Commit Graph

98 Commits

Author SHA1 Message Date
jennybuckley
adafb1365e Support dry run in admission plugins 2018-08-06 10:37:44 -07:00
stewart-yu
f1343af5d7 auto-generated file 2018-07-28 07:54:17 +08:00
stewart-yu
55251c716a update the import file for move util/pointer to k8s.io/utils 2018-07-27 19:47:02 +08:00
Tim Allclair
5ace0f03d8
Cleanup & fix PodSecurityPolicy field path usage 2018-07-18 17:47:32 -07:00
Jeff Grafton
23ceebac22 Run hack/update-bazel.sh 2018-06-22 16:22:57 -07:00
Jan Chaloupka
3cc15363bc Run make update 2018-06-06 00:12:40 +02:00
Jan Chaloupka
ab616a88b9 Promote sysctl annotations to API fields 2018-06-05 23:17:00 +02:00
Cao Shufeng
241422879d Log policy name from pod security policy 2018-06-04 19:24:25 +08:00
Slava Semushin
f49a0fbd5f Replace UserIDRange/GroupIDRange by IDRange in internal type to reduce difference with external type.
We had IDRange in both types prior 9440a68744 commit that splitted it
into UserIDRange/GroupIDRange. Later, in c91a12d205 commit we had to
revert this changes because they broke backward compatibility but
UserIDRange/GroupIDRange struct left in the internal type.

This commit removes these leftovers and reduces the differences
between internal and external types.
2018-05-04 18:31:42 +02:00
Kubernetes Submit Queue
60141cdfd9
Merge pull request #59317 from CaoShuFeng/assert_Equal
Automatic merge from submit-queue (batch tested with PRs 62448, 59317, 59947, 62418, 62352). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix assert.Equal argument order

Reference:
https://godoc.org/github.com/stretchr/testify/assert#Equal



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-04-17 16:31:17 -07:00
Slava Semushin
6767e233ed Update generated files.
In order to make it compilable I had to remove these files manually:

pkg/client/listers/extensions/internalversion/podsecuritypolicy.go
pkg/client/informers/informers_generated/internalversion/extensions/internalversion/podsecuritypolicy.go
pkg/client/clientset_generated/internalclientset/typed/extensions/internalversion/podsecuritypolicy.go
pkg/client/clientset_generated/internalclientset/typed/extensions/internalversion/fake/fake_podsecuritypolicy.go
2018-04-11 18:35:24 +02:00
Slava Semushin
8a7d5707d5 PSP: move internal types from extensions to policy. 2018-04-11 18:35:09 +02:00
Stephen Augustus
09aa0b9c1d pkg/util/pointer: Update int pointer functions
* Implement `Int64Ptr` function
* Replace per module functions of `int(32|64)?` --> `*int(32|64)?`
* Update bazel rules
2018-03-27 10:30:01 -04:00
Kubernetes Submit Queue
c014cc2740
Merge pull request #56848 from CaoShuFeng/duplicated-validation-psp
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove duplicated validation from podsecuritypolicy

**Release note**:
```release-note
NONE
```
2018-03-26 00:13:08 -07:00
Slava Semushin
cee37f2f72 Fix strategy name in the error messages. 2018-03-13 16:21:43 +01:00
Slava Semushin
88ae9479d9 Run hack/update-bazel.sh 2018-02-22 19:23:02 +01:00
Slava Semushin
3d4fa8a189 Modify PodSecurityPolicy admission plugin to additionally allow authorizing via "use" verb in policy API group. 2018-02-22 19:23:02 +01:00
Jeff Grafton
ef56a8d6bb Autogenerated: hack/update-bazel.sh 2018-02-16 13:43:01 -08:00
wackxu
9342eff20d rename func ValidatePodSecurityContext to ValidatePod 2018-02-14 10:55:50 +08:00
Di Xu
48388fec7e fix all the typos across the project 2018-02-11 11:04:14 +08:00
Cao Shufeng
f95bc9289d fix assert.Equal argument order
Reference:
https://godoc.org/github.com/stretchr/testify/assert#Equal
2018-02-04 15:14:55 +08:00
Cao Shufeng
4b738a7b40 [PSP] always check validated policy first for update operation
When update a pod with `kubernetes.io/psp` annotation set, we should
check this policy first. Because this saved policy is `usually` the
one we are looking for.
2018-01-03 11:08:37 +08:00
Jeff Grafton
efee0704c6 Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
Kubernetes Submit Queue
60e7727cb8
Merge pull request #57348 from tallclair/psp-owners
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add PodSecurityPolicy OWNERS

Make myself an approver of PodSecurityPolicy, and also add a couple reviewers.

```release-note
NONE
```
2017-12-18 13:29:51 -08:00
Kubernetes Submit Queue
b6b1762a80
Merge pull request #56349 from php-coder/simplify_admission_test
Automatic merge from submit-queue (batch tested with PRs 56947, 56349, 57140, 53686, 57314). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 admission_test.go(TestAdmitPreferNonmutating): simplify test

**What this PR does / why we need it**:
This PR simplifies `TestAdmitPreferNonmutating` test by inlining members that have a constant values.

**Release note**:
```release-note
NONE
```

PTAL @liggitt @tallclair 
CC @simo5
2017-12-18 12:24:38 -08:00
Tim Allclair
f65b709794
Add PodSecurityPolicy OWNERS 2017-12-18 11:47:05 -08:00
Kubernetes Submit Queue
45f983144f
Merge pull request #55504 from php-coder/cleanup_create_sc
Automatic merge from submit-queue (batch tested with PRs 55557, 55504, 56269, 55604, 56202). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create{Container,Pod}SecurityContext: modify a pod and don't return the annotations

**What this PR does / why we need it**:
Prior https://github.com/kubernetes/kubernetes/pull/52849 we couldn't modify a pod and had to return annotations from the methods. But now, as we always working with a copy of a pod, we can modify it directly and we don't need to copy&return annotations separately.

This PR simplifies the code by modifying a pod directly. Also it renames these methods and replaces returning of the `SecurityContext` by in-place modification.

In fact it reverts the changes from https://github.com/kubernetes/kubernetes/pull/30257

**Release note**:
```release-note
NONE
```

PTAL @liggitt @timstclair 
CC @simo5
2017-12-14 13:54:40 -08:00
Cao Shufeng
16999f172d remove duplicated validation from podsecuritypolicy 2017-12-05 19:13:44 +08:00
Slava Semushin
b1ae1d67b2 admission_test.go(TestAdmitPreferNonmutating): simplify test by replacing shouldPassAdmit by a constant value. 2017-11-24 17:12:53 +01:00
Slava Semushin
2b95212ad3 admission_test.go(TestAdmitPreferNonmutating): simplify test by replacing expectedPodUser by a constant value. 2017-11-24 17:12:48 +01:00
Tim Allclair
9673235583
Optimize PSP authorization 2017-11-22 11:13:07 -08:00
Dr. Stefan Schimanski
3d5849fd54 admission: don't update psp annotation on update 2017-11-13 17:10:17 +01:00
Slava Semushin
a4a3c7938a CreateContainerSecurityContext: rename; modify its arguments intead of returning a copy. 2017-11-13 16:02:03 +01:00
Slava Semushin
a31a14924d CreatePodSecurityContext: rename; modify its arguments instead of returning a copy. 2017-11-13 16:00:42 +01:00
Dr. Stefan Schimanski
b9efab0eb2 admission: split PodSecurityPolicy into mutating and validating part 2017-11-09 15:41:25 +01:00
Dr. Stefan Schimanski
bec617f3cc Update generated files 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski
012b085ac8 pkg/apis/core: mechanical import fixes in dependencies 2017-11-09 12:14:08 +01:00
Mike Danese
12125455d8 move authorizers over to new interface 2017-11-03 13:46:28 -07:00
Dr. Stefan Schimanski
aedcf681b3 admission: rename Validate{ -> Initialization}, Validat{ingAdmit -> e} 2017-11-02 09:29:55 +01:00
Dr. Stefan Schimanski
2452afffe0 admission: wire create+update validation func into kube registries 2017-11-02 09:29:16 +01:00
Kubernetes Submit Queue
2d914ee703 Merge pull request #53984 from sttts/sttts-legacyscheme
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

pkg/api: extract Scheme/Registry/Codecs into pkg/api/legacyscheme

This serves as

- a preparation for the pkg/api->pkg/apis/core move
- and makes the dependency to the scheme explicit when vizualizing
  left depenncies.

The later helps with our our efforts to split up the monolithic repo
into self-contained sub-repos, e.g. for kubectl, controller-manager
and kube-apiserver in the future.
2017-10-18 10:49:10 -07:00
Dr. Stefan Schimanski
cad0364e73 Update bazel 2017-10-18 17:24:04 +02:00
Dr. Stefan Schimanski
7773a30f67 pkg/api/legacyscheme: fixup imports 2017-10-18 17:23:55 +02:00
Slava Semushin
1a3a2d47c8 admission_test.go: remove unused createNamespaceForTest() and createSAForTest() functions. 2017-10-17 12:03:46 +02:00
Jordan Liggitt
8c5b01376a
PodSecurityPolicy: Order by name, prefer non-mutating policies, require *api.Pod, allow GC updates 2017-10-16 02:22:11 -04:00
Jordan Liggitt
abc7c077e1
PodSecurityPolicy: avoid unnecessary mutation of supplemental groups 2017-10-16 02:21:10 -04:00
Jordan Liggitt
b45b809f4c
PodSecurityPolicy: Do not mutate nil privileged field to false 2017-10-16 02:21:10 -04:00
Jeff Grafton
aee5f457db update BUILD files 2017-10-15 18:18:13 -07:00
p0lyn0mial
475493ced6 moved admission interfaces WantsClientCert, WantsAuthorizer and WantsExternalKubeClientSet to apiserver 2017-10-01 15:03:08 +02:00
Slava Semushin
9015a82692 PodSecurityPolicy.allowedCapabilities: add support for using * to allow to request any capabilities.
Also modify "privileged" PSP to use it and allow privileged users to use
any capabilities.
2017-09-06 12:18:09 +02:00