upstream/kubernetes
1
0
Fork 0
mirror of https://github.com/kubernetes/kubernetes.git synced 2026-06-11 01:41:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Cosmetical fixes for sysctl psp

Browse source
This commit is contained in:
Dr. Stefan Schimanski 2016-09-30 09:08:22 +02:00
parent 5e231d1312
commit a62a64550c
4 changed files with 8 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
pkg/security/podsecuritypolicy/factory.go
View file

@ -79,10 +79,7 @@ func (f *simpleStrategyFactory) CreateStrategies(psp *extensions.PodSecurityPoli
errs = append(errs, err)
}
}
sysctlsStrat, err := createSysctlsStrategy(unsafeSysctls)
if err != nil {
errs = append(errs, err)
}
sysctlsStrat := createSysctlsStrategy(unsafeSysctls)
if len(errs) > 0 {
return nil, errors.NewAggregate(errs)
@ -162,6 +159,6 @@ func createCapabilitiesStrategy(defaultAddCaps, requiredDropCaps, allowedCaps []
}
// createSysctlsStrategy creates a new unsafe sysctls strategy.
func createSysctlsStrategy(sysctlsPatterns []string) (sysctl.SysctlsStrategy, error) {
func createSysctlsStrategy(sysctlsPatterns []string) sysctl.SysctlsStrategy {
return sysctl.NewMustMatchPatterns(sysctlsPatterns)
}

6
pkg/security/podsecuritypolicy/sysctl/mustmatchpatterns.go
View file

@ -35,15 +35,15 @@ var (
defaultSysctlsPatterns = []string{"*"}
)
// NewMustMatchPatterns creates a new mustMatchPattern strategy that will provide validation.
// NewMustMatchPatterns creates a new mustMatchPatterns strategy that will provide validation.
// Passing nil means the default pattern, passing an empty list means to disallow all sysctls.
func NewMustMatchPatterns(patterns []string) (SysctlsStrategy, error) {
func NewMustMatchPatterns(patterns []string) SysctlsStrategy {
if patterns == nil {
patterns = defaultSysctlsPatterns
}
return &mustMatchPatterns{
patterns: patterns,
}, nil
}
}
// Validate ensures that the specified values fall within the range of the strategy.

6
pkg/security/podsecuritypolicy/sysctl/mustmatchpatterns_test.go
View file

@ -58,11 +58,7 @@ func TestValidate(t *testing.T) {
}
for k, v := range tests {
strategy, err := NewMustMatchPatterns(v.patterns)
if err != nil {
t.Errorf("%s failed: %v", k, err)
continue
}
strategy := NewMustMatchPatterns(v.patterns)
pod := &api.Pod{}
errs := strategy.Validate(pod)

4
plugin/pkg/admission/security/podsecuritypolicy/admission_test.go
View file

@ -1117,12 +1117,12 @@ func TestAdmitSysctls(t *testing.T) {
shouldPass: true,
expectedPSP: mixedSysctls.Name,
},
"pod with not-matching unsafe sysctls request allowed under mixedSysctls PSP": {
"pod with not-matching unsafe sysctls request disallowed under mixedSysctls PSP": {
pod: podWithSysctls([]string{"a.b", "b.c", "c", "d.e.f"}, []string{"e"}),
psps: []*extensions.PodSecurityPolicy{mixedSysctls},
shouldPass: false,
},
"pod with not-matching safe sysctls request allowed under mixedSysctls PSP": {
"pod with not-matching safe sysctls request disallowed under mixedSysctls PSP": {
pod: podWithSysctls([]string{"a.b", "b.c", "c", "d.e.f", "e"}, []string{}),
psps: []*extensions.PodSecurityPolicy{mixedSysctls},
shouldPass: false,