Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add a ProcMount option to the SecurityContext & AllowedProcMountTypes to PodSecurityPolicy #64283

Merged
merged 8 commits into from Aug 31, 2018
Merged

Add a ProcMount option to the SecurityContext & AllowedProcMountTypes to PodSecurityPolicy #64283

merged 8 commits into from Aug 31, 2018

Conversation

jessfraz
Copy link
Contributor

@jessfraz jessfraz commented May 24, 2018 •
edited

So there is a bit of a chicken and egg problem here in that the CRI runtimes will need to implement this for there to be any sort of e2e testing.

What this PR does / why we need it: This PR implements design proposal kubernetes/community#1934. This adds a ProcMount option to the SecurityContext and AllowedProcMountTypes to PodSecurityPolicy

Relies on google/cadvisor#1967

Release note:

ProcMount added to SecurityContext and AllowedProcMounts added to PodSecurityPolicy to allow paths in the container's /proc to not be masked.

cc @Random-Liu @mrunalp

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 24, 2018
@k8s-github-robot k8s-github-robot added the kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API label May 24, 2018
@jessfraz jessfraz mentioned this pull request May 24, 2018
Merged
dims
dims reviewed May 24, 2018
View reviewed changes
pkg/security/podsecuritypolicy/provider.go Outdated
@@ -271,6 +271,21 @@ func (s *simpleProvider) ValidateContainerSecurityContext(pod *api.Pod, containe
allErrs = append(allErrs, field.Invalid(fldPath.Child("privileged"), *privileged, "Privileged containers are not allowed"))
}

procMount := sc.ProcMount()
allowedProcMounts := s.psp.Spec.AllowedProcMountTypes
if allowedProcMounts == nil {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check for empty as well? (in addition to nil)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So a length check against 0 would catch both.

@dims
Copy link
Member

dims commented May 24, 2018

@jessfraz we need a Feature for this right? (entry in kube_features.go)

@jessfraz
Copy link
Contributor Author

Oh thanks for reminding me I'll do that

AkihiroSuda
AkihiroSuda reviewed May 25, 2018
View reviewed changes
pkg/kubelet/apis/cri/runtime/v1alpha2/api.proto
@@ -586,6 +586,12 @@ message LinuxContainerSecurityContext {
// no_new_privs defines if the flag for no_new_privs should be set on the
// container.
bool no_new_privs = 11;
// masked_paths is a slice of paths that should be masked by the container
// runtime, this can be passed directly to the OCI spec.
repeated string masked_paths = 13;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: 13 -> 12?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

run_as_group is 12 its just out of order, it got me on the compile :D

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

y, i scratched my head for a few mins and realized that

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there any guidance for runtimes on how to handle these two fields? containerd/cri@3e4cec8#diff-c656bacd6cb0fe9a7f64814b01256decR358 cri-containerd seems to handle it that way but I believe there must be guidance in the api itself, @Random-Liu @jessfraz

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 31, 2018
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 1, 2018
@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 2, 2018
@dims
Copy link
Member

dims commented Jun 9, 2018

/unassign
/uncc

@jessfraz jessfraz mentioned this pull request Jun 14, 2018
Merged
@jessfraz jessfraz added sig/node Categorizes an issue or PR as relevant to SIG Node. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. labels Jun 14, 2018
@jessfraz jessfraz added this to the v1.12 milestone Jun 14, 2018
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 14, 2018
@jessfraz jessfraz force-pushed the ProcMountType branch 2 times, most recently from ce9482c to 605cddf Compare June 15, 2018 00:01
@jessfraz jessfraz added the kind/feature Categorizes issue or PR as related to a new feature. label Jun 20, 2018
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 31, 2018
@smarterclayton
Copy link
Contributor

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, jessfraz, smarterclayton, tpepper

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 31, 2018
@jessfraz
Copy link
Contributor Author

/test pull-kubernetes-e2e-kops-aws

@k8s-github-robot
Copy link

/test all [submit-queue is verifying that this PR is safe to merge]

@jessfraz
Copy link
Contributor Author

/test pull-kubernetes-e2e-kops-aws

@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 64283, 67910, 67803, 68100). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

@k8s-github-robot k8s-github-robot merged commit 39004e8 into kubernetes:master Aug 31, 2018
@jessfraz jessfraz deleted the ProcMountType branch August 31, 2018 23:49
@derekwaynecarr
Copy link
Member

Can someone confirm this does not break support for docker 1.13?

@annismckenzie
Copy link

It doesn't – as long as your pod specs don't request/use the feature. According to https://github.com/kubernetes/kubernetes/pull/64283/files#diff-9a9f71a82ddbbcd0627de3aea90c6649R262 it'll be available starting with Docker API version 1.38 (which isn't even in a released version yet – see here). At that point in the code you also see that it'll fail to admit pods that ask for the feature with Docker not being at that version.

@dims
Copy link
Member

dims commented Sep 1, 2018

@derekwaynecarr as i mentioned earlier in this PR - one of the side results of the docker/docker update in this PR is that we switch from docker api version 1.31 to 1.38 if we want to keep the max to the earlier 1.31 docker API version then we need something like:
#66511

@jessfraz
Copy link
Contributor Author

jessfraz commented Sep 2, 2018 via email •
edited

@Random-Liu Random-Liu mentioned this pull request Sep 4, 2018
Closed
@dims dims mentioned this pull request Sep 5, 2018
Closed
@yujuhong
Copy link
Contributor

yujuhong commented Sep 5, 2018

I know the PR is already in, but I'd rather not add more Docker API checking logic in kubelet itself (with dockershim being the exception). Can we move that logic out of kubelet, and just let dockershim return an error when trying to start the pod? The pod will be pending but it's no worse than what this PR currently does IMO.

@k8s-ci-robot
Copy link
Contributor

@jessfraz: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-local-e2e-containerized 1a4cf7a link /test pull-kubernetes-local-e2e-containerized

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@AkihiroSuda AkihiroSuda mentioned this pull request Oct 4, 2018
Merged
AkihiroSuda added a commit to AkihiroSuda/minikube that referenced this pull request Oct 5, 2018
@AkihiroSuda
Upgrade Docker, from 17.12.1-ce to 18.06.1-ce
8edef67 
Docker >= 18.06 is needed for securityContext.procMount (Kubernetes >= 1.12)

See kubernetes/kubernetes#64283 and docker/docker-ce@67fe100

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
@AkihiroSuda AkihiroSuda mentioned this pull request Oct 5, 2018
Merged
@PatrickLang PatrickLang mentioned this pull request Oct 19, 2018
Closed
@dims dims mentioned this pull request Nov 8, 2018
Closed
89 tasks
@liggitt liggitt mentioned this pull request Dec 19, 2018
Merged
@wgliang wgliang mentioned this pull request Dec 22, 2018
Closed
@gaorong gaorong mentioned this pull request Jun 2, 2019
Closed
@jnewland jnewland mentioned this pull request Dec 28, 2019
Open
@geofft geofft mentioned this pull request Apr 14, 2020
Closed
@rptaylor rptaylor mentioned this pull request Mar 6, 2021
Closed
@haircommander haircommander mentioned this pull request Oct 2, 2023
Open
8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@annismckenzie annismckenzie annismckenzie left review comments

@runcom runcom runcom left review comments

@smarterclayton smarterclayton smarterclayton requested changes

@thockin thockin thockin left review comments

@AkihiroSuda AkihiroSuda AkihiroSuda left review comments

@dims dims dims approved these changes

@feiskyer feiskyer feiskyer approved these changes

@tpepper tpepper tpepper approved these changes

@davidopp davidopp Awaiting requested review from davidopp

Assignees

@dims dims

@smarterclayton smarterclayton

@tpepper tpepper

@thockin thockin

@derekwaynecarr derekwaynecarr

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver area/kubelet cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. sig/node Categorizes an issue or PR as relevant to SIG Node. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
v1.12
Development

Successfully merging this pull request may close these issues.

None yet