upstream/kubectl
1
0
Fork 0
mirror of https://github.com/kubernetes/kubectl.git synced 2026-06-09 00:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix: Restricted profile comply with PSS (#117543)

Browse source 
* restricted profile comply with PSA v1.27

* add test case

* Reflect review comments

* Reflect review comments 2

* Reflect review comments 3

Kubernetes-commit: 0813904404034fd760d8e7e1e3ca5444610a7fa8
This commit is contained in:
Keita Mochizuki 2023-05-24 20:16:49 +09:00 committed by Kubernetes Publisher
parent a9dd2e4bec
commit f118a887e5
3 changed files with 45 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
pkg/cmd/debug/debug_test.go
View file

@ -289,6 +289,8 @@ func TestGenerateDebugContainer(t *testing.T) {
Capabilities: &corev1.Capabilities{
Drop: []corev1.Capability{"ALL"},
},
AllowPrivilegeEscalation: pointer.Bool(false),
SeccompProfile: &corev1.SeccompProfile{Type: "RuntimeDefault"},
},
},
},
@ -1274,10 +1276,12 @@ func TestGeneratePodCopyWithDebugContainer(t *testing.T) {
Image: "busybox",
ImagePullPolicy: corev1.PullIfNotPresent,
SecurityContext: &corev1.SecurityContext{
RunAsNonRoot: pointer.Bool(true),
Capabilities: &corev1.Capabilities{
Drop: []corev1.Capability{"ALL"},
},
RunAsNonRoot: pointer.Bool(true),
AllowPrivilegeEscalation: pointer.Bool(false),
SeccompProfile: &corev1.SeccompProfile{Type: "RuntimeDefault"},
},
},
},
@ -1646,6 +1650,8 @@ func TestGenerateNodeDebugPod(t *testing.T) {
Capabilities: &corev1.Capabilities{
Drop: []corev1.Capability{"ALL"},
},
AllowPrivilegeEscalation: pointer.Bool(false),
SeccompProfile: &corev1.SeccompProfile{Type: "RuntimeDefault"},
},
},
},

30
pkg/cmd/debug/profiles.go
View file

@ -176,6 +176,8 @@ func (p *restrictedProfile) Apply(pod *corev1.Pod, containerName string, target
clearSecurityContext(pod, containerName)
disallowRoot(pod, containerName)
dropCapabilities(pod, containerName)
disallowPrivilegeEscalation(pod, containerName)
setSeccompProfile(pod, containerName)
switch style {
case podCopy:
@ -343,3 +345,31 @@ func addCapability(c *corev1.Container, capability corev1.Capability) {
}
c.SecurityContext.Capabilities.Add = append(c.SecurityContext.Capabilities.Add, capability)
}
// disallowPrivilegeEscalation configures the containers not allowed PrivilegeEscalation
func disallowPrivilegeEscalation(p *corev1.Pod, containerName string) {
podutils.VisitContainers(&p.Spec, podutils.AllContainers, func(c *corev1.Container, _ podutils.ContainerType) bool {
if c.Name != containerName {
return true
}
if c.SecurityContext == nil {
c.SecurityContext = &corev1.SecurityContext{}
}
c.SecurityContext.AllowPrivilegeEscalation = pointer.Bool(false)
return false
})
}
// setSeccompProfile apply SeccompProfile to the containers
func setSeccompProfile(p *corev1.Pod, containerName string) {
podutils.VisitContainers(&p.Spec, podutils.AllContainers, func(c *corev1.Container, _ podutils.ContainerType) bool {
if c.Name != containerName {
return true
}
if c.SecurityContext == nil {
c.SecurityContext = &corev1.SecurityContext{}
}
c.SecurityContext.SeccompProfile = &corev1.SeccompProfile{Type: "RuntimeDefault"}
return false
})
}

8
pkg/cmd/debug/profiles_test.go
View file

@ -347,6 +347,8 @@ func TestRestrictedProfile(t *testing.T) {
Capabilities: &corev1.Capabilities{
Drop: []corev1.Capability{"ALL"},
},
AllowPrivilegeEscalation: pointer.Bool(false),
SeccompProfile: &corev1.SeccompProfile{Type: "RuntimeDefault"},
},
},
},
@ -386,6 +388,8 @@ func TestRestrictedProfile(t *testing.T) {
Capabilities: &corev1.Capabilities{
Drop: []corev1.Capability{"ALL"},
},
AllowPrivilegeEscalation: pointer.Bool(false),
SeccompProfile: &corev1.SeccompProfile{Type: "RuntimeDefault"},
},
},
},
@ -404,6 +408,8 @@ func TestRestrictedProfile(t *testing.T) {
Capabilities: &corev1.Capabilities{
Add: []corev1.Capability{"ALL"},
},
AllowPrivilegeEscalation: pointer.Bool(false),
SeccompProfile: &corev1.SeccompProfile{Type: "RuntimeDefault"},
},
},
},
@ -423,6 +429,8 @@ func TestRestrictedProfile(t *testing.T) {
Capabilities: &corev1.Capabilities{
Drop: []corev1.Capability{"ALL"},
},
AllowPrivilegeEscalation: pointer.Bool(false),
SeccompProfile: &corev1.SeccompProfile{Type: "RuntimeDefault"},
},
},
},