Skip to content

Commit 074acdc

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #15558 from php-coder/scc_for_flexvolumes
Automatic merge from submit-queue SCC: add AllowedFlexVolumes to manage a whitelist of allowed flexvolumes drivers Proposal: kubernetes/community#723 Trello: https://trello.com/c/YT6sNEay/61-5-sccfsi-psp-scc-flex-volume-support Examples: #15558 (comment)
2 parents 787e1b7 + f67f171 commit 074acdc

19 files changed

+651
-128
lines changed

‎api/docs/api/v1.SecurityContextConstraints.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ Expand or mouse-over a field for more information about it.
2626
</div><div style="margin-left:13px;"><span title="(boolean) AllowPrivilegedContainer determines if a container can request to be run as privileged.">allowPrivilegedContainer</span>:
2727
</div><details><summary><span title="(array) AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field maybe added at the pod author&#39;s discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities. To allow all capabilities you may use &#39;*&#39;.">allowedCapabilities</span>:
2828
</summary><div style="margin-left:13px;">- <span title="(string)">[string]</span>:
29+
</div></details><details><summary><span title="(array) AllowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the &#34;Volumes&#34; field.">allowedFlexVolumes</span>:
30+
</summary><div style="margin-left:13px;">- <span title="(string) Driver is the name of the Flexvolume driver.">driver</span>:
2931
</div></details><div style="margin-left:13px;"><span title="(string) APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources">apiVersion</span>:
3032
</div><details><summary><span title="(array) DefaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability. You may not list a capabiility in both DefaultAddCapabilities and RequiredDropCapabilities.">defaultAddCapabilities</span>:
3133
</summary><div style="margin-left:13px;">- <span title="(string)">[string]</span>:

‎api/docs/apis-security.openshift.io/v1.SecurityContextConstraints.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ Expand or mouse-over a field for more information about it.
2626
</div><div style="margin-left:13px;"><span title="(boolean) AllowPrivilegedContainer determines if a container can request to be run as privileged.">allowPrivilegedContainer</span>:
2727
</div><details><summary><span title="(array) AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field maybe added at the pod author&#39;s discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities. To allow all capabilities you may use &#39;*&#39;.">allowedCapabilities</span>:
2828
</summary><div style="margin-left:13px;">- <span title="(string)">[string]</span>:
29+
</div></details><details><summary><span title="(array) AllowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the &#34;Volumes&#34; field.">allowedFlexVolumes</span>:
30+
</summary><div style="margin-left:13px;">- <span title="(string) Driver is the name of the Flexvolume driver.">driver</span>:
2931
</div></details><div style="margin-left:13px;"><span title="(string) APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources">apiVersion</span>:
3032
</div><details><summary><span title="(array) DefaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability. You may not list a capabiility in both DefaultAddCapabilities and RequiredDropCapabilities.">defaultAddCapabilities</span>:
3133
</summary><div style="margin-left:13px;">- <span title="(string)">[string]</span>:

‎api/protobuf-spec/github_com_openshift_origin_pkg_security_apis_security_v1.proto

Lines changed: 11 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/swagger-spec/api-v1.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22769,6 +22769,7 @@
2276922769
"allowedCapabilities",
2277022770
"allowHostDirVolumePlugin",
2277122771
"volumes",
22772+
"allowedFlexVolumes",
2277222773
"allowHostNetwork",
2277322774
"allowHostPorts",
2277422775
"allowHostPID",
@@ -22829,6 +22830,13 @@
2282922830
},
2283022831
"description": "Volumes is a white list of allowed volume plugins. FSType corresponds directly with the field names of a VolumeSource (azureFile, configMap, emptyDir). To allow all volumes you may use \"*\". To allow no volumes, set to [\"none\"]."
2283122832
},
22833+
"allowedFlexVolumes": {
22834+
"type": "array",
22835+
"items": {
22836+
"$ref": "v1.AllowedFlexVolume"
22837+
},
22838+
"description": "AllowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the \"Volumes\" field."
22839+
},
2283222840
"allowHostNetwork": {
2283322841
"type": "boolean",
2283422842
"description": "AllowHostNetwork determines if the policy allows the use of HostNetwork in the pod spec."
@@ -22892,6 +22900,16 @@
2289222900
"id": "v1.FSType",
2289322901
"properties": {}
2289422902
},
22903+
"v1.AllowedFlexVolume": {
22904+
"id": "v1.AllowedFlexVolume",
22905+
"description": "AllowedFlexVolume represents a single Flexvolume that is allowed to be used.",
22906+
"properties": {
22907+
"driver": {
22908+
"type": "string",
22909+
"description": "Driver is the name of the Flexvolume driver."
22910+
}
22911+
}
22912+
},
2289522913
"v1.SELinuxContextStrategyOptions": {
2289622914
"id": "v1.SELinuxContextStrategyOptions",
2289722915
"description": "SELinuxContextStrategyOptions defines the strategy type and any options used to create the strategy.",

‎api/swagger-spec/openshift-openapi-spec.json

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92187,6 +92187,15 @@
9218792187
}
9218892188
}
9218992189
},
92190+
"com.github.openshift.origin.pkg.security.apis.security.v1.AllowedFlexVolume": {
92191+
"description": "AllowedFlexVolume represents a single Flexvolume that is allowed to be used.",
92192+
"properties": {
92193+
"driver": {
92194+
"description": "Driver is the name of the Flexvolume driver.",
92195+
"type": "string"
92196+
}
92197+
}
92198+
},
9219092199
"com.github.openshift.origin.pkg.security.apis.security.v1.FSGroupStrategyOptions": {
9219192200
"description": "FSGroupStrategyOptions defines the strategy type and options used to create the strategy.",
9219292201
"properties": {
@@ -92459,6 +92468,7 @@
9245992468
"allowedCapabilities",
9246092469
"allowHostDirVolumePlugin",
9246192470
"volumes",
92471+
"allowedFlexVolumes",
9246292472
"allowHostNetwork",
9246392473
"allowHostPorts",
9246492474
"allowHostPID",
@@ -92497,6 +92507,13 @@
9249792507
"type": "string"
9249892508
}
9249992509
},
92510+
"allowedFlexVolumes": {
92511+
"description": "AllowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the \"Volumes\" field.",
92512+
"type": "array",
92513+
"items": {
92514+
"$ref": "#/definitions/com.github.openshift.origin.pkg.security.apis.security.v1.AllowedFlexVolume"
92515+
}
92516+
},
9250092517
"apiVersion": {
9250192518
"description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources",
9250292519
"type": "string"

‎pkg/oc/cli/describe/describer.go

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1835,6 +1835,7 @@ func describeSecurityContextConstraints(scc *securityapi.SecurityContextConstrai
18351835
fmt.Fprintf(out, " Allowed Capabilities:\t%s\n", capsToString(scc.AllowedCapabilities))
18361836
fmt.Fprintf(out, " Allowed Seccomp Profiles:\t%s\n", stringOrNone(strings.Join(scc.SeccompProfiles, ",")))
18371837
fmt.Fprintf(out, " Allowed Volume Types:\t%s\n", fsTypeToString(scc.Volumes))
1838+
fmt.Fprintf(out, " Allowed Flexvolumes:\t%s\n", flexVolumesToString(scc.AllowedFlexVolumes))
18381839
fmt.Fprintf(out, " Allow Host Network:\t%t\n", scc.AllowHostNetwork)
18391840
fmt.Fprintf(out, " Allow Host Ports:\t%t\n", scc.AllowHostPorts)
18401841
fmt.Fprintf(out, " Allow Host PID:\t%t\n", scc.AllowHostPID)
@@ -1884,10 +1885,14 @@ func describeSecurityContextConstraints(scc *securityapi.SecurityContextConstrai
18841885
}
18851886

18861887
func stringOrNone(s string) string {
1888+
return stringOrDefaultValue(s, "<none>")
1889+
}
1890+
1891+
func stringOrDefaultValue(s, defaultValue string) string {
18871892
if len(s) > 0 {
18881893
return s
18891894
}
1890-
return "<none>"
1895+
return defaultValue
18911896
}
18921897

18931898
func fsTypeToString(volumes []securityapi.FSType) string {
@@ -1898,6 +1903,14 @@ func fsTypeToString(volumes []securityapi.FSType) string {
18981903
return stringOrNone(strings.Join(strVolumes, ","))
18991904
}
19001905

1906+
func flexVolumesToString(flexVolumes []securityapi.AllowedFlexVolume) string {
1907+
volumes := []string{}
1908+
for _, flexVolume := range flexVolumes {
1909+
volumes = append(volumes, "driver="+flexVolume.Driver)
1910+
}
1911+
return stringOrDefaultValue(strings.Join(volumes, ","), "<all>")
1912+
}
1913+
19011914
func idRangeToString(ranges []securityapi.IDRange) string {
19021915
formattedString := ""
19031916
if ranges != nil {

‎pkg/openapi/zz_generated.openapi.go

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8788,6 +8788,23 @@ func GetOpenAPIDefinitions(ref openapi.ReferenceCallback) map[string]openapi.Ope
87888788
},
87898789
Dependencies: []string{},
87908790
},
8791+
"github.com/openshift/origin/pkg/security/apis/security/v1.AllowedFlexVolume": {
8792+
Schema: spec.Schema{
8793+
SchemaProps: spec.SchemaProps{
8794+
Description: "AllowedFlexVolume represents a single Flexvolume that is allowed to be used.",
8795+
Properties: map[string]spec.Schema{
8796+
"driver": {
8797+
SchemaProps: spec.SchemaProps{
8798+
Description: "Driver is the name of the Flexvolume driver.",
8799+
Type: []string{"string"},
8800+
Format: "",
8801+
},
8802+
},
8803+
},
8804+
},
8805+
},
8806+
Dependencies: []string{},
8807+
},
87918808
"github.com/openshift/origin/pkg/security/apis/security/v1.FSGroupStrategyOptions": {
87928809
Schema: spec.Schema{
87938810
SchemaProps: spec.SchemaProps{
@@ -9265,6 +9282,19 @@ func GetOpenAPIDefinitions(ref openapi.ReferenceCallback) map[string]openapi.Ope
92659282
},
92669283
},
92679284
},
9285+
"allowedFlexVolumes": {
9286+
SchemaProps: spec.SchemaProps{
9287+
Description: "AllowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the \"Volumes\" field.",
9288+
Type: []string{"array"},
9289+
Items: &spec.SchemaOrArray{
9290+
Schema: &spec.Schema{
9291+
SchemaProps: spec.SchemaProps{
9292+
Ref: ref("github.com/openshift/origin/pkg/security/apis/security/v1.AllowedFlexVolume"),
9293+
},
9294+
},
9295+
},
9296+
},
9297+
},
92689298
"allowHostNetwork": {
92699299
SchemaProps: spec.SchemaProps{
92709300
Description: "AllowHostNetwork determines if the policy allows the use of HostNetwork in the pod spec.",
@@ -9367,11 +9397,11 @@ func GetOpenAPIDefinitions(ref openapi.ReferenceCallback) map[string]openapi.Ope
93679397
},
93689398
},
93699399
},
9370-
Required: []string{"priority", "allowPrivilegedContainer", "defaultAddCapabilities", "requiredDropCapabilities", "allowedCapabilities", "allowHostDirVolumePlugin", "volumes", "allowHostNetwork", "allowHostPorts", "allowHostPID", "allowHostIPC", "readOnlyRootFilesystem"},
9400+
Required: []string{"priority", "allowPrivilegedContainer", "defaultAddCapabilities", "requiredDropCapabilities", "allowedCapabilities", "allowHostDirVolumePlugin", "volumes", "allowedFlexVolumes", "allowHostNetwork", "allowHostPorts", "allowHostPID", "allowHostIPC", "readOnlyRootFilesystem"},
93719401
},
93729402
},
93739403
Dependencies: []string{
9374-
"github.com/openshift/origin/pkg/security/apis/security/v1.FSGroupStrategyOptions", "github.com/openshift/origin/pkg/security/apis/security/v1.RunAsUserStrategyOptions", "github.com/openshift/origin/pkg/security/apis/security/v1.SELinuxContextStrategyOptions", "github.com/openshift/origin/pkg/security/apis/security/v1.SupplementalGroupsStrategyOptions", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
9404+
"github.com/openshift/origin/pkg/security/apis/security/v1.AllowedFlexVolume", "github.com/openshift/origin/pkg/security/apis/security/v1.FSGroupStrategyOptions", "github.com/openshift/origin/pkg/security/apis/security/v1.RunAsUserStrategyOptions", "github.com/openshift/origin/pkg/security/apis/security/v1.SELinuxContextStrategyOptions", "github.com/openshift/origin/pkg/security/apis/security/v1.SupplementalGroupsStrategyOptions", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
93759405
},
93769406
"github.com/openshift/origin/pkg/security/apis/security/v1.SecurityContextConstraintsList": {
93779407
Schema: spec.Schema{

‎pkg/security/apis/security/types.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ type SecurityContextConstraints struct {
4545
// of a VolumeSource (azureFile, configMap, emptyDir). To allow all volumes you may use "*".
4646
// To allow no volumes, set to ["none"].
4747
Volumes []FSType
48+
// AllowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all
49+
// Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes
50+
// is allowed in the "Volumes" field.
51+
// +optional
52+
AllowedFlexVolumes []AllowedFlexVolume
4853
// AllowHostNetwork determines if the policy allows the use of HostNetwork in the pod spec.
4954
AllowHostNetwork bool
5055
// AllowHostPorts determines if the policy allows host ports in the containers.
@@ -115,6 +120,12 @@ var (
115120
FSTypeNone FSType = "none"
116121
)
117122

123+
// AllowedFlexVolume represents a single Flexvolume that is allowed to be used.
124+
type AllowedFlexVolume struct {
125+
// Driver is the name of the Flexvolume driver.
126+
Driver string
127+
}
128+
118129
// SELinuxContextStrategyOptions defines the strategy type and any options used to create the strategy.
119130
type SELinuxContextStrategyOptions struct {
120131
// Type is the strategy that will dictate what SELinux context is used in the SecurityContext.

0 commit comments

Comments
 (0)