Add preflight check for seccomp

[KentaTada]

seccomp has already been GA since Kubernetes 1.19.
I think it is essential for the current Kubernetes, but could you give me your opinion if you have any concern about adding the seccomp check?

Signed-off-by: Kenta Tada Kenta.Tada@sony.com

[neolit123]

hi, given we are adding this to "required", do we know if there are any popular distributions used for k8s that have this config explicitly disabled (i.e. the options are missing in the config)?

[KentaTada]

I don't have the list of kernel configs of popular distributions although I have never heard to change the kernel config of seccomp from y to n.
I think some embedded systems may change the default to disable seccomp to reduce the impact of performance.

At first, I thought seccomp was one of requirements in the current Kubernetes.
But SeccompProfile is the optional currently and Kubernetes can launch the container without seccomp at least.
As of now, I think it is ok to change this check from Required to Optional.

[KentaTada]

In addition, the seccomp e2e test is not included in the conformance check.
I'm sorry I should check it at first.

[KentaTada]

I updated this check from Required to Optional.

[neolit123]

Yes, maybe having this as optional is better given the conformance factor. My assumption is similar - some distros may have opted out but not the popular mainline ones. /lgtm /approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: KentaTada, neolit123

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [neolit123]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment