Add GKE default pod into allowlist in Mount Launched of Privileged Container rule

[hi120ki]

Signed-off-by: Hi120ki [email protected]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

If contributing rules or changes to rules, please make sure to also uncomment one of the following line:

/kind rule-update

/kind rule-create

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area rules

/area tests

/area proposals

/area CI

What this PR does / why we need it:

In GKE cluster, a system container gce-pd-driver that manages Persistent Disk is running.
But the rule Mount Launched of Privileged Container detects as false positive.

Process: mount -t ext4 -o defaults /dev/disk/by-id/google-pvc-<id> /var/lib/kubelet/plugins/kubernetes.io/csi/pv/pvc-<id>/globalmount

This container runs in kube-system namespace, and image is from gke.gcr.io/gcp-compute-persistent-disk-csi-driver.
I added it into allowlist(macro : user_known_mount_in_privileged_containers ).

I'm waiting for your comments on adding it into allowlist and my proposed changes.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

rule(macro: known_gke_mount_in_privileged_containers): add new macro
rule(Mount Launched in Privileged Container): add GKE default pod into allowlist in Mount Launched of Privileged Container rule 

[darryk10]

Hi @hi120ki ,
thanks for helping with FPs we really need this type of contribution :)
The only suggestion from my side is to create a new macro related to GKE. The macros like user_known_mount_in_privileged_containers are usually used as macros that each user can customise based on their environment. If we find something related to a specific technology we use to create a new macro related to it. :)
Thanks

[hi120ki]

@darryk10 I see. I revert and add new macro macro: known_gke_mount_in_privileged_containers as allowlist.
Cloud you check it?

[jasondellaluce]

/milestone 0.33.0

/ok-to-test

[darryk10]

Thanks @hi120ki
LGTM

[poiana]

LGTM label has been added.

Git tree hash: 1c9189cac088f67f7e9d69e3b83a1e3cac740fd4

[jasondellaluce]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: darryk10, hi120ki, jasondellaluce, Kaizhe, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [jasondellaluce,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[leogr]

Closing and reopening to trigger the CI
/close

[poiana]

@leogr: Closed this PR.

In response to this:

Closing and reopening to trigger the CI
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[leogr]

/reopen

/hold
for the CI to complete

[poiana]

@leogr: Reopened this PR.

In response to this:

/reopen

/hold
for the CI to complete

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[leogr]

/hold cancel