Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Only drop capabilities that are not added #3972

Merged
merged 3 commits into from
Sep 25, 2024
Merged

Only drop capabilities that are not added #3972

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d659eae
Only drop capabilities that are not added
nemacysts Sep 25, 2024
849179d
Update security context tests
nemacysts Sep 25, 2024
5fa4cd1
this is definitely containerd
nemacysts Sep 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion paasta_tools/kubernetes_tools.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1396,7 +1396,16 @@ def get_security_context(self) -> Optional[V1SecurityContext]:
return V1SecurityContext(capabilities=V1Capabilities(drop=CAPS_DROP))
else:
return V1SecurityContext(
capabilities=V1Capabilities(add=cap_add, drop=CAPS_DROP)
# XXX: we should probably generally work in sets, but V1Capabilities is typed as accepting
# lists of string only
capabilities=V1Capabilities(
add=cap_add,
# NOTE: this is necessary as containerd differs in behavior from dockershim: in dockershim
# dropped capabilities were overriden if the same capability was added - but in containerd
# the dropped capabilities appear to have higher priority.
# (or maybe this is a k8s behavior change?)
drop=list(set(CAPS_DROP) - set(cap_add)),
)
)

def get_kubernetes_containers(
Expand Down
3 changes: 2 additions & 1 deletion tests/test_kubernetes_tools.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1067,8 +1067,9 @@ def test_get_security_context_without_cap_add(self):

def test_get_security_context_with_cap_add(self):
self.deployment.config_dict["cap_add"] = ["SETGID"]
expected_dropped_caps = list(set(CAPS_DROP) - {"SETGID"})
expected_security_context = V1SecurityContext(
capabilities=V1Capabilities(add=["SETGID"], drop=CAPS_DROP)
capabilities=V1Capabilities(add=["SETGID"], drop=expected_dropped_caps)
)
assert self.deployment.get_security_context() == expected_security_context

Expand Down
Loading