Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

GetBootstrapSecurityContextConstraints: change return type to a slice of pointers #15924

Merged
merged 1 commit into from Aug 28, 2017
Merged

GetBootstrapSecurityContextConstraints: change return type to a slice of pointers #15924

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go
View file
Open in desktop
Expand Up @@ -48,7 +48,7 @@ const (
// GetBootstrapSecurityContextConstraints returns the slice of default SecurityContextConstraints
// for system bootstrapping. This method takes additional users and groups that should be added
// to the strategies. Use GetBoostrapSCCAccess to produce the default set of mappings.
func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string][]string, sccNameToAdditionalUsers map[string][]string) []securityapi.SecurityContextConstraints {
func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string][]string, sccNameToAdditionalUsers map[string][]string) []*securityapi.SecurityContextConstraints {
// define priorities here and reference them below so it is easy to see, at a glance
// what we're setting
var (
Expand All @@ -57,7 +57,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
securityContextConstraintsAnyUIDPriority = int32(10)
)

constraints := []securityapi.SecurityContextConstraints{
constraints := []*securityapi.SecurityContextConstraints{
// SecurityContextConstraintPrivileged allows all access for every field
{
ObjectMeta: metav1.ObjectMeta{
Expand Down
2 changes: 1 addition & 1 deletion pkg/cmd/server/bootstrappolicy/securitycontextconstraints_test.go
View file
Open in desktop
Expand Up @@ -42,7 +42,7 @@ func TestBootstrappedConstraints(t *testing.T) {
}

for _, expectedVolume := range expectedVolumes {
if !sccutil.SCCAllowsFSType(&constraint, expectedVolume) {
if !sccutil.SCCAllowsFSType(constraint, expectedVolume) {
t.Errorf("%s does not support %v which is required for all default SCCs", constraint.Name, expectedVolume)
}
}
Expand Down
2 changes: 1 addition & 1 deletion pkg/cmd/server/origin/openshift_apiserver.go
View file
Open in desktop
Expand Up @@ -475,7 +475,7 @@ func (c *OpenshiftAPIConfig) bootstrapSCC(context genericapiserver.PostStartHook
bootstrapSCCGroups, bootstrapSCCUsers := bootstrappolicy.GetBoostrapSCCAccess(ns)

for _, scc := range bootstrappolicy.GetBootstrapSecurityContextConstraints(bootstrapSCCGroups, bootstrapSCCUsers) {
_, err := legacyclient.NewFromClient(c.KubeClientInternal.Core().RESTClient()).Create(&scc)
_, err := legacyclient.NewFromClient(c.KubeClientInternal.Core().RESTClient()).Create(scc)
if kapierror.IsAlreadyExists(err) {
continue
}
Expand Down
3 changes: 1 addition & 2 deletions pkg/oc/admin/policy/reconcile_sccs.go
View file
Open in desktop
Expand Up @@ -177,8 +177,7 @@ func (o *ReconcileSCCOptions) ChangedSCCs() ([]*securityapi.SecurityContextConst
groups, users := bootstrappolicy.GetBoostrapSCCAccess(o.InfraNamespace)
bootstrapSCCs := bootstrappolicy.GetBootstrapSecurityContextConstraints(groups, users)

for i := range bootstrapSCCs {
expectedSCC := &bootstrapSCCs[i]
for _, expectedSCC := range bootstrapSCCs {
actualSCC, err := o.SCCClient.Get(expectedSCC.Name, metav1.GetOptions{})
// if not found it needs to be created
if kapierrors.IsNotFound(err) {
Expand Down