Skip to content

K
k3s
Commit 611036c8 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #51404 from feiskyer/nonewprivs

Automatic merge from submit-queue (batch tested with PRs 51425, 51404, 51459, 51504, 51488) Admit NoNewPrivs for remote and rkt runtimes **What this PR does / why we need it**: #51347 is aiming to admit NoNewPrivis for remote container runtime, but it didn't actually solve the problem. See @miaoyq 's comments [here](https://github.com/kubernetes/kubernetes/pull/51347#discussion_r135379446). This PR always admit NoNewPrivs for runtimes except docker, which should fix the problem. **Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: Fixes #51319. **Special notes for your reviewer**: **Release note**: ```release-note NONE ```
parents a9b60b4a fc8736fd
Show whitespace changes
Inline Side-by-side
Showing with 2 additions and 13 deletions
pkg/kubelet/lifecycle/handlers.go
View file @ 611036c8
...@@ -187,21 +187,11 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult ...@@ -187,21 +187,11 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult
return PodAdmitResult{Admit: true} return PodAdmitResult{Admit: true}
} }
// Always admit for remote runtime. // Always admit runtimes except docker.
if a.Runtime.Type() == kubetypes.RemoteContainerRuntime { if a.Runtime.Type() != kubetypes.DockerContainerRuntime {
return PodAdmitResult{Admit: true} return PodAdmitResult{Admit: true}
} }
// Make sure it is either docker or rkt runtimes.
if a.Runtime.Type() != kubetypes.DockerContainerRuntime && a.Runtime.Type() != kubetypes.RktContainerRuntime {
return PodAdmitResult{
Admit: false,
Reason: "NoNewPrivs",
Message: fmt.Sprintf("Cannot enforce NoNewPrivs: %s runtime not supported", a.Runtime.Type()),
}
}
if a.Runtime.Type() == kubetypes.DockerContainerRuntime {
// Make sure docker api version is valid. // Make sure docker api version is valid.
rversion, err := a.Runtime.APIVersion() rversion, err := a.Runtime.APIVersion()
if err != nil { if err != nil {
...@@ -227,7 +217,6 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult ...@@ -227,7 +217,6 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult
Message: fmt.Sprintf("Cannot enforce NoNewPrivs: docker runtime API version %q must be greater than or equal to 1.23", rversion.String()), Message: fmt.Sprintf("Cannot enforce NoNewPrivs: docker runtime API version %q must be greater than or equal to 1.23", rversion.String()),
} }
} }
}
return PodAdmitResult{Admit: true} return PodAdmitResult{Admit: true}
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment