a577b50012
Adds "MayRunAs" value among other group strategies. This strategy allows to define a certain range of GIDs for FSGroupStrategy and SupplementalGroupStrategy in a PSP. This new strategy works similarly to the "MustRunAs" one, except that when no GID is specified in a pod/container security context then no GID is generated for the respective containers. Resolves #56173
60 lines
1.8 KiB
Go
60 lines
1.8 KiB
Go
/*
|
|
Copyright 2018 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package group
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"k8s.io/apimachinery/pkg/util/validation/field"
|
|
api "k8s.io/kubernetes/pkg/apis/core"
|
|
"k8s.io/kubernetes/pkg/apis/policy"
|
|
)
|
|
|
|
// mayRunAs implements the GroupStrategy interface.
|
|
type mayRunAs struct {
|
|
ranges []policy.IDRange
|
|
}
|
|
|
|
var _ GroupStrategy = &mayRunAs{}
|
|
|
|
// NewMayRunAs provides a new MayRunAs strategy.
|
|
func NewMayRunAs(ranges []policy.IDRange) (GroupStrategy, error) {
|
|
if len(ranges) == 0 {
|
|
return nil, fmt.Errorf("ranges must be supplied for MayRunAs")
|
|
}
|
|
return &mayRunAs{
|
|
ranges: ranges,
|
|
}, nil
|
|
}
|
|
|
|
// Generate creates the group based on policy rules. This strategy returns an empty slice.
|
|
func (s *mayRunAs) Generate(_ *api.Pod) ([]int64, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
// Generate a single value to be applied. This is used for FSGroup. This strategy returns nil.
|
|
func (s *mayRunAs) GenerateSingle(_ *api.Pod) (*int64, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
// Validate ensures that the specified values fall within the range of the strategy.
|
|
// Groups are passed in here to allow this strategy to support multiple group fields (fsgroup and
|
|
// supplemental groups).
|
|
func (s *mayRunAs) Validate(fldPath *field.Path, _ *api.Pod, groups []int64) field.ErrorList {
|
|
return ValidateGroupsInRanges(fldPath, s.ranges, groups)
|
|
}
|