Add "MayRunAs" value among other GroupStrategies #65135

stlaz · 2018-06-15T11:31:53Z

What this PR does / why we need it:
Adds "MayRunAs" value among other group strategies. This strategy
allows to define a certain range of GIDs for FSGroupStrategy and
SupplementalGroupStrategy in a PSP.

This new strategy works similarly to the "MustRunAs" one, except that
when no GID is specified in a pod/container security context then no
GID is generated for the respective containers.

Which issue(s) this PR fixes
Resolves #56173

Release note:

PodSecurityPolicy objects now support a `MayRunAs` rule for `fsGroup` and `supplementalGroups` options. This allows specifying ranges of allowed GIDs for pods/containers without forcing a default GID the way `MustRunAs` does. This means that a container to which such a policy applies to won't use any fsGroup/supplementalGroup GID if not explicitly specified, yet a specified GID must still fall in the GID range according to the policy.

php-coder · 2018-06-15T12:30:26Z

/sig auth
/ok-to-test

PTAL @kubernetes/sig-auth-api-reviews

CC @simo5

php-coder · 2018-06-15T12:37:03Z

pkg/security/podsecuritypolicy/group/mayrunas.go

+
+var _ GroupStrategy = &mayRunAs{}
+
+// NewRunAsAny provides a new RunAsAny strategy.


Please, update the comment.

php-coder · 2018-06-15T12:37:26Z

pkg/security/podsecuritypolicy/group/mayrunas.go

+// NewRunAsAny provides a new RunAsAny strategy.
+func NewMayRunAs(ranges []policy.IDRange, field string) (GroupStrategy, error) {
+	if len(ranges) == 0 {
+		return nil, fmt.Errorf("ranges must be supplied for MustRunAs")


s/MustRunAs/MayRunAs/

php-coder · 2018-06-15T12:41:12Z

pkg/apis/policy/types.go

@@ -389,6 +392,9 @@ type SupplementalGroupsStrategyOptions struct {
 type SupplementalGroupsStrategyType string

 const (
+	// SupplementalGroupsStrategyMayRunAs means that container does not need to run as a particular gid.


s/to run as a particular gid/to run with particular gids/ ?

It was but a mere copy-paste but "with" sounds definitely better

php-coder · 2018-06-15T12:41:57Z

pkg/apis/policy/types.go

@@ -389,6 +392,9 @@ type SupplementalGroupsStrategyOptions struct {
 type SupplementalGroupsStrategyType string

 const (
+	// SupplementalGroupsStrategyMayRunAs means that container does not need to run as a particular gid.
+	// However, when it is applied, it has to fall in the defined range.


s/when it is applied, it has to/when they are specified, they have to/ ?

php-coder · 2018-06-15T12:43:41Z

@stlaz One more place to update:

kubernetes/pkg/apis/policy/fuzzer/fuzzer.go

Lines 49 to 58 in 3abba25

    
           supplementalGroupsRules := []policy.SupplementalGroupsStrategyType{ 
        
           	policy.SupplementalGroupsStrategyRunAsAny, 
        
           	policy.SupplementalGroupsStrategyMustRunAs, 
        
           } 
        
           psp.SupplementalGroups.Rule = supplementalGroupsRules[c.Rand.Intn(len(supplementalGroupsRules))] 
        
           fsGroupRules := []policy.FSGroupStrategyType{ 
        
           	policy.FSGroupStrategyMustRunAs, 
        
           	policy.FSGroupStrategyRunAsAny, 
        
           }

php-coder · 2018-06-15T12:44:44Z

@kubernetes/sig-auth-api-reviews Do we need to update PSP in extensions API group?

php-coder · 2018-06-15T12:51:05Z

/assign @tallclair

stlaz · 2018-06-15T14:17:58Z

Updated the patch to fix verify-basel failure and to address the PR comments.

stlaz · 2018-06-18T12:40:34Z

This change introduces backward incompatibility since the "MayRunAs" value to the groups is unknown to previous API versions. If we convert this to "MustRunAs" internally, we wouldn't be able to later get the information that it's actually "MayRunAs".
What would be the preferred way to handle such an issue? Is the rollback desirable here? Does @tallclair have an input on this?

krmayankk · 2018-06-20T06:53:17Z

@tallclair @php-coder i believe the MayRunAs would also be needed by RunAsGroup field. I will include that in the PSP changes for RunAsGroup in my next PR.

php-coder · 2018-06-26T15:47:04Z

PTAL @tallclair

tallclair

This change introduces backward incompatibility since the "MayRunAs" value to the groups is unknown to previous API versions.

Backwards incompatibility means that a resource that was valid in a previous version is no longer valid (or behaves differently), which isn't the case here. What you're refering to is forwards compatibility, and that's not something Kubernetes provides, so this is a non-issue.

tallclair · 2018-07-04T00:23:03Z

pkg/security/podsecuritypolicy/group/mayrunas.go

+func (s *mayRunAs) Validate(_ *api.Pod, groups []int64) field.ErrorList {
+	allErrs := field.ErrorList{}
+
+	for _, group := range groups {


dedupe this code with mustRunAs.Validate (extract a shared helper)

tallclair · 2018-07-04T00:27:11Z

pkg/security/podsecuritypolicy/group/mayrunas_test.go

+	}
+}
+
+func TestMayRunAsGenerate(t *testing.T) {


This method is constant, don't bother testing it here. Instead, add a couple cases under https://github.com/kubernetes/kubernetes/blob/master/pkg/security/podsecuritypolicy/provider_test.go to ensure that the nil return works as expected.

stlaz · 2018-09-06T12:56:21Z

/retest

stlaz · 2018-09-06T12:57:33Z

The "fall in all groups" issue should now be resolved, a positive multi-ranges test was added on top of the mayrunas tests.

liggitt · 2018-09-06T20:03:25Z

thanks. both tallclair and I are out of the office at the moment, but will pick this up when master reopens for 1.13.

stlaz · 2018-09-07T06:49:53Z

Thank you. I'm not sure exactly why the verify test does not pass since make verify seems to be running fine on my system. The only guess I have was my upgrade of golang from 1.10 to 1.11 🤔

stlaz · 2018-09-14T07:04:30Z

/retest

pkg/security/podsecuritypolicy/group/mayrunas_test.go

stlaz · 2018-09-25T08:21:40Z

@tallclair Test cases for multiple groups added.

tallclair

A couple nits, but LGTM. Please squash.

tallclair · 2018-09-26T21:15:39Z

pkg/security/podsecuritypolicy/group/helpers.go

+)
+
+func ValidateGroupsInRanges(fldPath *field.Path, ranges []policy.IDRange, groups []int64) field.ErrorList {
+	const errFmt = "group %d must be in the ranges: %v"


nit: inline

tallclair · 2018-09-26T21:15:46Z

pkg/security/podsecuritypolicy/group/helpers.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2016 The Kubernetes Authors.


Adds "MayRunAs" value among other group strategies. This strategy allows to define a certain range of GIDs for FSGroupStrategy and SupplementalGroupStrategy in a PSP. This new strategy works similarly to the "MustRunAs" one, except that when no GID is specified in a pod/container security context then no GID is generated for the respective containers. Resolves kubernetes#56173

stlaz · 2018-09-27T10:49:19Z

Comments addressed + squashed.

tallclair · 2018-09-27T21:13:32Z

/lgtm
/hold cancel

liggitt · 2018-09-30T01:21:06Z

/approve

k8s-ci-robot · 2018-09-30T01:21:14Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, stlaz, tallclair

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~pkg/apis/policy/OWNERS~~ [liggitt]
~~pkg/security/podsecuritypolicy/OWNERS~~ [liggitt,tallclair]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

yue9944882 · 2018-10-11T22:00:47Z

hi folks, why not syncing these new internal definitions to the external repo? i'm afraid currently we can't specify the new strategy w/ client-go. also the "MayRunAs" will be an undefined value when deserialized into external types.

ref: #69704

k8s-ci-robot requested review from enisoc and ericchiang June 15, 2018 11:31

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 15, 2018

k8s-github-robot added the kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API label Jun 15, 2018

k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 15, 2018

php-coder reviewed Jun 15, 2018

View reviewed changes

k8s-ci-robot assigned tallclair Jun 15, 2018

php-coder mentioned this pull request Jun 15, 2018

[PodSecurityPolicy] "MayRunAs" strategies #56173

Closed

stlaz force-pushed the psp_group_mayrunas branch 2 times, most recently from 3d44643 to 5e430d8 Compare June 15, 2018 14:16

stlaz changed the title ~~[WIP] Add "MayRunAs" value among other GroupStrategies~~ Add "MayRunAs" value among other GroupStrategies Jun 18, 2018

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 18, 2018

tallclair reviewed Jul 4, 2018

View reviewed changes

stlaz force-pushed the psp_group_mayrunas branch from 5e430d8 to 698d161 Compare July 17, 2018 13:12

k8s-ci-robot added sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. labels Sep 6, 2018

stlaz force-pushed the psp_group_mayrunas branch 2 times, most recently from fb98885 to 5cb67ba Compare September 6, 2018 11:42

stlaz force-pushed the psp_group_mayrunas branch from 5cb67ba to c946886 Compare September 6, 2018 14:51

k8s-ci-robot added the sig/network Categorizes an issue or PR as relevant to SIG Network. label Sep 6, 2018

stlaz force-pushed the psp_group_mayrunas branch from c946886 to b738d40 Compare September 13, 2018 10:48

tallclair reviewed Sep 20, 2018

View reviewed changes

pkg/security/podsecuritypolicy/group/mayrunas_test.go Show resolved Hide resolved

k8s-ci-robot removed the status/approved-for-milestone label Sep 21, 2018

stlaz force-pushed the psp_group_mayrunas branch from b738d40 to 4ae930c Compare September 25, 2018 08:21

tallclair reviewed Sep 26, 2018

View reviewed changes

tallclair mentioned this pull request Sep 26, 2018

Implement RunAsGroup Strategy in PSP #67802

Merged

stlaz force-pushed the psp_group_mayrunas branch from 4ae930c to a577b50 Compare September 27, 2018 10:48

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Sep 27, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 30, 2018

k8s-ci-robot merged commit 0b3a5cd into kubernetes:master Sep 30, 2018

stlaz mentioned this pull request Apr 1, 2022

REQUEST: New membership for stlaz kubernetes/org#3352

Closed

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add "MayRunAs" value among other GroupStrategies #65135

Add "MayRunAs" value among other GroupStrategies #65135

stlaz commented Jun 15, 2018 •

edited by liggitt

Loading

php-coder commented Jun 15, 2018

php-coder Jun 15, 2018

php-coder Jun 15, 2018

php-coder Jun 15, 2018

stlaz Jun 15, 2018

php-coder Jun 15, 2018

php-coder commented Jun 15, 2018

php-coder commented Jun 15, 2018

php-coder commented Jun 15, 2018

stlaz commented Jun 15, 2018 •

edited

Loading

stlaz commented Jun 18, 2018

krmayankk commented Jun 20, 2018

php-coder commented Jun 26, 2018

tallclair left a comment

tallclair Jul 4, 2018

tallclair Jul 4, 2018

tallclair Jul 17, 2018

stlaz commented Sep 6, 2018

stlaz commented Sep 6, 2018

liggitt commented Sep 6, 2018

stlaz commented Sep 7, 2018

stlaz commented Sep 14, 2018

stlaz commented Sep 25, 2018

tallclair left a comment

tallclair Sep 26, 2018

tallclair Sep 26, 2018

stlaz commented Sep 27, 2018

tallclair commented Sep 27, 2018

liggitt commented Sep 30, 2018

k8s-ci-robot commented Sep 30, 2018

yue9944882 commented Oct 11, 2018 •

edited

Loading


		var _ GroupStrategy = &mayRunAs{}

		// NewRunAsAny provides a new RunAsAny strategy.

Add "MayRunAs" value among other GroupStrategies #65135

Add "MayRunAs" value among other GroupStrategies #65135

Conversation

stlaz commented Jun 15, 2018 • edited by liggitt Loading

php-coder commented Jun 15, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

php-coder commented Jun 15, 2018

php-coder commented Jun 15, 2018

php-coder commented Jun 15, 2018

stlaz commented Jun 15, 2018 • edited Loading

stlaz commented Jun 18, 2018

krmayankk commented Jun 20, 2018

php-coder commented Jun 26, 2018

tallclair left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stlaz commented Sep 6, 2018

stlaz commented Sep 6, 2018

liggitt commented Sep 6, 2018

stlaz commented Sep 7, 2018

stlaz commented Sep 14, 2018

stlaz commented Sep 25, 2018

tallclair left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stlaz commented Sep 27, 2018

tallclair commented Sep 27, 2018

liggitt commented Sep 30, 2018

k8s-ci-robot commented Sep 30, 2018

yue9944882 commented Oct 11, 2018 • edited Loading

stlaz commented Jun 15, 2018 •

edited by liggitt

Loading

stlaz commented Jun 15, 2018 •

edited

Loading

yue9944882 commented Oct 11, 2018 •

edited

Loading