grafton aee5f457db update BUILD files 2017-10-15 18:18:13 -07:00
Di Xu 5e96f7cae9 enable to specific unconfined AppArmor profile 2017-09-28 10:06:36 +08:00
Kubernetes Submit Queue 1b7cd72261 Merge pull request #50378 from php-coder/improve_unit_tests
Automatic merge from submit-queue (batch tested with PRs 50378, 51463, 50006, 51962, 51673). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

provider_test.go: use existing method instead of own copy of it

**What this PR does / why we need it**:
This PR removes duplicated definition of the `defaultPod()` function and also updates a comment.

**Release note**:
```release-note
NONE
```
2017-09-23 04:02:49 -07:00
Slava Semushin 7ab69d16bd Update autogenerated files. 2017-09-06 12:18:09 +02:00
Slava Semushin 9015a82692 PodSecurityPolicy.allowedCapabilities: add support for using * to allow to request any capabilities.
Also modify "privileged" PSP to use it and allow privileged users to use
any capabilities.
2017-09-06 12:18:09 +02:00
Kubernetes Submit Queue d56b676100 Merge pull request #51408 from feiskyer/magic
Automatic merge from submit-queue (batch tested with PRs 50719, 51216, 50212, 51408, 51381)

Use constants instead of magic string for runtime names

**What this PR does / why we need it**:

Use constants instead of magic string for runtime names.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51678

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-08-31 21:09:17 -07:00
Pengfei Ni d88fe3c0ca run hack/update-bazel.sh 2017-08-26 22:55:49 +08:00
Pengfei Ni 9dd589c035 Use constants instead of magic string for runtime names 2017-08-26 22:44:27 +08:00
Josh Horwitz fab6044a31 Allow PSP's to specify a whitelist of allowed paths for host volume
removed files not supposed to be there
2017-08-25 21:35:55 -04:00
Pengfei Ni 15b9871d50 Allow remote runtimes to pass apparmor host validation 2017-08-24 09:18:46 +08:00
Slava Semushin 93a9186e8e provider_test.go: use existing method instead of own copy of it.
Also:
- rename variables according to its meaning
- improve godoc comment
2017-08-18 17:45:36 +02:00
Jeff Grafton a7f49c906d Use buildozer to delete licenses() rules except under third_party/ 2017-08-11 09:32:39 -07:00
Jeff Grafton 33276f06be Use buildozer to remove deprecated automanaged tags 2017-08-11 09:31:50 -07:00
Jeff Grafton cf55f9ed45 Autogenerate BUILD files 2017-08-11 09:30:23 -07:00
Jess Frazelle 0f349cc61f
allowPrivilegeEscalation: modify api types & add functionality
Signed-off-by: Jess Frazelle <acidburn@google.com>
2017-07-24 12:52:41 -04:00
xiangpengzhao 01daf707c5 Refactor: pkg/util into sub-pkgs 2017-07-18 14:34:08 +08:00
Kubernetes Submit Queue 35794a8f2d Merge pull request #47638 from xilabao/update-hostports-log
Automatic merge from submit-queue (batch tested with PRs 47417, 47638, 46930)

update the err of hostPorts in psp

**What this PR does / why we need it**:
change `Allowed ports: [{8000 8080}]` to `Allowed ports: [8000-8080]`

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-07-16 16:33:03 -07:00
Tim Allclair a2f2e1d491 Name change: s/timstclair/tallclair/ 2017-07-10 14:05:46 -07:00
xilabao c9b772e9a9 update the err of hostPorts in psp 2017-06-23 09:27:50 +08:00
Chao Xu 60604f8818 run hack/update-all 2017-06-22 11:31:03 -07:00
Chao Xu f4989a45a5 run root-rewrite-v1-..., compile 2017-06-22 10:25:57 -07:00
Kubernetes Submit Queue 03014f486c Merge pull request #47824 from mbohlool/revert2
Automatic merge from submit-queue (batch tested with PRs 47851, 47824, 47858, 46099)

Revert 44714 manually

#44714 broke backward compatibility for old swagger spec that kubectl still uses. The decision on #47448 was to revert this change but the change was not automatically revertible. Here I semi-manually remove all references to UnixUserID and UnixGroupID and updated generated files accordingly.

Please wait for tests to pass then review that as there may still be tests that are failing.

Fixes #47448

Adding release note just because the original PR has a release note. If possible, we should remove both release notes as they cancel each other.

**Release note**: (removed by caesarxuchao)

UnixUserID and UnixGroupID is reverted back as int64 to keep backward compatibility.
2017-06-21 15:21:14 -07:00
Josh Horwitz b6e08ec39d Revert "Merge pull request #43946 from jhorwit2/jah/host-path-psp"
This reverts commit b5eadb5d6b, reversing
changes made to 1889d654f5.
2017-06-21 12:45:22 -04:00
mbohlool 70c4fe7f4f update generated files 2017-06-21 04:09:08 -07:00
mbohlool c91a12d205 Remove all references to types.UnixUserID and types.UnixGroupID 2017-06-21 04:09:07 -07:00
Kubernetes Submit Queue 60c1c1e8ae Merge pull request #47073 from Q-Lee/psp-run-as-non-root
Automatic merge from submit-queue (batch tested with PRs 47073, 47457, 47479)

PodSecurityPolicy should respect and validate user-supplied RunAsNonR…

**What this PR does / why we need it**: PodSecurityPolicies overwrite and then fail to validate the RunAsNonRoot field in the container security context.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47071

**Special notes for your reviewer**: gce/gke don't use this in 1.6. You'll need to speak up if you think this is important enough to patch. It should almost certainly go into 1.7.

**Release note**:


```release-note
PodSecurityPolicy now recognizes pods that specify `runAsNonRoot: false` in their security context and does not overwrite the specified value
```
2017-06-14 01:52:12 -07:00
Quintin Lee 158f17b9bb PodSecurityPolicy should respect and validate user-supplied RunAsNonRoot fields. 2017-06-09 11:46:50 -07:00
Simon Croome 5e2503e71f Add StorageOS volume plugin 2017-06-09 13:19:27 +01:00
Josh Horwitz f75b3f3d05 Added host path whitelist to psp 2017-05-29 13:03:25 -04:00
Jamie Hannaford 9440a68744 Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
Kubernetes Submit Queue 3559c067c6 Merge pull request #41571 from php-coder/fix_comments
Automatic merge from submit-queue

Minor cleanups

Minor improvements:
- `ValidateNoNewFinalizers`: remove unused const
- Mention that mutation of `spec.initContainers[*].image` field is allowed
- Improve godoc comments
2017-04-21 08:34:07 -07:00
Mike Danese a05c3c0efd autogenerated 2017-04-14 10:40:57 -07:00
Chao Xu 08aa712a6c move helpers.go to helper 2017-04-11 15:49:11 -07:00
Kubernetes Submit Queue 3f941ac16c Merge pull request #41995 from roidelapluie/41990-a
Automatic merge from submit-queue

Improvements to mustrunas_test.go

refs #41990

Signed-off-by: Julien Pivotto <roidelapluie@inuits.eu>



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #41990

**Special notes for your reviewer**:

**Release note**:

```release-note
```
2017-04-10 07:28:51 -07:00
Slava Semushin 95049b6440 Minor cleanups.
- ValidateNoNewFinalizers: remove unused const
- Mention that mutation of spec.initContainers[*].image field is allowed
- Improve godoc comments
- validation_test.go(expectPrefix): remove unused function
2017-04-05 09:49:35 +02:00
Vladimir Vivien 915a54180d Addition of ScaleIO Kubernetes Volume Plugin
This commits implements the Kubernetes volume plugin allowing pods to seamlessly access and use data stored on ScaleIO volumes.
2017-03-03 15:47:19 -05:00
Aditya Dani 28df55fc31 Portworx Volume Driver in Kubernetes
- Add a new type PortworxVolumeSource
- Implement the kubernetes volume plugin for Portworx Volumes under pkg/volume/portworx
- The Portworx Volume Driver uses the libopenstorage/openstorage specifications and apis for volume operations.

Changes for k8s configuration and examples for portworx volumes.

- Add PortworxVolume hooks in kubectl, kube-controller-manager and validation.
- Add a README for PortworxVolume usage as PVs, PVCs and StorageClass.
- Add example spec files

Handle code review comments.

- Modified READMEs to incorporate to suggestions.
- Add a test for ReadWriteMany access mode.
- Use util.UnmountPath in TearDown.
- Add ReadOnly flag to PortworxVolumeSource
- Use hostname:port instead of unix sockets
- Delete the mount dir in TearDown.
- Fix link issue in persistentvolumes README
- In unit test check for mountpath after Setup is done.
- Add PVC Claim Name as a Portworx Volume Label

Generated code and documentation.
- Updated swagger spec
- Updated api-reference docs
- Updated generated code under pkg/api/v1

Godeps update for Portworx Volume Driver
- Adds github.com/libopenstorage/openstorage
- Adds go.pedge.io/pb/go/google/protobuf
- Updates Godep Licenses
2017-02-28 23:24:56 +00:00
Julien Pivotto 12a3b61279
Improvements to mustrunas_test.go
* Removed unused members from structs
* Compare error messages

Signed-off-by: Julien Pivotto <roidelapluie@inuits.eu>
2017-02-24 08:10:15 +01:00
Jeff Peeler 8fb1b71c66 Implements projected volume driver
Proposal: kubernetes/kubernetes#35313
2017-02-20 12:56:04 -05:00
Slava Semushin 1320f47f2a Minor comments improvements. 2017-02-13 12:32:58 +01:00
Dr. Stefan Schimanski 2b8e938128 Update generated files 2017-01-24 20:56:03 +01:00