mirror of
https://github.com/containers/podman.git
synced 2025-06-20 17:13:43 +08:00
Kube like pods should share ipc,net,uts by default
Signed-off-by: flouthoc <flouthoc.git@gmail.com>
This commit is contained in:
@ -23,6 +23,10 @@ func ToPodGen(ctx context.Context, podName string, podYAML *v1.PodTemplateSpec)
|
||||
p := specgen.NewPodSpecGenerator()
|
||||
p.Name = podName
|
||||
p.Labels = podYAML.ObjectMeta.Labels
|
||||
// Kube pods must share {ipc, net, uts} by default
|
||||
p.SharedNamespaces = append(p.SharedNamespaces, "ipc")
|
||||
p.SharedNamespaces = append(p.SharedNamespaces, "net")
|
||||
p.SharedNamespaces = append(p.SharedNamespaces, "uts")
|
||||
// TODO we only configure Process namespace. We also need to account for Host{IPC,Network,PID}
|
||||
// which is not currently possible with pod create
|
||||
if podYAML.Spec.ShareProcessNamespace != nil && *podYAML.Spec.ShareProcessNamespace {
|
||||
|
@ -28,6 +28,44 @@ metadata:
|
||||
spec:
|
||||
hostname: unknown
|
||||
`
|
||||
var sharedNamespacePodYaml = `
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
creationTimestamp: "2021-05-07T17:25:01Z"
|
||||
labels:
|
||||
app: testpod1
|
||||
name: testpod1
|
||||
spec:
|
||||
containers:
|
||||
- command:
|
||||
- top
|
||||
- -d
|
||||
- "1.5"
|
||||
env:
|
||||
- name: PATH
|
||||
value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
- name: TERM
|
||||
value: xterm
|
||||
- name: container
|
||||
value: podman
|
||||
- name: HOSTNAME
|
||||
value: label-pod
|
||||
image: quay.io/libpod/alpine:latest
|
||||
name: alpine
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities: {}
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
seLinuxOptions: {}
|
||||
workingDir: /
|
||||
dnsConfig: {}
|
||||
restartPolicy: Never
|
||||
shareProcessNamespace: true
|
||||
status: {}
|
||||
`
|
||||
|
||||
var selinuxLabelPodYaml = `
|
||||
apiVersion: v1
|
||||
@ -1004,6 +1042,24 @@ var _ = Describe("Podman play kube", func() {
|
||||
Expect(label).To(ContainSubstring("unconfined_u:system_r:spc_t:s0"))
|
||||
})
|
||||
|
||||
It("podman play kube should share ipc,net,uts when shareProcessNamespace is set", func() {
|
||||
SkipIfRootless("Requires root priviledges for sharing few namespaces")
|
||||
err := writeYaml(sharedNamespacePodYaml, kubeYaml)
|
||||
Expect(err).To(BeNil())
|
||||
|
||||
kube := podmanTest.Podman([]string{"play", "kube", kubeYaml})
|
||||
kube.WaitWithDefaultTimeout()
|
||||
Expect(kube.ExitCode()).To(Equal(0))
|
||||
|
||||
inspect := podmanTest.Podman([]string{"inspect", "testpod1", "--format", "'{{ .SharedNamespaces }}'"})
|
||||
inspect.WaitWithDefaultTimeout()
|
||||
sharednamespaces := inspect.OutputToString()
|
||||
Expect(sharednamespaces).To(ContainSubstring("ipc"))
|
||||
Expect(sharednamespaces).To(ContainSubstring("net"))
|
||||
Expect(sharednamespaces).To(ContainSubstring("uts"))
|
||||
Expect(sharednamespaces).To(ContainSubstring("pid"))
|
||||
})
|
||||
|
||||
It("podman play kube fail with nonexistent authfile", func() {
|
||||
err := generateKubeYaml("pod", getPod(), kubeYaml)
|
||||
Expect(err).To(BeNil())
|
||||
|
Reference in New Issue
Block a user