Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support finer grained security capabilities #283

Merged
merged 5 commits into from Aug 2, 2019

Conversation

bodom0015
Copy link
Member

@bodom0015 bodom0015 commented May 16, 2019

Problem

We currently only have 2 levels of security: default and privileged. Since Kubernetes supports very fine-grained security features, we should support those individually.

Fixes #266

Approach

Replace privileged boolean on our Spec object with a securityContext field that can be passed directly through to Kubernetes.

NOTE: Since this is an admin-only field, there is no API validation or UI component to this PR.

How to Test

  1. minikube start
  2. docker run --name=etcd -p 4001:4001 -d ndslabs/etcd:2.2.5 /usr/local/bin/etcd \ --bind-addr=0.0.0.0:4001 \ --advertise-client-urls=http://127.0.0.1:4001
  3. Configure apiserver.json to point to minikube and etcd
  4. Checkout, build branch locally, then run: ./build.sh local && ./build/bin/apiserver-darwin-amd64
  5. Use Postman to login as the admin, change log level to 4, create a user, verify the email address, and approve the account
  6. Use Postman to add the full.json spec to the catalog
  7. Use Postman to create a stack from the fulltest spec
  8. Use Postman to trigger StartStack on the stack you just created
  9. Check the log output of the API server
    • You should see the full template of the stack that is being created
    • You should see securityContext listed under your container (not the pod itself)
  10. Verify with kubectl get pods -n <user> -o yaml
    • You should see securityContext listed under your container (not the pod itself)

NOTE: On second thought, I should probably add a new set of Postman tests for the security

@bodom0015 bodom0015 changed the base branch from master to develop May 16, 2019 22:27
@bodom0015 bodom0015 force-pushed the finer-grained-security-capabilities branch from 1b4d8d3 to 7fd0984 Compare May 16, 2019 22:31
@bodom0015 bodom0015 force-pushed the finer-grained-security-capabilities branch from 9a054d6 to 7ff04e0 Compare May 22, 2019 21:45
@craig-willis craig-willis merged commit 2df8abd into develop Aug 2, 2019
@craig-willis craig-willis deleted the finer-grained-security-capabilities branch August 2, 2019 14:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants