8000 [Bugfix] Pass SecurityContext Pod Settings for SELinux and Seccomp · arangodb/kube-arangodb@b6b53a6 · GitHub
[go: up one dir, main page]
Skip to content

Commit b6b53a6

Browse files
ajanikowajanikow
committed
[Bugfix] Pass SecurityContext Pod Settings for SELinux and Seccomp
1 parent a4d7331 commit b6b53a6

File tree

5 files changed

+109
-2
lines changed

5 files changed

+109
-2
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
- (Maintenance) Update Go to 1.22.2
2121
- (Feature) Object Checksum
2222
- (Bugfix) Use Rendered Spec in case of scheduling compare
23+
- (Bugfix) Pass SecurityContext Pod Settings for SELinux and Seccomp
2324

2425
## [1.2.39](https://github.com/arangodb/kube-arangodb/tree/1.2.39) (2024-03-11)
2526
- (Feature) Extract Scheduler API

‎pkg/apis/deployment/v1/server_group_security_context_spec.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,15 @@ func (s *ServerGroupSpecSecurityContext) NewPodSecurityContext(secured bool) *co
116116
}
117117
}
118118

119+
if s != nil {
120+
if psc == nil {
121+
psc = &core.PodSecurityContext{}
122+
}
123+
124+
psc.SeccompProfile = s.SeccompProfile.DeepCopy()
125+
psc.SELinuxOptions = s.SELinuxOptions.DeepCopy()
126+
}
127+
119128
if s != nil && len(s.Sysctls) > 0 {
120129
var sysctls []core.Sysctl
121130
for k, v := range s.Sysctls {

‎pkg/apis/deployment/v1/server_group_security_context_spec_test.go

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2016-2023 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2016-2024 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -101,6 +101,28 @@ func TestServerGroupSpecSecurityContext_NewPodSecurityContext(t *testing.T) {
101101
},
102102
},
103103
},
104+
"pass seccompProfile opts": {
105+
sc: &ServerGroupSpecSecurityContext{
106+
SeccompProfile: &core.SeccompProfile{
107+
Type: core.SeccompProfileTypeRuntimeDefault,
108+
},
109+
},
110+
secured: false,
111+
want: &core.PodSecurityContext{
112+
SeccompProfile: &core.SeccompProfile{
113+
Type: core.SeccompProfileTypeRuntimeDefault,
114+
},
115+
},
116+
},
117+
"pass seLinuxOptions opts": {
118+
sc: &ServerGroupSpecSecurityContext{
119+
SELinuxOptions: &core.SELinuxOptions{Type: "test"},
120+
},
121+
secured: false,
122+
want: &core.PodSecurityContext{
123+
SELinuxOptions: &core.SELinuxOptions{Type: "test"},
124+
},
125+
},
104126
}
105127

106128
for testName, testCase := range testCases {
@@ -225,6 +247,28 @@ func TestServerGroupSpecSecurityContext_NewSecurityContext(t *testing.T) {
225247
RunAsUser: util.NewType[int64](3001),
226248
},
227249
},
250+
"pass seccompProfile opts": {
251+
sc: &ServerGroupSpecSecurityContext{
252+
SeccompProfile: &core.SeccompProfile{
253+
Type: core.SeccompProfileTypeRuntimeDefault,
254+
},
255+
},
256+
secured: false,
257+
want: &core.SecurityContext{
258+
SeccompProfile: &core.SeccompProfile{
259+
Type: core.SeccompProfileTypeRuntimeDefault,
260+
},
261+
},
262+
},
263+
"pass seLinuxOptions opts": {
264+
sc: &ServerGroupSpecSecurityContext{
265+
SELinuxOptions: &core.SELinuxOptions{Type: "test"},
266+
},
267+
secured: false,
268+
want: &core.SecurityContext{
269+
SELinuxOptions: &core.SELinuxOptions{Type: "test"},
270+
},
271+
},
228272
}
229273

230274
for testName, testCase := range tests {

‎pkg/apis/deployment/v2alpha1/server_group_security_context_spec.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,15 @@ func (s *ServerGroupSpecSecurityContext) NewPodSecurityContext(secured bool) *co
116116
}
117117
}
118118

119+
if s != nil {
120+
if psc == nil {
121+
psc = &core.PodSecurityContext{}
122+
}
123+
124+
psc.SeccompProfile = s.SeccompProfile.DeepCopy()
125+
psc.SELinuxOptions = s.SELinuxOptions.DeepCopy()
126+
}
127+
119128
if s != nil && len(s.Sysctls) > 0 {
120129
var sysctls []core.Sysctl
121130
for k, v := range s.Sysctls {

‎pkg/apis/deployment/v2alpha1/server_group_security_context_spec_test.go

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2016-2023 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2016-2024 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -101,6 +101,28 @@ func TestServerGroupSpecSecurityContext_NewPodSecurityContext(t *testing.T) {
101101
},
102102
},
103103
},
104+
"pass seccompProfile opts": {
105+
sc: &ServerGroupSpecSecurityContext{
106+
SeccompProfile: &core.SeccompProfile{
107+
Type: core.SeccompProfileTypeRuntimeDefault,
108+
},
109+
},
110+
secured: false,
111+
want: &core.PodSecurityContext{
112+
SeccompProfile: &core.SeccompProfile{
113+
Type: core.SeccompProfileTypeRuntimeDefault,
114+
},
115+
},
116+
},
117+
"pass seLinuxOptions opts": {
118+
sc: &ServerGroupSpecSecurityContext{
119+
SELinuxOptions: &core.SELinuxOptions{Type: "test"},
120+
},
121+
secured: false,
122+
want: &core.PodSecurityContext{
123+
SELinuxOptions: &core.SELinuxOptions{Type: "test"},
124+
},
125+
},
104126
}
105127

106128
for testName, testCase := range testCases {
@@ -225,6 +247,28 @@ func TestServerGroupSpecSecurityContext_NewSecurityContext(t *testing.T) {
225247
RunAsUser: util.NewType[int64](3001),
226248
},
227249
},
250+
"pass seccompProfile opts": {
251+
sc: &ServerGroupSpecSecurityContext{
252+
SeccompProfile: &core.SeccompProfile{
253+
Type: core.SeccompProfileTypeRuntimeDefault,
254+
},
255+
},
256+
secured: false,
257+
want: &core.SecurityContext{
258+
SeccompProfile: &core.SeccompProfile{
259+
Type: core.SeccompProfileTypeRuntimeDefault,
260+
},
261+
},
262+
},
263+
"pass seLinuxOptions opts": {
264+
sc: &ServerGroupSpecSecurityContext{
265+
SELinuxOptions: &core.SELinuxOptions{Type: "test"},
266+
},
267+
secured: false,
268+
want: &core.SecurityContext{
269+
SELinuxOptions: &core.SELinuxOptions{Type: "test"},
270+
},
271+
},
228272
}
229273

230274
for testName, testCase := range tests {

0 commit comments

Comments
 (0)
0