Add seccomp default feature blog post #28951

saschagrunert · 2021-07-15T07:58:41Z

This adds the blog post about the new Kubernetes SeccompDefault alpha feature.

/hold
cc @PI-Victor @pmmalinov01 @ashnehete @carlisia @chrisnegus @ritpanjw

Todo

Adjust publishing date

netlify · 2021-07-15T08:15:47Z

✔️ Deploy Preview for kubernetes-io-main-staging ready!

🔨 Explore the source changes: 84e472e

🔍 Inspect the deploy log: https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/61249698af684100079246d8

😎 Browse the preview: https://deploy-preview-28951--kubernetes-io-main-staging.netlify.app

sftim

This looks like a thorough explanation.

Here's some feedback on the article.

content/en/blog/2021-08-15-seccomp-default.md

sftim · 2021-07-28T17:45:28Z

Looks good to review and I don't see a need for a hold (the article is future dated, to a date after the scheduled release).

/hold cancel

sftim · 2021-07-28T17:45:51Z

Any more feedback or is this OK for LGTM?

PI-Victor · 2021-07-28T18:26:19Z

i gave this a read way back, LGTM from my side

content/en/blog/_posts/2021-08-20-seccomp-default.md

sftim

Hi. Here's some feedback. It's fine to ship this without addressing the style nits I'm mentioning in this review.

content/en/blog/_posts/2021-08-20-seccomp-default.md

saschagrunert · 2021-08-02T08:41:39Z

Hi. Here's some feedback. It's fine to ship this without addressing the style nits I'm mentioning in this review.

Thank you! I addressed all of the review comments.

saschagrunert · 2021-08-20T10:36:29Z

/hold

Publication is due tomorrow and reviews are not yet in place.

If this article goes past the publication date, we should pick a new date, update the article to match that, check all is good, and then remove this hold.

From my point of view the open discussion point has been resolved. Are we good to merge?

sftim · 2021-08-20T10:39:59Z

@saschagrunert can you point to a signoff that confirms what this PR is saying is technically correct? If that were available, I'd be happy to approve it right away.

sftim · 2021-08-20T10:40:54Z

@PushkarJ are you willing to add /lgtm here?

saschagrunert · 2021-08-20T10:45:51Z

@saschagrunert can you point to a signoff that confirms what this PR is saying is technically correct? If that were available, I'd be happy to approve it right away.

I only have source code, container runtimes basically do nothing on privileged containers:

https://github.com/containerd/containerd/blob/cf600abecc27200a3c0e1415cd1f6c325eb05edf/pkg/cri/server/container_create_linux.go#L424

CRI-O behaves in the same way.

sftim · 2021-08-20T11:02:23Z

From the blog team's perspective, we're looking for a subject matter expert (or someone who is expert enough) to check technical accuracy. SIG Docs can't promise to have the skills for this.

PushkarJ

These are mostly quick fixes and minor nits. Happy to lgtm after that

content/en/blog/_posts/2021-08-20-seccomp-default.md

PushkarJ · 2021-08-20T17:44:02Z

content/en/blog/_posts/2021-08-20-seccomp-default.md

+    - name: test-container-nginx
+      image: nginx:1.21
+      securityContext:
+        seccompProfile:


Thank you for making this change

content/en/blog/_posts/2021-08-20-seccomp-default.md

PushkarJ · 2021-08-20T17:50:22Z

content/en/blog/_posts/2021-08-20-seccomp-default.md

+  [strace][strace]) for any executed syscalls which may be blocked by the
+  default profiles. If that's the case, then you can create a custom seccomp
+  profile based on the default by adding the additional syscalls to the
+  `"action": "SCMP_ACT_ALLOW"` section.


+1 on blog post

content/en/blog/_posts/2021-08-20-seccomp-default.md

saschagrunert · 2021-08-23T07:58:08Z

@PushkarJ added the changes. Thank you for the review, PTAL again.
@sftim since we passed the deadline, do you have any suggestion on a new date?

PushkarJ · 2021-08-23T16:38:52Z

Thank you @saschagrunert for patiently resolving all the comments. Looking forward to this blog post and more people using the feature as a result of that :)

/lgtm

k8s-ci-robot · 2021-08-23T16:39:09Z

LGTM label has been added.

Git tree hash: edb48bb7299357c2ce0983dc6863e10171ff0205

content/en/blog/_posts/2021-08-20-seccomp-default.md

This adds the blog post about the new Kubernetes `SeccompDefault` alpha feature. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

sftim · 2021-08-24T09:25:22Z

/hold cancel
/approve

borrowing LGTM from #28951 (comment)
/lgtm

k8s-ci-robot · 2021-08-24T09:25:37Z

LGTM label has been added.

Git tree hash: ad9c7b7f6f8cd1357b08fc08e1e5aeea81ad8519

k8s-ci-robot · 2021-08-24T09:25:40Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/blog/OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot requested review from kbarnard10 and sftim July 15, 2021 07:58

k8s-ci-robot added language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Jul 15, 2021

saschagrunert force-pushed the seccomp-default-blog branch from 4223285 to e730a28 Compare July 15, 2021 08:19

sftim reviewed Jul 15, 2021

View reviewed changes

saschagrunert force-pushed the seccomp-default-blog branch from e730a28 to 6d4653b Compare July 15, 2021 09:03

saschagrunert commented Jul 20, 2021

View reviewed changes

content/en/blog/2021-08-15-seccomp-default.md Outdated Show resolved Hide resolved

sftim added this to Ready for review in Blog articles via automation Jul 20, 2021

sftim moved this from Ready for review to Planned in Blog articles Jul 20, 2021

sftim moved this from Planned to Ready for review in Blog articles Jul 21, 2021

saschagrunert force-pushed the seccomp-default-blog branch 2 times, most recently from 0c9aa66 to 3919f2d Compare July 23, 2021 07:11

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 28, 2021

tengqm reviewed Jul 29, 2021

View reviewed changes

content/en/blog/_posts/2021-08-20-seccomp-default.md Outdated Show resolved Hide resolved

tengqm reviewed Jul 29, 2021

View reviewed changes

content/en/blog/_posts/2021-08-20-seccomp-default.md Outdated Show resolved Hide resolved

saschagrunert force-pushed the seccomp-default-blog branch 2 times, most recently from 1480b9c to 0106220 Compare July 29, 2021 11:43

sftim reviewed Jul 30, 2021

View reviewed changes

saschagrunert force-pushed the seccomp-default-blog branch 2 times, most recently from 36dca2e to d64aa11 Compare August 2, 2021 08:40

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 19, 2021

saschagrunert mentioned this pull request Aug 20, 2021

Mention that privileged containers run unconfined #29489

Merged

PushkarJ suggested changes Aug 20, 2021

View reviewed changes

saschagrunert force-pushed the seccomp-default-blog branch 2 times, most recently from bf7aede to 3f8b8fc Compare August 23, 2021 07:56

k8s-ci-robot assigned PushkarJ Aug 23, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 23, 2021

reylejano reviewed Aug 23, 2021

View reviewed changes

content/en/blog/_posts/2021-08-20-seccomp-default.md Outdated Show resolved Hide resolved

Add seccomp default feature blog post

84e472e

This adds the blog post about the new Kubernetes `SeccompDefault` alpha feature. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

saschagrunert force-pushed the seccomp-default-blog branch from 3f8b8fc to 84e472e Compare August 24, 2021 06:49

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 24, 2021

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 24, 2021

k8s-ci-robot assigned sftim Aug 24, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 24, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 24, 2021

sftim moved this from Ready for review to Scheduled in Blog articles Aug 24, 2021

k8s-ci-robot merged commit 157f1d7 into kubernetes:main Aug 24, 2021

saschagrunert deleted the seccomp-default-blog branch August 24, 2021 10:15

sftim moved this from Scheduled to Published in Blog articles Sep 7, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add seccomp default feature blog post #28951

Add seccomp default feature blog post #28951

saschagrunert commented Jul 15, 2021 •

edited

netlify bot commented Jul 15, 2021 •

edited

sftim left a comment

sftim commented Jul 28, 2021

sftim commented Jul 28, 2021

PI-Victor commented Jul 28, 2021

sftim left a comment

saschagrunert commented Aug 2, 2021

saschagrunert commented Aug 20, 2021

sftim commented Aug 20, 2021

sftim commented Aug 20, 2021

saschagrunert commented Aug 20, 2021

sftim commented Aug 20, 2021

PushkarJ left a comment

PushkarJ Aug 20, 2021

PushkarJ Aug 20, 2021

saschagrunert commented Aug 23, 2021 •

edited

PushkarJ commented Aug 23, 2021

k8s-ci-robot commented Aug 23, 2021

sftim commented Aug 24, 2021

k8s-ci-robot commented Aug 24, 2021

k8s-ci-robot commented Aug 24, 2021

Add seccomp default feature blog post #28951

Add seccomp default feature blog post #28951

Conversation

saschagrunert commented Jul 15, 2021 • edited

Todo

netlify bot commented Jul 15, 2021 • edited

sftim left a comment

Choose a reason for hiding this comment

sftim commented Jul 28, 2021

sftim commented Jul 28, 2021

PI-Victor commented Jul 28, 2021

sftim left a comment

Choose a reason for hiding this comment

saschagrunert commented Aug 2, 2021

saschagrunert commented Aug 20, 2021

sftim commented Aug 20, 2021

sftim commented Aug 20, 2021

saschagrunert commented Aug 20, 2021

sftim commented Aug 20, 2021

PushkarJ left a comment

Choose a reason for hiding this comment

PushkarJ Aug 20, 2021

Choose a reason for hiding this comment

PushkarJ Aug 20, 2021

Choose a reason for hiding this comment

saschagrunert commented Aug 23, 2021 • edited

PushkarJ commented Aug 23, 2021

k8s-ci-robot commented Aug 23, 2021

sftim commented Aug 24, 2021

k8s-ci-robot commented Aug 24, 2021

k8s-ci-robot commented Aug 24, 2021

saschagrunert commented Jul 15, 2021 •

edited

netlify bot commented Jul 15, 2021 •

edited

saschagrunert commented Aug 23, 2021 •

edited