Merge pull request #49180 from feiskyer/seccomp

Automatic merge from submit-queue (batch tested with PRs 48981, 47316, 49180) Add seccomp profile in sandbox security context **What this PR does / why we need it**: PR #46332 adds seccomp profile to container security context, but not sandbox. This PR adds seccomp profile in sandbox security context. Without this, we couldn't honour "seccomp.security.alpha.kubernetes.io/pod" for sandbox. **Which issue this PR fixes** fixes #49179. **Special notes for your reviewer**: **Release note**: ```release-note NONE ``` /cc @yujuhong

Merge pull request #49180 from feiskyer/seccomp
8a98983a · Kubernetes Submit Queue · GitHub · c0287ce4 · d0205c8b · 8a98983a
Commit 8a98983a authored Jul 19, 2017 by Kubernetes Submit Queue Committed by GitHub Jul 19, 2017
Expand all Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 0 deletions

api.pb.go pkg/kubelet/apis/cri/v1alpha1/runtime/api.pb.go +0 -0

api.proto pkg/kubelet/apis/cri/v1alpha1/runtime/api.proto +6 -0

No files found.
--- a/pkg/kubelet/apis/cri/v1alpha1/runtime/api.pb.go
+++ b/pkg/kubelet/apis/cri/v1alpha1/runtime/api.pb.go
--- a/pkg/kubelet/apis/cri/v1alpha1/runtime/api.proto
+++ b/pkg/kubelet/apis/cri/v1alpha1/runtime/api.proto
@@ -200,6 +200,12 @@ message LinuxSandboxSecurityContext {
    // This allows a sandbox to take additional security precautions if no
    // privileged containers are expected to be run.
    bool privileged = 6;
+    // Seccomp profile for the sandbox, candidate values are:
+    // * runtime/default: the default profile for the container runtime
+    // * unconfined: unconfined profile, ie, no seccomp sandboxing
+    // * localhost/<full-path-to-profile>: the profile installed on the node.
+    //   <full-path-to-profile> is the full path of the profile.
+    string seccomp_profile_path = 7;
 }
 // LinuxPodSandboxConfig holds platform-specific configurations for Linux