Skip to content

Commit 459fa3e

Browse files
ajanikowajanikow
authored
[Feature] Extend Pod Security context (#1151)
1 parent 94e3dfc commit 459fa3e

File tree

7 files changed

+263
-192
lines changed

7 files changed

+263
-192
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
- (Improvement) Unify K8S Error Handling
1313
- (Feature) Remove stuck Pods
1414
- (Bugfix) Fix Go routine leak
15+
- (Feature) Extend Pod Security context
1516

1617
## [1.2.19](https://github.com/arangodb/kube-arangodb/tree/1.2.19) (2022-10-05)
1718
- (Bugfix) Prevent changes when UID is wrong

‎pkg/apis/deployment/v1/server_group_security_context_spec.go‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
//
2+
// DISCLAIMER
3+
//
4+
// Copyright 2016-2022 ArangoDB GmbH, Cologne, Germany
5+
//
6+
// Licensed under the Apache License, Version 2.0 (the "License");
7+
// you may not use this file except in compliance with the License.
8+
// You may obtain a copy of the License at
9+
//
10+
// http://www.apache.org/licenses/LICENSE-2.0
11+
//
12+
// Unless required by applicable law or agreed to in writing, software
13+
// distributed under the License is distributed on an "AS IS" BASIS,
14+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
// See the License for the specific language governing permissions and
16+
// limitations under the License.
17+
//
18+
// Copyright holder is ArangoDB GmbH, Cologne, Germany
19+
//
20+
21+
package v1
22+
23+
import core "k8s.io/api/core/v1"
24+
25+
// ServerGroupSpecSecurityContext contains specification for pod security context
26+
type ServerGroupSpecSecurityContext struct {
27+
// DropAllCapabilities specifies if capabilities should be dropped for this pod containers
28+
//
29+
// Deprecated: This field is added for backward compatibility. Will be removed in 1.1.0.
30+
DropAllCapabilities *bool `json:"dropAllCapabilities,omitempty"`
31+
// AddCapabilities add new capabilities to containers
32+
AddCapabilities []core.Capability `json:"addCapabilities,omitempty"`
33+
34+
AllowPrivilegeEscalation *bool `json:"allowPrivilegeEscalation,omitempty"`
35+
Privileged *bool `json:"privileged,omitempty"`
36+
ReadOnlyRootFilesystem *bool `json:"readOnlyRootFilesystem,omitempty"`
37+
RunAsNonRoot *bool `json:"runAsNonRoot,omitempty"`
38+
RunAsUser *int64 `json:"runAsUser,omitempty"`
39+
RunAsGroup *int64 `json:"runAsGroup,omitempty"`
40+
41+
SupplementalGroups []int64 `json:"supplementalGroups,omitempty"`
42+
FSGroup *int64 `json:"fsGroup,omitempty"`
43+
44+
SeccompProfile *core.SeccompProfile `json:"seccompProfile,omitempty" protobuf:"bytes,11,opt,name=seccompProfile"`
45+
SELinuxOptions *core.SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,3,opt,name=seLinuxOptions"`
46+
}
47+
48+
// GetDropAllCapabilities returns flag if capabilities should be dropped
49+
//
50+
// Deprecated: This function is added for backward compatibility. Will be removed in 1.1.0.
51+
func (s *ServerGroupSpecSecurityContext) GetDropAllCapabilities() bool {
52+
if s == nil {
53+
return true
54+
}
55+
56+
if s.DropAllCapabilities == nil {
57+
return true
58+
}
59+
60+
return *s.DropAllCapabilities
61+
}
62+
63+
// GetAddCapabilities add capabilities to pod context
64+
func (s *ServerGroupSpecSecurityContext) GetAddCapabilities() []core.Capability {
65+
if s == nil {
66+
return nil
67+
}
68+
69+
return s.AddCapabilities
70+
}
71+
72+
// NewSecurityContext creates new pod security context
73+
func (s *ServerGroupSpecSecurityContext) NewPodSecurityContext() *core.PodSecurityContext {
74+
if s == nil {
75+
return nil
76+
}
77+
78+
if s.FSGroup == nil && len(s.SupplementalGroups) == 0 {
79+
return nil
80+
}
81+
82+
return &core.PodSecurityContext{
83+
SupplementalGroups: s.SupplementalGroups,
84+
FSGroup: s.FSGroup,
85+
}
86+
}
87+
88+
// NewSecurityContext creates new security context
89+
func (s *ServerGroupSpecSecurityContext) NewSecurityContext() *core.SecurityContext {
90+
r := &core.SecurityContext{}
91+
92+
if s != nil {
93+
r.AllowPrivilegeEscalation = s.AllowPrivilegeEscalation
94+
r.Privileged = s.Privileged
95+
r.ReadOnlyRootFilesystem = s.ReadOnlyRootFilesystem
96+
r.RunAsNonRoot = s.RunAsNonRoot
97+
r.RunAsUser = s.RunAsUser
98+
r.RunAsGroup = s.RunAsGroup
99+
100+
r.SeccompProfile = s.SeccompProfile.DeepCopy()
101+
r.SELinuxOptions = s.SELinuxOptions.DeepCopy()
102+
}
103+
104+
capabilities := &core.Capabilities{}
105+
106+
if s.GetDropAllCapabilities() {
107+
capabilities.Drop = []core.Capability{
108+
"ALL",
109+
}
110+
}
111+
112+
if caps := s.GetAddCapabilities(); caps != nil {
113+
capabilities.Add = []core.Capability{}
114+
115+
capabilities.Add = append(capabilities.Add, caps...)
116+
}
117+
118+
r.Capabilities = capabilities
119+
120+
return r
121+
}

‎pkg/apis/deployment/v1/server_group_spec.go‎

Lines changed: 0 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -157,102 +157,6 @@ type ServerGroupSpec struct {
157157
IndexMethod *ServerGroupIndexMethod `json:"indexMethod,omitempty"`
158158
}
159159

160-
// ServerGroupSpecSecurityContext contains specification for pod security context
161-
type ServerGroupSpecSecurityContext struct {
162-
// DropAllCapabilities specifies if capabilities should be dropped for this pod containers
163-
//
164-
// Deprecated: This field is added for backward compatibility. Will be removed in 1.1.0.
165-
DropAllCapabilities *bool `json:"dropAllCapabilities,omitempty"`
166-
// AddCapabilities add new capabilities to containers
167-
AddCapabilities []core.Capability `json:"addCapabilities,omitempty"`
168-
169-
AllowPrivilegeEscalation *bool `json:"allowPrivilegeEscalation,omitempty"`
170-
Privileged *bool `json:"privileged,omitempty"`
171-
ReadOnlyRootFilesystem *bool `json:"readOnlyRootFilesystem,omitempty"`
172-
RunAsNonRoot *bool `json:"runAsNonRoot,omitempty"`
173-
RunAsUser *int64 `json:"runAsUser,omitempty"`
174-
RunAsGroup *int64 `json:"runAsGroup,omitempty"`
175-
176-
SupplementalGroups []int64 `json:"supplementalGroups,omitempty"`
177-
FSGroup *int64 `json:"fsGroup,omitempty"`
178-
}
179-
180-
// GetDropAllCapabilities returns flag if capabilities should be dropped
181-
//
182-
// Deprecated: This function is added for backward compatibility. Will be removed in 1.1.0.
183-
func (s *ServerGroupSpecSecurityContext) GetDropAllCapabilities() bool {
184-
if s == nil {
185-
return true
186-
}
187-
188-
if s.DropAllCapabilities == nil {
189-
return true
190-
}
191-
192-
return *s.DropAllCapabilities
193-
}
194-
195-
// GetAddCapabilities add capabilities to pod context
196-
func (s *ServerGroupSpecSecurityContext) GetAddCapabilities() []core.Capability {
197-
if s == nil {
198-
return nil
199-
}
200-
201-
if s.AddCapabilities == nil {
202-
return nil
203-
}
204-
205-
return s.AddCapabilities
206-
}
207-
208-
// NewSecurityContext creates new pod security context
209-
func (s *ServerGroupSpecSecurityContext) NewPodSecurityContext() *core.PodSecurityContext {
210-
if s == nil {
211-
return nil
212-
}
213-
214-
if s.FSGroup == nil && len(s.SupplementalGroups) == 0 {
215-
return nil
216-
}
217-
218-
return &core.PodSecurityContext{
219-
SupplementalGroups: s.SupplementalGroups,
220-
FSGroup: s.FSGroup,
221-
}
222-
}
223-
224-
// NewSecurityContext creates new security context
225-
func (s *ServerGroupSpecSecurityContext) NewSecurityContext() *core.SecurityContext {
226-
r := &core.SecurityContext{}
227-
228-
if s != nil {
229-
r.AllowPrivilegeEscalation = s.AllowPrivilegeEscalation
230-
r.Privileged = s.Privileged
231-
r.ReadOnlyRootFilesystem = s.ReadOnlyRootFilesystem
232-
r.RunAsNonRoot = s.RunAsNonRoot
233-
r.RunAsUser = s.RunAsUser
234-
r.RunAsGroup = s.RunAsGroup
235-
}
236-
237-
capabilities := &core.Capabilities{}
238-
239-
if s.GetDropAllCapabilities() {
240-
capabilities.Drop = []core.Capability{
241-
"ALL",
242-
}
243-
}
244-
245-
if caps := s.GetAddCapabilities(); caps != nil {
246-
capabilities.Add = []core.Capability{}
247-
248-
capabilities.Add = append(capabilities.Add, caps...)
249-
}
250-
251-
r.Capabilities = capabilities
252-
253-
return r
254-
}
255-
256160
// ServerGroupProbesSpec contains specification for probes for pods of the server group
257161
type ServerGroupProbesSpec struct {
258162
// LivenessProbeDisabled if true livenessProbes are disabled

‎pkg/apis/deployment/v1/zz_generated.deepcopy.go‎

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/apis/deployment/v2alpha1/server_group_security_context_spec.go‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
//
2+
// DISCLAIMER
3+
//
4+
// Copyright 2016-2022 ArangoDB GmbH, Cologne, Germany
5+
//
6+
// Licensed under the Apache License, Version 2.0 (the "License");
7+
// you may not use this file except in compliance with the License.
8+
// You may obtain a copy of the License at
9+
//
10+
// http://www.apache.org/licenses/LICENSE-2.0
11+
//
12+
// Unless required by applicable law or agreed to in writing, software
13+
// distributed under the License is distributed on an "AS IS" BASIS,
14+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
// See the License for the specific language governing permissions and
16+
// limitations under the License.
17+
//
18+
// Copyright holder is ArangoDB GmbH, Cologne, Germany
19+
//
20+
21+
package v2alpha1
22+
23+
import core "k8s.io/api/core/v1"
24+
25+
// ServerGroupSpecSecurityContext contains specification for pod security context
26+
type ServerGroupSpecSecurityContext struct {
27+
// DropAllCapabilities specifies if capabilities should be dropped for this pod containers
28+
//
29+
// Deprecated: This field is added for backward compatibility. Will be removed in 1.1.0.
30+
DropAllCapabilities *bool `json:"dropAllCapabilities,omitempty"`
31+
// AddCapabilities add new capabilities to containers
32+
AddCapabilities []core.Capability `json:"addCapabilities,omitempty"`
33+
34+
AllowPrivilegeEscalation *bool `json:"allowPrivilegeEscalation,omitempty"`
35+
Privileged *bool `json:"privileged,omitempty"`
36+
ReadOnlyRootFilesystem *bool `json:"readOnlyRootFilesystem,omitempty"`
37+
RunAsNonRoot *bool `json:"runAsNonRoot,omitempty"`
38+
RunAsUser *int64 `json:"runAsUser,omitempty"`
39+
RunAsGroup *int64 `json:"runAsGroup,omitempty"`
40+
41+
SupplementalGroups []int64 `json:"supplementalGroups,omitempty"`
42+
FSGroup *int64 `json:"fsGroup,omitempty"`
43+
44+
SeccompProfile *core.SeccompProfile `json:"seccompProfile,omitempty" protobuf:"bytes,11,opt,name=seccompProfile"`
45+
SELinuxOptions *core.SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,3,opt,name=seLinuxOptions"`
46+
}
47+
48+
// GetDropAllCapabilities returns flag if capabilities should be dropped
49+
//
50+
// Deprecated: This function is added for backward compatibility. Will be removed in 1.1.0.
51+
func (s *ServerGroupSpecSecurityContext) GetDropAllCapabilities() bool {
52+
if s == nil {
53+
return true
54+
}
55+
56+
if s.DropAllCapabilities == nil {
57+
return true
58+
}
59+
60+
return *s.DropAllCapabilities
61+
}
62+
63+
// GetAddCapabilities add capabilities to pod context
64+
func (s *ServerGroupSpecSecurityContext) GetAddCapabilities() []core.Capability {
65+
if s == nil {
66+
return nil
67+
}
68+
69+
return s.AddCapabilities
70+
}
71+
72+
// NewSecurityContext creates new pod security context
73+
func (s *ServerGroupSpecSecurityContext) NewPodSecurityContext() *core.PodSecurityContext {
74+
if s == nil {
75+
return nil
76+
}
77+
78+
if s.FSGroup == nil && len(s.SupplementalGroups) == 0 {
79+
return nil
80+
}
81+
82+
return &core.PodSecurityContext{
83+
SupplementalGroups: s.SupplementalGroups,
84+
FSGroup: s.FSGroup,
85+
}
86+
}
87+
88+
// NewSecurityContext creates new security context
89+
func (s *ServerGroupSpecSecurityContext) NewSecurityContext() *core.SecurityContext {
90+
r := &core.SecurityContext{}
91+
92+
if s != nil {
93+
r.AllowPrivilegeEscalation = s.AllowPrivilegeEscalation
94+
r.Privileged = s.Privileged
95+
r.ReadOnlyRootFilesystem = s.ReadOnlyRootFilesystem
96+
r.RunAsNonRoot = s.RunAsNonRoot
97+
r.RunAsUser = s.RunAsUser
98+
r.RunAsGroup = s.RunAsGroup
99+
100+
r.SeccompProfile = s.SeccompProfile.DeepCopy()
101+
r.SELinuxOptions = s.SELinuxOptions.DeepCopy()
102+
}
103+
104+
capabilities := &core.Capabilities{}
105+
106+
if s.GetDropAllCapabilities() {
107+
capabilities.Drop = []core.Capability{
108+
"ALL",
109+
}
110+
}
111+
112+
if caps := s.GetAddCapabilities(); caps != nil {
113+
capabilities.Add = []core.Capability{}
114+
115+
capabilities.Add = append(capabilities.Add, caps...)
116+
}
117+
118+
r.Capabilities = capabilities
119+
120+
return r
121+
}

0 commit comments

Comments
 (0)