opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-27 05:21:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix security-opt generate kube

Browse Source 
fix #4950
add selinux options from --security-opt of the container to generate kube result

Signed-off-by: Qi Wang <qiwan@redhat.com>
This commit is contained in:
Qi Wang
2020-02-21 17:59:56 -05:00
parent 47c4ea3919
commit 17bab33bd2
2 changed files with 65 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
libpod/kube.go
View File

@ -468,11 +468,26 @@ func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, error) {
return nil, err
}
var selinuxOpts v1.SELinuxOptions
opts := strings.SplitN(c.config.Spec.Annotations[InspectAnnotationLabel], ":", 2)
if len(opts) == 2 {
switch opts[0] {
case "type":
selinuxOpts.Type = opts[1]
case "level":
selinuxOpts.Level = opts[1]
}
}
if len(opts) == 1 {
if opts[0] == "disable" {
selinuxOpts.Type = "spc_t"
}
}
sc := v1.SecurityContext{
Capabilities: newCaps,
Privileged: &priv,
// TODO How do we know if selinux were passed into podman
//SELinuxOptions:
Capabilities: newCaps,
Privileged: &priv,
SELinuxOptions: &selinuxOpts,
// RunAsNonRoot is an optional parameter; our first implementations should be root only; however
// I'm leaving this as a bread-crumb for later
//RunAsNonRoot: &nonRoot,

47
test/e2e/generate_kube_test.go
View File

@ -10,7 +10,7 @@ import (
"github.com/ghodss/yaml"
. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
"k8s.io/api/core/v1"
v1 "k8s.io/api/core/v1"
)
var _ = Describe("Podman generate kube", func() {
@ -69,6 +69,51 @@ var _ = Describe("Podman generate kube", func() {
Expect(numContainers).To(Equal(1))
})
It("podman generate service kube on container with --security-opt level", func() {
session := podmanTest.Podman([]string{"create", "--name", "test", "--security-opt", "label=level:s0:c100,c200", "alpine"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
kube := podmanTest.Podman([]string{"generate", "kube", "test"})
kube.WaitWithDefaultTimeout()
Expect(kube.ExitCode()).To(Equal(0))
pod := new(v1.Pod)
err := yaml.Unmarshal(kube.Out.Contents(), pod)
Expect(err).To(BeNil())
Expect(kube.OutputToString()).To(ContainSubstring("level: s0:c100,c200"))
})
It("podman generate service kube on container with --security-opt disable", func() {
session := podmanTest.Podman([]string{"create", "--name", "test-disable", "--security-opt", "label=disable", "alpine"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
kube := podmanTest.Podman([]string{"generate", "kube", "test-disable"})
kube.WaitWithDefaultTimeout()
Expect(kube.ExitCode()).To(Equal(0))
pod := new(v1.Pod)
err = yaml.Unmarshal(kube.Out.Contents(), pod)
Expect(err).To(BeNil())
Expect(kube.OutputToString()).To(ContainSubstring("type: spc_t"))
})
It("podman generate service kube on container with --security-opt type", func() {
session := podmanTest.Podman([]string{"create", "--name", "test", "--security-opt", "label=type:foo_bar_t", "alpine"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
kube := podmanTest.Podman([]string{"generate", "kube", "test"})
kube.WaitWithDefaultTimeout()
Expect(kube.ExitCode()).To(Equal(0))
pod := new(v1.Pod)
err = yaml.Unmarshal(kube.Out.Contents(), pod)
Expect(err).To(BeNil())
Expect(kube.OutputToString()).To(ContainSubstring("type: foo_bar_t"))
})
It("podman generate service kube on container", func() {
session := podmanTest.RunTopContainer("top")
session.WaitWithDefaultTimeout()