PSP ephemeral volume validation #98918
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
k8s-ci-robot
added
release-note
k8s-ci-robot
added
kind/api-change
pohly
changed the title
k8s-ci-robot
removed
the
do-not-merge/work-in-progress
|
/sig security |
k8s-ci-robot
added
the
sig/security
pohly
referenced
this pull request
Feb 9, 2021
As explained in https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1698-generic-ephemeral-volumes, CSI inline volumes are not suitable for more "normal" kinds of storage systems. For those a new approach is needed: "generic ephemeral inline volumes".
|
This PR may require API review. If so, when the changes are ready, complete the pre-review checklist and request an API review. Status of requested reviews is tracked in the API Review project. |
k8s-ci-robot
added
the
needs-rebase
pohly
force-pushed
the
psp-ephemeral-validation
branch
from
0d20827
to
a8d29d6
Compare
k8s-ci-robot
removed
the
needs-rebase
|
/retest |
|
/label api-review |
k8s-ci-robot
added
the
api-review
liggitt
reviewed
Mar 6, 2021
k8s-ci-robot
added
the
needs-rebase
When introducing the new "generic" volume type for generic ephemeral inline volumes, the storage policy for PodSecurityPolicy objects should have been extended so that this new type is valid only if the generic ephemeral volume feature is enabled or an existing object already has it. Adding the new type to the internal API was also missed.
When the PSP contains some other volume types, generic ephemeral inline volumes must be rejected.
It's not enough to silently drop the volume type if the feature is disabled. Instead, the policy should fail validation, just as it would have if the API server didn't know about the feature at all.
pohly
force-pushed
the
psp-ephemeral-validation
branch
from
521258f
to
fb4b380
Compare
k8s-ci-robot
removed
the
needs-rebase
|
/lgtm |
k8s-ci-robot
added
triage/accepted
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: liggitt, pohly The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind bug
What this PR does / why we need it:
As pointed out in c05c8e9#r46791570 the introduction of the "generic" volume type did not consider that this is an implicit API change for PodSecurityPolicy which must take the feature gate into account.
This gets fixed and one more test case for applying the PSP gets added.
Special notes for your reviewer:
I think the validation itself (pkg/apis/policy/validation/validation.go) does not need to check the feature gate because the new type will already have been dropped depending on the feature gate and the old object (#80568 (comment)).
Does this PR introduce a user-facing change?:
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.: