Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add AppArmor feature gate #31473

Merged
merged 1 commit into from
Aug 27, 2016
Merged

Add AppArmor feature gate #31473

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
9 changes: 7 additions & 2 deletions pkg/api/validation/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ import (
"k8s.io/kubernetes/pkg/capabilities"
"k8s.io/kubernetes/pkg/labels"
"k8s.io/kubernetes/pkg/security/apparmor"
utilconfig "k8s.io/kubernetes/pkg/util/config"
"k8s.io/kubernetes/pkg/util/intstr"
"k8s.io/kubernetes/pkg/util/sets"
"k8s.io/kubernetes/pkg/util/validation"
Expand Down Expand Up @@ -2119,13 +2120,17 @@ func ValidateAppArmorPodAnnotations(annotations map[string]string, spec *api.Pod
if !strings.HasPrefix(k, apparmor.ContainerAnnotationKeyPrefix) {
continue
}
if !utilconfig.DefaultFeatureGate.AppArmor() {
allErrs = append(allErrs, field.Forbidden(fldPath.Key(k), "AppArmor is disabled by feature-gate"))
continue
}
containerName := strings.TrimPrefix(k, apparmor.ContainerAnnotationKeyPrefix)
if !podSpecHasContainer(spec, containerName) {
allErrs = append(allErrs, field.Invalid(fldPath.Child(k), containerName, "container not found"))
allErrs = append(allErrs, field.Invalid(fldPath.Key(k), containerName, "container not found"))
}

if err := apparmor.ValidateProfileFormat(p); err != nil {
allErrs = append(allErrs, field.Invalid(fldPath.Child(k), p, err.Error()))
allErrs = append(allErrs, field.Invalid(fldPath.Key(k), p, err.Error()))
}
}

Expand Down
8 changes: 7 additions & 1 deletion pkg/security/apparmor/validate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ import (

"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/util"
utilconfig "k8s.io/kubernetes/pkg/util/config"
)

// Whether AppArmor should be disabled by default.
Expand Down Expand Up @@ -88,9 +89,14 @@ func (v *validator) Validate(pod *api.Pod) error {

// Verify that the host and runtime is capable of enforcing AppArmor profiles.
func validateHost(runtime string) error {
// Check feature-gates
if !utilconfig.DefaultFeatureGate.AppArmor() {
return errors.New("AppArmor disabled by feature-gate")
}

// Check build support.
if isDisabledBuild {
return errors.New("Binary not compiled for linux.")
return errors.New("Binary not compiled for linux")
}

// Check kernel support.
Expand Down
12 changes: 11 additions & 1 deletion pkg/util/config/feature_gate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,9 +39,9 @@ const (
// AllAlpha=true,NewFeature=false will result in newFeature=false
allAlphaGate = "AllAlpha"
externalTrafficLocalOnly = "AllowExtTrafficLocalEndpoints"
appArmor = "AppArmor"
dynamicKubeletConfig = "DynamicKubeletConfig"
dynamicVolumeProvisioning = "DynamicVolumeProvisioning"
// TODO: Define gate/accessor for AppArmor
)

var (
Expand All @@ -50,6 +50,7 @@ var (
knownFeatures = map[string]featureSpec{
allAlphaGate: {false, alpha},
externalTrafficLocalOnly: {false, alpha},
appArmor: {true, alpha},
dynamicKubeletConfig: {false, alpha},
dynamicVolumeProvisioning: {true, alpha},
}
Expand Down Expand Up @@ -91,6 +92,10 @@ type FeatureGate interface {
// // alpha: v1.4
// MyFeature() bool

// owner: @timstclair
// alpha: v1.4
AppArmor() bool

// owner: @girishkalele
// alpha: v1.4
ExternalTrafficLocalOnly() bool
Expand Down Expand Up @@ -175,6 +180,11 @@ func (f *featureGate) ExternalTrafficLocalOnly() bool {
return f.lookup(externalTrafficLocalOnly)
}

// AppArmor returns the value for the AppArmor feature gate.
func (f *featureGate) AppArmor() bool {
return f.lookup(appArmor)
}

// DynamicKubeletConfig returns value for dynamicKubeletConfig
func (f *featureGate) DynamicKubeletConfig() bool {
return f.lookup(dynamicKubeletConfig)
Expand Down