1. origin
  2. Commit 020adabb83a78fd823e8a43b68ef38e6eab232d3
Browse code

allow pvc by default

Paul Weil authored on 2016/03/31 00:37:43
Showing 2 changed files
pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go
History View file @ 020adab
... ... 
@@ -91,7 +91,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
91 91 
 					DescriptionAnnotation: SecurityContextConstraintNonRootDesc,
92 92 
 				},
93 93 
 			},
94 
-			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},
94 
+			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap, kapi.FSTypePersistentVolumeClaim},
95 95 
 			SELinuxContext: kapi.SELinuxContextStrategyOptions{
96 96 
 				// This strategy requires that annotations on the namespace which will be populated
97 97 
 				// by the admission controller.  If namespaces are not annotated creating the strategy
... ... 
@@ -119,7 +119,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
119 119 
 					DescriptionAnnotation: SecurityContextConstraintHostMountAndAnyUIDDesc,
120 120 
 				},
121 121 
 			},
122 
-			Volumes: []kapi.FSType{kapi.FSTypeHostPath, kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},
122 
+			Volumes: []kapi.FSType{kapi.FSTypeHostPath, kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap, kapi.FSTypePersistentVolumeClaim},
123 123 
 			SELinuxContext: kapi.SELinuxContextStrategyOptions{
124 124 
 				// This strategy requires that annotations on the namespace which will be populated
125 125 
 				// by the admission controller.  If namespaces are not annotated creating the strategy
... ... 
@@ -148,7 +148,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
148 148 
 					DescriptionAnnotation: SecurityContextConstraintHostNSDesc,
149 149 
 				},
150 150 
 			},
151 
-			Volumes:          []kapi.FSType{kapi.FSTypeHostPath, kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},
151 
+			Volumes:          []kapi.FSType{kapi.FSTypeHostPath, kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap, kapi.FSTypePersistentVolumeClaim},
152 152 
 			AllowHostNetwork: true,
153 153 
 			AllowHostPorts:   true,
154 154 
 			AllowHostPID:     true,
... ... 
@@ -180,7 +180,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
180 180 
 					DescriptionAnnotation: SecurityContextConstraintRestrictedDesc,
181 181 
 				},
182 182 
 			},
183 
-			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},
183 
+			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap, kapi.FSTypePersistentVolumeClaim},
184 184 
 			SELinuxContext: kapi.SELinuxContextStrategyOptions{
185 185 
 				// This strategy requires that annotations on the namespace which will be populated
186 186 
 				// by the admission controller.  If namespaces are not annotated creating the strategy
... ... 
@@ -210,7 +210,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
210 210 
 					DescriptionAnnotation: SecurityContextConstraintsAnyUIDDesc,
211 211 
 				},
212 212 
 			},
213 
-			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},
213 
+			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap, kapi.FSTypePersistentVolumeClaim},
214 214 
 			SELinuxContext: kapi.SELinuxContextStrategyOptions{
215 215 
 				// This strategy requires that annotations on the namespace which will be populated
216 216 
 				// by the admission controller.  If namespaces are not annotated creating the strategy
... ... 
@@ -241,7 +241,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
241 241 
 			},
242 242 
 			AllowHostNetwork: true,
243 243 
 			AllowHostPorts:   true,
244 
-			Volumes:          []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},
244 
+			Volumes:          []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap, kapi.FSTypePersistentVolumeClaim},
245 245 
 			SELinuxContext: kapi.SELinuxContextStrategyOptions{
246 246 
 				// This strategy requires that annotations on the namespace which will be populated
247 247 
 				// by the admission controller.  If namespaces are not annotated creating the strategy
pkg/cmd/server/bootstrappolicy/securitycontextconstraints_test.go
History View file @ 020adab
... ... 
@@ -1,9 +1,11 @@
1 1 
 package bootstrappolicy
2 2
3 3 
 import (
4 
-	"k8s.io/kubernetes/pkg/serviceaccount"
5 4 
 	"reflect"
6 5 
 	"testing"
6 
+
7 
+	kapi "k8s.io/kubernetes/pkg/api"
8 
+	"k8s.io/kubernetes/pkg/serviceaccount"
7 9 
 )
8 10
9 11 
 func TestBootstrappedConstraints(t *testing.T) {
... ... 
@@ -17,6 +19,7 @@ func TestBootstrappedConstraints(t *testing.T) {
17 17 
 		SecurityContextConstraintsHostNetwork,
18 18 
 	}
19 19 
 	expectedGroups, expectedUsers := getExpectedAccess()
20 
+	expectedVolumes := []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap, kapi.FSTypePersistentVolumeClaim}
20 21
21 22 
 	groups, users := GetBoostrapSCCAccess(DefaultOpenShiftInfraNamespace)
22 23 
 	bootstrappedConstraints := GetBootstrapSecurityContextConstraints(groups, users)
... ... 
@@ -35,6 +38,12 @@ func TestBootstrappedConstraints(t *testing.T) {
35 35 
 		if !reflect.DeepEqual(u, constraint.Users) {
36 36 
 			t.Errorf("unexpected user access for %s.  Found %v, wanted %v", constraint.Name, constraint.Users, u)
37 37 
 		}
38 
+
39 
+		for _, expectedVolume := range expectedVolumes {
40 
+			if !supportsFSType(expectedVolume, &constraint) {
41 
+				t.Errorf("%s does not support %v which is required for all default SCCs", constraint.Name, expectedVolume)
42 
+			}
43 
+		}
38 44 
 	}
39 45 
 }
40 46
... ... 
@@ -77,3 +86,12 @@ func getExpectedAccess() (map[string][]string, map[string][]string) {
77 77 
 	}
78 78 
 	return groups, users
79 79 
 }
80 
+
81 
+func supportsFSType(fsType kapi.FSType, scc *kapi.SecurityContextConstraints) bool {
82 
+	for _, v := range scc.Volumes {
83 
+		if v == kapi.FSTypeAll || v == fsType {
84 
+			return true
85 
+		}
86 
+	}
87 
+	return false
88 
+}