Kubernetes Submit Queue 4ddfc4849a Merge pull request #27180 from sttts/sysctl-implementation ... Automatic merge from submit-queue Add sysctl support Implementation of proposal https://github.com/kubernetes/kubernetes/pull/26057, feature https://github.com/kubernetes/features/issues/34 TODO: - [x] change types.go - [x] implement docker and rkt support - [x] add e2e tests - [x] decide whether we want apiserver validation - ~~[ ] add documentation~~: api docs exist. Existing PodSecurityContext docs is very light and links back to the api docs anyway: 6684555ed9/docs/user-guide/security-context.md - [x] change PodSecurityPolicy in types.go - [x] write admission controller support for PodSecurityPolicy - [x] write e2e test for PodSecurityPolicy - [x] make sure we are compatible in the sense of https://github.com/kubernetes/kubernetes/blob/master/docs/devel/api_changes.md - [x] test e2e with rkt: it only works with kubenet, not with no-op network plugin. The later has no sysctl support. - ~~[ ] add RunC implementation~~ (~~if that is already in kube,~~ it isn't) - [x] update whitelist - [x] switch PSC fields to annotations - [x] switch PSP fields to annotations - [x] decide about `--experimental-whitelist-sysctl` flag to be additive or absolute - [x] decide whether to add a sysctl node whitelist annotation ### Release notes: ```release-note The pod annotation `security.alpha.kubernetes.io/sysctls` now allows customization of namespaced and well isolated kernel parameters (sysctls), starting with `kernel.shm_rmid_forced`, `net.ipv4.ip_local_port_range`, `net.ipv4.tcp_max_syn_backlog` and `net.ipv4.tcp_syncookies` for Kubernetes 1.4. The pod annotation `security.alpha.kubernetes.io/unsafeSysctls` allows customization of namespaced sysctls where isolation is unclear. Unsafe sysctls must be enabled at-your-own-risk on the kubelet with the `--experimental-allowed-unsafe-sysctls` flag. Future versions will improve on resource isolation and more sysctls will be considered safe. ```		2016-08-25 06:21:24 -07:00
..
component/scheduler/perf	Fix broken warning image link in docs	2016-07-15 10:44:58 +01:00
e2e	Merge pull request #27180 from sttts/sysctl-implementation	2016-08-25 06:21:24 -07:00
e2e_node	Merge pull request #31185 from coufon/log_throughput_benchmark	2016-08-25 04:05:20 -07:00
fixtures/pkg/kubectl/cmd	add subjectaccessreviews resource	2016-08-05 11:20:56 -04:00
images	GCE Cloud provider changes for ESIPP	2016-08-23 16:16:39 -07:00
integration	Allow per-resource default garbage collection behavior	2016-08-22 11:37:04 -07:00
kubemark	Fix heapster in kubemark	2016-08-22 15:38:02 +02:00
soak	Remove "All rights reserved" from all the headers.	2016-06-29 17:47:36 -07:00
utils	Remove "All rights reserved" from all the headers.	2016-06-29 17:47:36 -07:00
.gitattributes	Add test/test_owners.csv, for automatic assignment of test failures.	2016-07-01 17:39:14 -07:00
OWNERS	Move blunderbuss assignees into tree	2016-03-02 20:46:32 -05:00
test_owners.csv	Update test assignments	2016-08-19 18:43:40 -07:00