github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add log

Browse Source 
Signed-off-by: jyz0309 <45495947@qq.com>
This commit is contained in:
jyz0309
2021-08-15 00:05:41 +08:00
parent 9462ca2312
commit 339c81f9a8
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
staging/src/k8s.io/pod-security-admission/admission/admission.go
View File

@@ -350,7 +350,7 @@ func (a *Admission) ValidatePod(ctx context.Context, attrs Attributes) *admissio
return sharedAllowedResponse() return sharedAllowedResponse()
} }
} }
return a.EvaluatePod(ctx, nsPolicy, nsPolicyErr, &pod.ObjectMeta, &pod.Spec, true) return a.EvaluatePod(ctx, nsPolicy, nsPolicyErr, &pod.ObjectMeta, &pod.Spec, attrs, true)
} }
// ValidatePodController evaluates a pod controller create or update request against the effective policy for the namespace. // ValidatePodController evaluates a pod controller create or update request against the effective policy for the namespace.
@@ -390,13 +390,13 @@ func (a *Admission) ValidatePodController(ctx context.Context, attrs Attributes)
// if a controller with an optional pod spec does not contain a pod spec, skip validation // if a controller with an optional pod spec does not contain a pod spec, skip validation
return sharedAllowedResponse() return sharedAllowedResponse()
} }
return a.EvaluatePod(ctx, nsPolicy, nsPolicyErr, podMetadata, podSpec, false) return a.EvaluatePod(ctx, nsPolicy, nsPolicyErr, podMetadata, podSpec, attrs, false)
} }
// EvaluatePod evaluates the given policy against the given pod(-like) object. // EvaluatePod evaluates the given policy against the given pod(-like) object.
// The enforce policy is only checked if enforce=true. // The enforce policy is only checked if enforce=true.
// The returned response may be shared between evaluations and must not be mutated. // The returned response may be shared between evaluations and must not be mutated.
func (a *Admission) EvaluatePod(ctx context.Context, nsPolicy api.Policy, nsPolicyErr error, podMetadata *metav1.ObjectMeta, podSpec *corev1.PodSpec, enforce bool) *admissionv1.AdmissionResponse { func (a *Admission) EvaluatePod(ctx context.Context, nsPolicy api.Policy, nsPolicyErr error, podMetadata *metav1.ObjectMeta, podSpec *corev1.PodSpec, attrs Attributes, enforce bool) *admissionv1.AdmissionResponse {
// short-circuit on exempt runtimeclass // short-circuit on exempt runtimeclass
if a.exemptRuntimeClass(podSpec.RuntimeClassName) { if a.exemptRuntimeClass(podSpec.RuntimeClassName) {
return sharedAllowedResponse() return sharedAllowedResponse()
@@ -407,8 +407,8 @@ func (a *Admission) EvaluatePod(ctx context.Context, nsPolicy api.Policy, nsPoli
klog.V(2).InfoS("failed to parse PodSecurity namespace labels", "err", nsPolicyErr) klog.V(2).InfoS("failed to parse PodSecurity namespace labels", "err", nsPolicyErr)
auditAnnotations["error"] = fmt.Sprintf("Failed to parse policy: %v", nsPolicyErr) auditAnnotations["error"] = fmt.Sprintf("Failed to parse policy: %v", nsPolicyErr)
} }
// TODO: log nsPolicy evaluation with context (op, resource, namespace, name) for the request.
klog.V(2).InfoS("nsPolicy evaluation", "op", attrs.GetOperation(), "resource", attrs.GetResource(), "namespace", attrs.GetNamespace(), "name", attrs.GetName())
response := allowedResponse() response := allowedResponse()
if enforce { if enforce {
if result := policy.AggregateCheckResults(a.Evaluator.EvaluatePod(nsPolicy.Enforce, podMetadata, podSpec)); !result.Allowed { if result := policy.AggregateCheckResults(a.Evaluator.EvaluatePod(nsPolicy.Enforce, podMetadata, podSpec)); !result.Allowed {