Commit Graph

53 Commits

Author SHA1 Message Date
Jordan Liggitt
92ea33efc5 Clean up TODOs 2019-10-03 09:23:10 -04:00
Jordan Liggitt
92eb072989 Propagate context to Authorize() calls 2019-09-24 11:14:54 -04:00
Jordan Liggitt
61774cd717 Plumb context to admission Admit/Validate 2019-08-20 11:11:00 -04:00
Jordan Liggitt
2899abb65c Populate API version in synthetic authorization requests 2019-07-10 21:29:25 -04:00
Miguel Bernabeu
f47da8a75d Fix golint violations in several plugins 2019-05-23 20:00:06 +02:00
Kubernetes Prow Robot
ccc90b2ba6
Merge pull request #75680 from tallclair/psp-refactor
Clean up some PodSecurityPolicy code
2019-03-26 21:59:01 -07:00
Tim Allclair
e5d2cad7b9 Refactor PSP provider 2019-03-25 11:46:36 -07:00
Mehdy Bohlool
d08bc3774d Mechanical changes due to signature change for Admit and Validate functions 2019-02-16 13:28:47 -08:00
Davanum Srinivas
954996e231
Move from glog to klog
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135
2018-11-10 07:50:31 -05:00
yue9944882
e2c61169b1 externalize psp admission controller 2018-10-24 00:22:07 +08:00
Tim Allclair
5ace0f03d8
Cleanup & fix PodSecurityPolicy field path usage 2018-07-18 17:47:32 -07:00
Cao Shufeng
241422879d Log policy name from pod security policy 2018-06-04 19:24:25 +08:00
Slava Semushin
8a7d5707d5 PSP: move internal types from extensions to policy. 2018-04-11 18:35:09 +02:00
Slava Semushin
3d4fa8a189 Modify PodSecurityPolicy admission plugin to additionally allow authorizing via "use" verb in policy API group. 2018-02-22 19:23:02 +01:00
wackxu
9342eff20d rename func ValidatePodSecurityContext to ValidatePod 2018-02-14 10:55:50 +08:00
Cao Shufeng
4b738a7b40 [PSP] always check validated policy first for update operation
When update a pod with `kubernetes.io/psp` annotation set, we should
check this policy first. Because this saved policy is `usually` the
one we are looking for.
2018-01-03 11:08:37 +08:00
Kubernetes Submit Queue
45f983144f
Merge pull request #55504 from php-coder/cleanup_create_sc
Automatic merge from submit-queue (batch tested with PRs 55557, 55504, 56269, 55604, 56202). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create{Container,Pod}SecurityContext: modify a pod and don't return the annotations

**What this PR does / why we need it**:
Prior https://github.com/kubernetes/kubernetes/pull/52849 we couldn't modify a pod and had to return annotations from the methods. But now, as we always working with a copy of a pod, we can modify it directly and we don't need to copy&return annotations separately.

This PR simplifies the code by modifying a pod directly. Also it renames these methods and replaces returning of the `SecurityContext` by in-place modification.

In fact it reverts the changes from https://github.com/kubernetes/kubernetes/pull/30257

**Release note**:
```release-note
NONE
```

PTAL @liggitt @timstclair 
CC @simo5
2017-12-14 13:54:40 -08:00
Tim Allclair
9673235583
Optimize PSP authorization 2017-11-22 11:13:07 -08:00
Dr. Stefan Schimanski
3d5849fd54 admission: don't update psp annotation on update 2017-11-13 17:10:17 +01:00
Slava Semushin
a4a3c7938a CreateContainerSecurityContext: rename; modify its arguments intead of returning a copy. 2017-11-13 16:02:03 +01:00
Slava Semushin
a31a14924d CreatePodSecurityContext: rename; modify its arguments instead of returning a copy. 2017-11-13 16:00:42 +01:00
Dr. Stefan Schimanski
b9efab0eb2 admission: split PodSecurityPolicy into mutating and validating part 2017-11-09 15:41:25 +01:00
Dr. Stefan Schimanski
012b085ac8 pkg/apis/core: mechanical import fixes in dependencies 2017-11-09 12:14:08 +01:00
Mike Danese
12125455d8 move authorizers over to new interface 2017-11-03 13:46:28 -07:00
Dr. Stefan Schimanski
aedcf681b3 admission: rename Validate{ -> Initialization}, Validat{ingAdmit -> e} 2017-11-02 09:29:55 +01:00
Jordan Liggitt
8c5b01376a
PodSecurityPolicy: Order by name, prefer non-mutating policies, require *api.Pod, allow GC updates 2017-10-16 02:22:11 -04:00
p0lyn0mial
475493ced6 moved admission interfaces WantsClientCert, WantsAuthorizer and WantsExternalKubeClientSet to apiserver 2017-10-01 15:03:08 +02:00
p0lyn0mial
d0e89577db Simply changed the names of packages of some admission plugins. 2017-06-05 22:23:42 +02:00
p0lyn0mial
c5019bf696 remove init blocks from all admission plugins 2017-05-23 22:00:32 +02:00
p0lyn0mial
3f8d6e9210 Change all the existing admission init blocks to call a Register function
this is a two stage refactor when done there will be no init block in admission plugins.
Instead all plugins expose Register function which accept admission.Plugins instance.
The registration to global plugin registry happens inside Register func.
2017-05-18 22:25:01 +02:00
FengyunPan
3856b5d76c Check errors before logging providers
The logProviders() should check errors firstly, and do not log
providers when providers is null.
2017-04-22 16:55:32 +08:00
Dr. Stefan Schimanski
63f547e1b1 pkg/admission: make plugin registry non-global 2017-04-12 11:37:25 +02:00
Jordan Liggitt
5d839d0d0b
Avoid nil user special-casing in unsecured endpoint 2017-03-31 13:28:59 -04:00
Jordan Liggitt
829e6f6cfb
Include pod namespace in PSP 'use' authorization check 2017-03-24 15:14:52 -04:00
Jordan Liggitt
dd7561801a
Authorize PSP usage for pods without service accounts 2017-03-21 19:54:39 -04:00
Kubernetes Submit Queue
2be623b14f Merge pull request #38805 from xilabao/add-err-info-to-authorize-in-psp
Automatic merge from submit-queue

add err info to authorize in psp

It's unwise to ignore the err in my view.
2017-03-10 13:32:19 -08:00
deads2k
d89862beca update names for kube plugin initializer to avoid conflicts 2017-03-06 10:18:21 -05:00
xilabao
35d926d8d3 add err info to authorize in psp 2017-02-27 10:24:01 +08:00
Andy Goldstein
022bff7fbe Switch admission to use shared informers 2017-02-23 11:16:09 -05:00
deads2k
b0b156b381 make tools/cache authoritative 2017-01-25 08:29:45 -05:00
Clayton Coleman
469df12038
refactor: move ListOptions references to metav1 2017-01-23 17:52:46 -05:00
deads2k
01b3b2b461 move admission to genericapiserver 2017-01-18 08:15:19 -05:00
deads2k
77b4d55982 mechanical 2017-01-16 09:35:12 -05:00
deads2k
6a4d5cd7cc start the apimachinery repo 2017-01-11 09:09:48 -05:00
deads2k
4d7fcae85a mechanicals 2017-01-05 11:14:27 -05:00
deads2k
ca58ec0237 mechanical changes for move 2017-01-04 10:27:05 -05:00
deads2k
2861509b6d refactored admission to avoid internal client references 2017-01-03 15:50:12 -05:00
Chao Xu
1044aa4500 plugin/admission; including resourcequota admission 2016-11-23 15:53:09 -08:00
pweil-
bbe9c8f96d add authz checks to allowed policies admission 2016-11-08 08:36:27 -05:00
Tim St. Clair
c99d7fddc1
Add alpha annotations support to the PodSecurityPolicy provider 2016-08-17 10:14:36 -07:00