github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
k3s/pkg/volume
History
Kubernetes Submit Queue 098e1df3b6 Merge pull request #47290 from jhorwit2/jah/hostpath-psp-backstep-check 
Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

validate host paths on the kubelet for backsteps

**What this PR does / why we need it**:

This PR adds validation on the kubelet to ensure the host path does not contain backsteps that could allow the volume to escape the PSP's allowed host paths. Currently, there is validation done at in API server; however, that does not account for mismatch of OS's on the kubelet vs api server. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47107

**Special notes for your reviewer**:

cc @liggitt

**Release note**:


```release-note
Paths containing backsteps (for example, "../bar") are no longer allowed in hostPath volume paths, or in volumeMount subpaths
```
 		2017-06-16 19:57:01 -07:00
..
aws_ebs Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
azure_dd Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
azure_file Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
cephfs Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
cinder Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
configmap Migrate kubelet configmap management logic to an interface 2017-05-31 10:39:36 +02:00
downwardapi Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
empty_dir Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
fc Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
flexvolume Merge pull request #46382 from verult/FlexVolumeMinorPatches 2017-06-16 18:05:51 -07:00
flocker Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
gce_pd Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
git_repo Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
glusterfs Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
host_path do not allow backsteps in host volume plugin 2017-06-16 16:48:24 -04:00
iscsi iSCSI plugin: Update devicepath with filepath.Glob result 2017-06-09 22:54:25 -04:00
local Address review comments 2017-05-26 11:48:31 -07:00
nfs nfs.go: cleancode err 2017-05-06 19:06:27 +08:00
photon_pd Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
portworx Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
projected Block on projected volume data fetch failure 2017-06-06 00:34:24 -04:00
quobyte Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
rbd Merge pull request #46016 from kokhang/rbd-modprobe 2017-06-13 16:53:41 -07:00
scaleio Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
secret Migrate kubelet configmap management logic to an interface 2017-05-31 10:39:36 +02:00
storageos Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
testing Migrate kubelet configmap management logic to an interface 2017-05-31 10:39:36 +02:00
util Waiting attach operation to be finished rather than returning nil 2017-06-06 22:58:44 +08:00
validation do not allow backsteps in host volume plugin 2017-06-16 16:48:24 -04:00
vsphere_volume Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
BUILD Add StorageOS volume plugin 2017-06-09 13:19:27 +01:00
OWNERS Merge pull request #45295 from rootfs/vol-owner 2017-05-09 04:13:00 -07:00
doc.go
…
metrics_cached.go
…
metrics_du.go add volume timestamps 2017-03-02 15:01:59 -08:00
metrics_du_test.go Update metrics_du_test.go 2017-05-31 17:21:46 +05:30
metrics_errors.go
…
metrics_nil.go
…
metrics_nil_test.go
…
metrics_statfs.go add volume timestamps 2017-03-02 15:01:59 -08:00
metrics_statfs_test.go add volume timestamps 2017-03-02 15:01:59 -08:00
plugins.go Migrate kubelet configmap management logic to an interface 2017-05-31 10:39:36 +02:00
plugins_test.go Impement bulk polling of volumes 2017-03-02 14:59:59 -05:00
util.go Don't provision for PVCs with AccessModes unsupported by plugin 2017-06-12 12:56:41 -04:00
util_test.go Added func ValidateZone 2017-05-24 10:48:10 +02:00
volume.go Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
volume_linux.go Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
volume_unsupported.go Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00