Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[podsecurity] Dedupe overlapping forbidden messages #107117

Closed
wants to merge 1 commit into from
Closed

[podsecurity] Dedupe overlapping forbidden messages #107117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 3 additions & 2 deletions staging/src/k8s.io/pod-security-admission/policy/check_capabilities_baseline.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,9 @@ func init() {
// that limits the capabilities that can be added in 1.0+
func CheckCapabilitiesBaseline() Check {
return Check{
ID: "capabilities_baseline",
Level: api.LevelBaseline,
ID: "capabilities_baseline",
Level: api.LevelBaseline,
Overlap: true,
Versions: []VersionedCheck{
{
MinimumVersion: api.MajorMinorVersion(1, 0),
Expand Down
5 changes: 3 additions & 2 deletions staging/src/k8s.io/pod-security-admission/policy/check_hostPathVolumes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,9 @@ func init() {
// that requires hostPath=undefined/null in 1.0+
func CheckHostPathVolumes() Check {
return Check{
ID: "hostPathVolumes",
Level: api.LevelBaseline,
ID: "hostPathVolumes",
Level: api.LevelBaseline,
Overlap: true,
Versions: []VersionedCheck{
{
MinimumVersion: api.MajorMinorVersion(1, 0),
Expand Down
5 changes: 3 additions & 2 deletions staging/src/k8s.io/pod-security-admission/policy/check_seccompProfile_baseline.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,9 @@ func init() {

func CheckSeccompBaseline() Check {
return Check{
ID: "seccompProfile_baseline",
Level: api.LevelBaseline,
ID: "seccompProfile_baseline",
Level: api.LevelBaseline,
Overlap: true,
Versions: []VersionedCheck{
{
MinimumVersion: api.MajorMinorVersion(1, 0),
Expand Down
2 changes: 2 additions & 0 deletions staging/src/k8s.io/pod-security-admission/policy/checks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ type Check struct {
// Baseline checks are evaluated for baseline and restricted namespaces.
// Restricted checks are only evaluated for restricted namespaces.
Level api.Level
// Overlap indicates whether the check is overlapping with the check one level higher than oneself.
Overlap bool
// Versions contains one or more revisions of the check that apply to different versions.
// If the check is not yet assigned to a version, this must be a single-item list with a MinimumVersion of "".
// Otherwise, MinimumVersion of items must represent strictly increasing versions.
Expand Down
12 changes: 9 additions & 3 deletions staging/src/k8s.io/pod-security-admission/policy/registry.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ type Evaluator interface {
// checkRegistry provides a default implementation of an Evaluator.
type checkRegistry struct {
// The checks are a map of check_ID -> sorted slice of versioned checks, newest first
baselineChecks, restrictedChecks map[api.Version][]CheckPodFn
baselineChecks, overlappingBaselineChecks, restrictedChecks map[api.Version][]CheckPodFn
// maxVersion is the maximum version that is cached, guaranteed to be at least
// the max MinimumVersion of all registered checks.
maxVersion api.Version
Expand All @@ -50,8 +50,9 @@ func NewEvaluator(checks []Check) (Evaluator, error) {
return nil, err
}
r := &checkRegistry{
baselineChecks: map[api.Version][]CheckPodFn{},
restrictedChecks: map[api.Version][]CheckPodFn{},
baselineChecks: map[api.Version][]CheckPodFn{},
overlappingBaselineChecks: map[api.Version][]CheckPodFn{},
restrictedChecks: map[api.Version][]CheckPodFn{},
}
populate(r, checks)
return r, nil
Expand All @@ -69,6 +70,9 @@ func (r *checkRegistry) EvaluatePod(lv api.LevelVersion, podMetadata *metav1.Obj
results = append(results, check(podMetadata, podSpec))
}
if lv.Level == api.LevelBaseline {
for _, check := range r.overlappingBaselineChecks[lv.Version] {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

marking checks as overlapping and skipping them without positive verification that the specific check they overlap with is also getting run makes me slightly nervous

the integration test failures are related, and make it seem like some expected checks aren't getting run

results = append(results, check(podMetadata, podSpec))
}
return results
}
for _, check := range r.restrictedChecks[lv.Version] {
Expand Down Expand Up @@ -122,6 +126,8 @@ func populate(r *checkRegistry, validChecks []Check) {
for _, c := range validChecks {
if c.Level == api.LevelRestricted {
inflateVersions(c, r.restrictedChecks, r.maxVersion)
} else if c.Overlap {
inflateVersions(c, r.overlappingBaselineChecks, r.maxVersion)
} else {
inflateVersions(c, r.baselineChecks, r.maxVersion)
}
Expand Down
22 changes: 12 additions & 10 deletions staging/src/k8s.io/pod-security-admission/policy/registry_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,13 @@ import (

func TestCheckRegistry(t *testing.T) {
checks := []Check{
generateCheck("a", api.LevelBaseline, []string{"v1.0"}),
generateCheck("b", api.LevelBaseline, []string{"v1.10"}),
generateCheck("c", api.LevelBaseline, []string{"v1.0", "v1.5", "v1.10"}),
generateCheck("d", api.LevelBaseline, []string{"v1.11", "v1.15", "v1.20"}),
generateCheck("e", api.LevelRestricted, []string{"v1.0"}),
generateCheck("f", api.LevelRestricted, []string{"v1.12", "v1.16", "v1.21"}),
generateCheck("a", api.LevelBaseline, false, []string{"v1.0"}),
generateCheck("b", api.LevelBaseline, false, []string{"v1.10"}),
generateCheck("c", api.LevelBaseline, false, []string{"v1.0", "v1.5", "v1.10"}),
generateCheck("d", api.LevelBaseline, false, []string{"v1.11", "v1.15", "v1.20"}),
generateCheck("e", api.LevelRestricted, false, []string{"v1.0"}),
generateCheck("f", api.LevelRestricted, false, []string{"v1.12", "v1.16", "v1.21"}),
generateCheck("g", api.LevelBaseline, true, []string{"v1.15"}),
}

reg, err := NewEvaluator(checks)
Expand All @@ -52,7 +53,7 @@ func TestCheckRegistry(t *testing.T) {
{api.LevelBaseline, "v1.5", []string{"a:v1.0", "c:v1.5"}},
{api.LevelBaseline, "v1.10", []string{"a:v1.0", "b:v1.10", "c:v1.10"}},
{api.LevelBaseline, "v1.11", []string{"a:v1.0", "b:v1.10", "c:v1.10", "d:v1.11"}},
{api.LevelBaseline, "latest", []string{"a:v1.0", "b:v1.10", "c:v1.10", "d:v1.20"}},
{api.LevelBaseline, "latest", []string{"a:v1.0", "b:v1.10", "c:v1.10", "g:v1.15", "d:v1.20"}},
{api.LevelRestricted, "v1.0", []string{"a:v1.0", "c:v1.0", "e:v1.0"}},
{api.LevelRestricted, "v1.4", []string{"a:v1.0", "c:v1.0", "e:v1.0"}},
{api.LevelRestricted, "v1.5", []string{"a:v1.0", "c:v1.5", "e:v1.0"}},
Expand All @@ -75,10 +76,11 @@ func TestCheckRegistry(t *testing.T) {
}
}

func generateCheck(id string, level api.Level, versions []string) Check {
func generateCheck(id string, level api.Level, overlap bool, versions []string) Check {
c := Check{
ID: id,
Level: level,
ID: id,
Level: level,
Overlap: overlap,
}
for _, ver := range versions {
v := versionOrPanic(ver) // Copy ver so it can be used in the CheckPod closure.
Expand Down