Adding a new `WindowsSecurityOptions` struct

As outlined in the KEP at https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20190418-windows-security-context.md and improvements on it at https://github.com/kubernetes/enhancements/pull/975 For now this struct is left empty, as discussed in the KEP (see above) and as previously discussed with Jordan Liggitt. It will allow adding GMSA and options as well as `RunAsUserName` options; both of which have already been pre-implemented respectively at https://github.com/kubernetes/kubernetes/pull/75459 and https://github.com/kubernetes/kubernetes/pull/73609; and both of which will need to be re-based to make use of the new struct. Signed-off-by: Jean Rouge <rougej+github@gmail.com>

Adding a new `WindowsSecurityOptions` struct
d7aa3185 · Jean Rouge · 62219e1f · d7aa3185 · d7aa3185
Commit d7aa3185 authored Apr 26, 2019 by Jean Rouge
Hide whitespace changes
Inline Side-by-side

Showing with 22 additions and 0 deletions

types.go pkg/apis/core/types.go +11 -0

types.go staging/src/k8s.io/api/core/v1/types.go +11 -0

No files found.
--- a/pkg/apis/core/types.go
+++ b/pkg/apis/core/types.go
@@ -2733,6 +2733,9 @@ type PodSecurityContext struct {
 	// takes precedence for that container.
 	// +optional
 	SELinuxOptions *SELinuxOptions
+	// Windows security options.
+	// +optional
+	WindowsOptions *WindowsSecurityContextOptions
 	// The UID to run the entrypoint of the container process.
 	// Defaults to user specified in image metadata if unspecified.
 	// May also be set in SecurityContext.  If set in both SecurityContext and
@@ -4677,6 +4680,9 @@ type SecurityContext struct {
 	// PodSecurityContext, the value specified in SecurityContext takes precedence.
 	// +optional
 	SELinuxOptions *SELinuxOptions
+	// Windows security options.
+	// +optional
+	WindowsOptions *WindowsSecurityContextOptions
 	// The UID to run the entrypoint of the container process.
 	// Defaults to user specified in image metadata if unspecified.
 	// May also be set in PodSecurityContext.  If set in both SecurityContext and
@@ -4743,6 +4749,11 @@ type SELinuxOptions struct {
 	Level string
 }

+// WindowsSecurityContextOptions contain Windows-specific options and credentials.
+type WindowsSecurityContextOptions struct {
+	// intentionally left empty for now
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

 // RangeAllocation is an opaque API object (not exposed to end users) that can be persisted to record

--- a/staging/src/k8s.io/api/core/v1/types.go
+++ b/staging/src/k8s.io/api/core/v1/types.go
@@ -3000,6 +3000,9 @@ type PodSecurityContext struct {
 	// takes precedence for that container.
 	// +optional
 	SELinuxOptions *SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,1,opt,name=seLinuxOptions"`
+	// Windows security options.
+	// +optional
+	WindowsOptions *WindowsSecurityContextOptions `json:"windowsOptions,omitempty" protobuf:"bytes,8,opt,name=windowsOptions"`
 	// The UID to run the entrypoint of the container process.
 	// Defaults to user specified in image metadata if unspecified.
 	// May also be set in SecurityContext.  If set in both SecurityContext and
@@ -5267,6 +5270,9 @@ type SecurityContext struct {
 	// PodSecurityContext, the value specified in SecurityContext takes precedence.
 	// +optional
 	SELinuxOptions *SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,3,opt,name=seLinuxOptions"`
+	// Windows security options.
+	// +optional
+	WindowsOptions *WindowsSecurityContextOptions `json:"windowsOptions,omitempty" protobuf:"bytes,10,opt,name=windowsOptions"`
 	// The UID to run the entrypoint of the container process.
 	// Defaults to user specified in image metadata if unspecified.
 	// May also be set in PodSecurityContext.  If set in both SecurityContext and
@@ -5337,6 +5343,11 @@ type SELinuxOptions struct {
 	Level string `json:"level,omitempty" protobuf:"bytes,4,opt,name=level"`
 }

+// WindowsSecurityContextOptions contain Windows-specific options and credentials.
+type WindowsSecurityContextOptions struct {
+	// intentionally left empty for now
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

 // RangeAllocation is not a public type.