ca16bd601a
Some CRI compatible runtimes may not support provileged operations. Specifically hypervisor based runtimes (like kata-containers, cc-runtime and runv) do not support privileged operations like: - Provide access to the host namespaces - Create fully privileged containers with access to host devices Hypervisor based runtimes create container workloads within virtual machines. When a running host privileged containers using them, they wont provide support to requested the privileged opertations. This commits add the new options to define two runtimes: Trusted runtime : Used when a privileged container is requested. Default runtime : for non-privileged workloads. A container that belongs to a privileged pod will inherent this property an will be created with the trusted runtime. - Add options to define trusted runtime - Add logic to decide if a sanbox is trusted - Export annotation containers below to a trusted sandbox Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
38 lines
1.3 KiB
Go
38 lines
1.3 KiB
Go
/*
|
|
Copyright 2018 The Containerd Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package annotations
|
|
|
|
// ContainerType values
|
|
// Following OCI annotations are used by katacontainers now.
|
|
// We'll switch to standard secure pod API after it is defined in CRI.
|
|
const (
|
|
// ContainerTypeSandbox represents a pod sandbox container
|
|
ContainerTypeSandbox = "sandbox"
|
|
|
|
// ContainerTypeContainer represents a container running within a pod
|
|
ContainerTypeContainer = "container"
|
|
|
|
// ContainerType is the container type (sandbox or container) annotation
|
|
ContainerType = "io.kubernetes.cri.container-type"
|
|
|
|
// SandboxID is the sandbox ID annotation
|
|
SandboxID = "io.kubernetes.cri.sandbox-id"
|
|
|
|
// PrivilegedSandbox is the privileged annotation
|
|
PrivilegedSandbox = "io.kubernetes.cri.privileged-sandbox"
|
|
)
|