Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

seccomp GA - Add new seccomp fields and update kubelet to use them #91381

Merged
merged 1 commit into from
Jul 6, 2020
Merged

seccomp GA - Add new seccomp fields and update kubelet to use them #91381

merged 1 commit into from
Jul 6, 2020

Conversation

pjbgf
Copy link
Member

@pjbgf pjbgf commented May 23, 2020 •
edited by liggitt
Loading

What type of PR is this?
/kind feature

What this PR does / why we need it:
This PR adds the SeccompProfile field to both Pod and Container. It also implements the kubelet enforcement priority defined at the KEP.

Which issue(s) this PR fixes:

Part of #91286

Special notes for your reviewer:
A separate PR will be created to cover annotation to field conversion, and its test cases.
The API changes made are based off the merged KEP.

Does this PR introduce a user-facing change?:

Seccomp support has graduated to GA. A new `seccompProfile` field is added to pod and container securityContext objects. Support for `seccomp.security.alpha.kubernetes.io/pod` and `container.seccomp.security.alpha.kubernetes.io/...` annotations is deprecated, and will be removed in v1.22.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

/sig node
/area security

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/node Categorizes an issue or PR as relevant to SIG Node. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. area/security cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels May 23, 2020
@pjbgf pjbgf mentioned this pull request May 23, 2020
Closed
9 tasks
@k8s-ci-robot k8s-ci-robot added area/kubelet kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API sig/apps Categorizes an issue or PR as relevant to SIG Apps. labels May 23, 2020
@fejta-bot
Copy link

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

@pjbgf
Copy link
Member Author

pjbgf commented May 23, 2020

/retest

1 similar comment
@pjbgf
Copy link
Member Author

pjbgf commented May 23, 2020

/retest

@liggitt liggitt requested review from tallclair and liggitt and removed request for caesarxuchao and brendandburns May 23, 2020 23:48
@pjbgf
Copy link
Member Author

pjbgf commented May 25, 2020

The API changes are based off the already reviewed KEP.

/label api-review

@k8s-ci-robot k8s-ci-robot added the api-review Categorizes an issue or PR as actively needing an API review. label May 25, 2020
@pjbgf
Copy link
Member Author

pjbgf commented May 25, 2020

/cc @saschagrunert @hasheddan @evrardjp

@k8s-ci-robot
Copy link
Contributor

@pjbgf: GitHub didn't allow me to request PR reviews from the following users: evrardjp.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @saschagrunert @hasheddan @evrardjp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

saschagrunert
saschagrunert reviewed May 25, 2020
View reviewed changes
Copy link
Member

@saschagrunert saschagrunert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally LGTM, I've just got a few nits/suggestions 👇

pkg/apis/core/annotation_key_constants.go Outdated Show resolved Hide resolved
pkg/apis/core/types.go Outdated Show resolved Hide resolved
pkg/apis/core/types.go Show resolved Hide resolved
staging/src/k8s.io/api/core/v1/generated.proto Show resolved Hide resolved
@saschagrunert saschagrunert mentioned this pull request May 25, 2020
Merged
@pjbgf pjbgf mentioned this pull request May 25, 2020
Closed
22 tasks
@k8s-ci-robot k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Jun 30, 2020
@pjbgf
Copy link
Member Author

pjbgf commented Jun 30, 2020

/retest

@liggitt
Copy link
Member

liggitt commented Jun 30, 2020 •
edited
Loading

API change and validation lgtm

/hold pending #91408 being ready and reviewed

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 30, 2020
@liggitt
Copy link
Member

liggitt commented Jun 30, 2020

noticed one validation gap in https://github.com/kubernetes/kubernetes/pull/91381/files#r447910309

@pjbgf
Copy link
Member Author

pjbgf commented Jun 30, 2020

/retest

2 similar comments
@pjbgf
Copy link
Member Author

pjbgf commented Jun 30, 2020

/retest

@pjbgf
Copy link
Member Author

pjbgf commented Jul 1, 2020

/retest

@pjbgf @saschagrunert
Add seccomp enforcement and validation based on new GA fields
8976e36 
Adds seccomp validation.

This ensures that field and annotation values must match when present.

Co-authored-by: Sascha Grunert <[email protected]>
@saschagrunert
Copy link
Member

/test pull-kubernetes-kubemark-e2e-gce-big

@liggitt
Copy link
Member

liggitt commented Jul 6, 2020

/lgtm
/approve
/priority important-soon

@k8s-ci-robot k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jul 6, 2020
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, pjbgf

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 6, 2020
@liggitt
Copy link
Member

liggitt commented Jul 6, 2020

/hold cancel
#91408 has lgtm

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 6, 2020
@k8s-ci-robot k8s-ci-robot merged commit 205d5c5 into kubernetes:master Jul 6, 2020
@pjbgf pjbgf deleted the seccomp-ga-kubelet-changes branch July 7, 2020 07:35
@github-actions github-actions bot mentioned this pull request Jul 8, 2020
Open
@Matty9191 Matty9191 mentioned this pull request Jul 8, 2020
Open
@github-actions github-actions bot mentioned this pull request Jul 22, 2020
Open
@tallclair tallclair mentioned this pull request Feb 22, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@saschagrunert saschagrunert saschagrunert approved these changes

@liggitt liggitt liggitt left review comments

@hasheddan hasheddan hasheddan approved these changes

@tallclair tallclair Awaiting requested review from tallclair

Assignees

@saschagrunert saschagrunert

@liggitt liggitt

@hasheddan hasheddan

Labels
api-review Categorizes an issue or PR as actively needing an API review. approved Indicates a PR has been approved by an approver from all required OWNERS files. area/conformance Issues or PRs related to kubernetes conformance tests area/kubelet area/release-eng Issues or PRs related to the Release Engineering subproject area/security cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/node Categorizes an issue or PR as relevant to SIG Node. sig/release Categorizes an issue or PR as relevant to SIG Release. sig/scheduling Categorizes an issue or PR as relevant to SIG Scheduling. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
API Reviews
Status: API review completed, 1.19
Milestone
v1.19
Development

Successfully merging this pull request may close these issues.
7 participants
@pjbgf @fejta-bot @k8s-ci-robot @liggitt @saschagrunert @kow3ns @hasheddan