summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorValentin Rothberg <rothberg@redhat.com>2021-02-09 14:12:06 +0100
committerValentin Rothberg <rothberg@redhat.com>2021-02-09 17:40:35 +0100
commit48c612cf6671c918e8f11e836de8c6172bd73663 (patch)
tree1906c29e6fd41333170311b5af2c542ee0e16de0
parent9da4169e312bb822a0fbae8e18a0eb7c7eff6e64 (diff)
downloadpodman-48c612cf6671c918e8f11e836de8c6172bd73663.tar.gz
podman-48c612cf6671c918e8f11e836de8c6172bd73663.tar.bz2
podman-48c612cf6671c918e8f11e836de8c6172bd73663.zip
generate kube: support --privileged
Do not play with capabilities for privileged containers where all capabilities will be set implicitly. Also, avoid the device check when running privileged since all of /dev/* will be mounted in any case. Fixes: #8897 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
-rw-r--r--libpod/kube.go20
-rw-r--r--test/e2e/generate_kube_test.go35
2 files changed, 48 insertions, 7 deletions
diff --git a/libpod/kube.go b/libpod/kube.go
index f9ead027d..6cb7723c9 100644
--- a/libpod/kube.go
+++ b/libpod/kube.go
@@ -322,7 +322,8 @@ func containerToV1Container(c *Container) (v1.Container, []v1.Volume, *v1.PodDNS
return kubeContainer, kubeVolumes, nil, err
}
- if len(c.config.Spec.Linux.Devices) > 0 {
+ // NOTE: a privileged container mounts all of /dev/*.
+ if !c.Privileged() && len(c.config.Spec.Linux.Devices) > 0 {
// TODO Enable when we can support devices and their names
kubeContainer.VolumeDevices = generateKubeVolumeDeviceFromLinuxDevice(c.Spec().Linux.Devices)
return kubeContainer, kubeVolumes, nil, errors.Wrapf(define.ErrNotImplemented, "linux devices")
@@ -625,13 +626,18 @@ func capAddDrop(caps *specs.LinuxCapabilities) (*v1.Capabilities, error) {
// generateKubeSecurityContext generates a securityContext based on the existing container
func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, error) {
- priv := c.Privileged()
+ privileged := c.Privileged()
ro := c.IsReadOnly()
allowPrivEscalation := !c.config.Spec.Process.NoNewPrivileges
- newCaps, err := capAddDrop(c.config.Spec.Process.Capabilities)
- if err != nil {
- return nil, err
+ var capabilities *v1.Capabilities
+ if !privileged {
+ // Running privileged adds all caps.
+ newCaps, err := capAddDrop(c.config.Spec.Process.Capabilities)
+ if err != nil {
+ return nil, err
+ }
+ capabilities = newCaps
}
var selinuxOpts v1.SELinuxOptions
@@ -651,8 +657,8 @@ func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, error) {
}
sc := v1.SecurityContext{
- Capabilities: newCaps,
- Privileged: &priv,
+ Capabilities: capabilities,
+ Privileged: &privileged,
SELinuxOptions: &selinuxOpts,
// RunAsNonRoot is an optional parameter; our first implementations should be root only; however
// I'm leaving this as a bread-crumb for later
diff --git a/test/e2e/generate_kube_test.go b/test/e2e/generate_kube_test.go
index bcfab0f68..cd949c666 100644
--- a/test/e2e/generate_kube_test.go
+++ b/test/e2e/generate_kube_test.go
@@ -699,4 +699,39 @@ ENTRYPOINT /bin/sleep`
Expect(containers[0].Command).To(Equal([]string{"/bin/sh", "-c", "/bin/sleep"}))
Expect(containers[0].Args).To(Equal([]string{"10s"}))
})
+
+ It("podman generate kube - --privileged container", func() {
+ session := podmanTest.Podman([]string{"create", "--pod", "new:testpod", "--privileged", ALPINE, "ls"})
+ session.WaitWithDefaultTimeout()
+ Expect(session.ExitCode()).To(Equal(0))
+
+ kube := podmanTest.Podman([]string{"generate", "kube", "testpod"})
+ kube.WaitWithDefaultTimeout()
+ Expect(kube.ExitCode()).To(Equal(0))
+
+ // Now make sure that the capabilities aren't set.
+ pod := new(v1.Pod)
+ err := yaml.Unmarshal(kube.Out.Contents(), pod)
+ Expect(err).To(BeNil())
+
+ containers := pod.Spec.Containers
+ Expect(len(containers)).To(Equal(1))
+ Expect(containers[0].SecurityContext.Capabilities).To(BeNil())
+
+ // Now make sure we can also `play` it.
+ kubeFile := filepath.Join(podmanTest.TempDir, "kube.yaml")
+
+ kube = podmanTest.Podman([]string{"generate", "kube", "testpod", "-f", kubeFile})
+ kube.WaitWithDefaultTimeout()
+ Expect(kube.ExitCode()).To(Equal(0))
+
+ // Remove the pod so play can recreate it.
+ kube = podmanTest.Podman([]string{"pod", "rm", "-f", "testpod"})
+ kube.WaitWithDefaultTimeout()
+ Expect(kube.ExitCode()).To(Equal(0))
+
+ kube = podmanTest.Podman([]string{"play", "kube", kubeFile})
+ kube.WaitWithDefaultTimeout()
+ Expect(kube.ExitCode()).To(Equal(0))
+ })
})