Admit NoNewPrivs for remote and rkt runtimes

pkg/kubelet/lifecycle/handlers.go

@@ -187,21 +187,11 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult
 		return PodAdmitResult{Admit: true}
 	}
 
-	// Always admit for remote runtime.
-	if a.Runtime.Type() == kubetypes.RemoteContainerRuntime {
+	// Always admit runtimes except docker.
+	if a.Runtime.Type() != kubetypes.DockerContainerRuntime {
 		return PodAdmitResult{Admit: true}
 	}
 
-	// Make sure it is either docker or rkt runtimes.
-	if a.Runtime.Type() != kubetypes.DockerContainerRuntime && a.Runtime.Type() != kubetypes.RktContainerRuntime {
-		return PodAdmitResult{
-			Admit:   false,
-			Reason:  "NoNewPrivs",
-			Message: fmt.Sprintf("Cannot enforce NoNewPrivs: %s runtime not supported", a.Runtime.Type()),
-		}
-	}
-
-	if a.Runtime.Type() == kubetypes.DockerContainerRuntime {
 	// Make sure docker api version is valid.
 	rversion, err := a.Runtime.APIVersion()
 	if err != nil {
@@ -227,7 +217,6 @@ func (a *noNewPrivsAdmitHandler) Admit(attrs *PodAdmitAttributes) PodAdmitResult
 			Message: fmt.Sprintf("Cannot enforce NoNewPrivs: docker runtime API version %q must be greater than or equal to 1.23", rversion.String()),
 		}
 	}
-	}
 
 	return PodAdmitResult{Admit: true}
 }