PodSecurityPolicy.allowedCapabilities: add support for * to allow to request any capabilities #51337

php-coder · 2017-08-25T14:57:02Z

What this PR does / why we need it:
Prior this change there was no way to allow to pods to request any capabilities. Cluster admin had always specify a full list of capabilities explicitly. Because there are many of them, it gets tedious. This PR makes possible to use * to allow all possible capabilities. Non-paranoid (and lazy) cluster admins can use it. Those who are super strict and paranoid of course won't use it because * allows capabilities that don't exist today but may be introduced in the future.

"privileged" PSP in examples was modified to allow privileged users to use this feature.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #50055

Special notes for your reviewer:
This functional is already present in OpenShift: openshift/origin#12875 and openshift/origin#15135

Release note:

PSP: add support for using `*` as a value in `allowedCapabilities` to allow to request any capabilities

CC @simo5 @pweil- @gyliu513 @liqlin2015

k8s-ci-robot · 2017-08-25T14:57:09Z

Hi @php-coder. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

mfojtik · 2017-08-25T14:59:39Z

/ok-to-test

php-coder · 2017-08-25T15:03:47Z

While this PR has kind/api-change label it effectively doesn't change the API.

php-coder · 2017-08-28T13:54:09Z

@timothysc PTAL

php-coder · 2017-08-30T21:04:09Z

@smarterclayton PTAL

smarterclayton · 2017-08-30T23:58:23Z

This looks ok to me. It is an API change in surface area.

We hit this in openshift for administrative users - giving admins access to all capabilities. The "admin" PSP should have this for backwards compatibility when we start enabling PSP.

It is also consistent with other PSP policies on the object. @kubernetes/sig-auth-pr-reviews please weigh in.

/retest

ericchiang · 2017-08-31T00:10:28Z

/lgtm

Seems reasonable and we allow "*" for a lot of policies.

ericchiang · 2017-08-31T00:15:01Z

pkg/api/types.go

@@ -1673,6 +1673,10 @@ const (
 // Capability represent POSIX capabilities type
 type Capability string

+// AllowAllCapabilities can be used as a value for the PodSecurityPolicy.AllowAllCapabilities
+// field and means that any capabilities are allowed to be requested.
+var AllowAllCapabilities Capability = "*"


One nit. This should probably be in "pkg/apis/extensions" right? Since it's meant to be used with the PodSecurityPolicy types which are defined there.

This should probably be in "pkg/apis/extensions" right?

Probably? I'm either not sure what it should be.

if it is related to PSP, it should be in the PSP API group (just like FSType All is)

@php-coder do you need to run ./hack/update-all.sh -a if the api was changed?

php-coder · 2017-09-01T14:29:13Z

AllowAllCapabilities was moved from api to extensions as per @ericchiang suggestion. PTAL.

liggitt · 2017-09-01T14:35:38Z

needs hack/update-bazel.sh

smarterclayton · 2017-09-01T15:02:11Z

/approve

liggitt · 2017-09-01T21:00:24Z

I0901 14:50:03.363] Verifying hack/make-rules/../../hack/verify-bazel.sh
I0901 14:50:31.532] --- /go/src/k8s.io/kubernetes/pkg/security/podsecuritypolicy/capabilities/BUILD	2017-09-01 14:43:35.946021363 +0000
I0901 14:50:31.532] +++ /tmp/BUILD012596670	2017-09-01 14:50:17.425910445 +0000
I0901 14:50:31.532] @@ -15,6 +15,7 @@
I0901 14:50:31.532]      ],
I0901 14:50:31.533]      deps = [
I0901 14:50:31.533]          "//pkg/api:go_default_library",
I0901 14:50:31.533] +        "//pkg/apis/extensions:go_default_library",
I0901 14:50:31.533]          "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
I0901 14:50:31.533]          "//vendor/k8s.io/apimachinery/pkg/util/validation/field:go_default_library",
I0901 14:50:31.533]      ],
I0901 14:50:31.534] @@ -24,7 +25,10 @@
I0901 14:50:31.534]      name = "go_default_test",
I0901 14:50:31.534]      srcs = ["mustrunas_test.go"],
I0901 14:50:31.534]      library = ":go_default_library",
I0901 14:50:31.535] -    deps = ["//pkg/api:go_default_library"],
I0901 14:50:31.535] +    deps = [
I0901 14:50:31.535] +        "//pkg/api:go_default_library",
I0901 14:50:31.535] +        "//pkg/apis/extensions:go_default_library",
I0901 14:50:31.535] +    ],
I0901 14:50:31.536]  )
I0901 14:50:31.536]  
I0901 14:50:31.536]  filegroup(
I0901 14:50:31.536] 
I0901 14:50:31.537] 
I0901 14:50:31.537] Run ./hack/update-bazel.sh
I0901 14:50:31.596] FAILED   hack/make-rules/../../hack/verify-bazel.sh	28s

smarterclayton · 2017-09-01T23:09:12Z

Needs an update

php-coder · 2017-09-04T14:40:47Z

Test flake #51897:

W0904 14:21:30.465] error running tasks: deadline exceeded executing task EBSVolume/a.etcd-events.e2e-46669.test-aws.k8s.io. Example error: error creating PersistentVolume: VolumeLimitExceeded: You have exceeded your maximum gp2 storage limit of 20 TiB in this region. Please contact AWS Support to request an Elastic Block Store service limit increase.

php-coder · 2017-09-05T12:56:01Z

Updated. PTAL. The existing test failures aren't related to my code and they're flakes in other parts.

liggitt · 2017-09-05T19:49:49Z

pkg/apis/extensions/validation/validation.go

@@ -660,6 +660,10 @@ func ValidatePodSecurityPolicySpec(spec *extensions.PodSecurityPolicySpec, fldPa
 	allErrs = append(allErrs, validatePSPSupplementalGroup(fldPath.Child("supplementalGroups"), &spec.SupplementalGroups)...)
 	allErrs = append(allErrs, validatePSPFSGroup(fldPath.Child("fsGroup"), &spec.FSGroup)...)
 	allErrs = append(allErrs, validatePodSecurityPolicyVolumes(fldPath, spec.Volumes)...)
+	if len(spec.RequiredDropCapabilities) > 0 && hasCap(extensions.AllowAllCapabilities, spec.AllowedCapabilities) {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("requiredDropCapabilities"), spec.RequiredDropCapabilities,
+			"required capabilities must be empty when all capabilities are allowed by a wildcard"))


change to "must be empty when all capabilities are allowed by a wildcard"

Updated. The only change is this message.

liggitt · 2017-09-05T19:52:09Z

nit on validation message, lgtm otherwise

…ow to request any capabilities. Also modify "privileged" PSP to use it and allow privileged users to use any capabilities.

liggitt · 2017-09-06T13:10:53Z

/lgtm
/retest

k8s-github-robot · 2017-09-06T13:11:50Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ericchiang, liggitt, php-coder, smarterclayton

Associated issue: 50055

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~examples/OWNERS~~ [smarterclayton]
~~pkg/OWNERS~~ [smarterclayton]
~~plugin/pkg/admission/OWNERS~~ [smarterclayton]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

fejta-bot · 2017-09-11T14:12:17Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

fejta-bot · 2017-09-11T21:54:18Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

wanghaoran1988 · 2017-09-12T08:44:45Z

/retest

tallclair · 2017-09-15T17:00:53Z

Any chance we can get this in 1.8?

liggitt · 2017-09-15T17:08:06Z

Any chance we can get this in 1.8?

would need an exception filed. I'd be in favor... change is minimal, risk is low, benefit is high (allows creating a true superuser PSP which is usually necessary as part of deploying PSP in a cluster)

ericchiang · 2017-09-15T21:42:54Z

/retest

cc @kubernetes/kubernetes-release-managers this PR was approved before the freeze but was never added to the milestone. As liggitt stated above, It's an extremely low risk change and I'd also like to see this in the release.

dims · 2017-09-19T02:35:46Z

/test all

dims · 2017-09-19T10:50:49Z

/retest

fejta-bot · 2017-09-19T18:54:27Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

k8s-github-robot · 2017-09-20T00:31:04Z

Automatic merge from submit-queue (batch tested with PRs 51337, 47080, 52646, 52635, 52666). If you want to cherry-pick this change to another branch, please follow the instructions here..

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Aug 25, 2017

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 25, 2017

k8s-github-robot assigned timothysc and smarterclayton Aug 25, 2017

k8s-github-robot added kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Aug 25, 2017

php-coder mentioned this pull request Aug 25, 2017

PSP: provide a simple way to allow all Linux capabilities #50055

Closed

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 25, 2017

php-coder force-pushed the psp_star_in_allowed_caps branch from 02e13bd to 770a770 Compare August 25, 2017 15:55

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Aug 30, 2017

k8s-ci-robot assigned ericchiang Aug 31, 2017

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 31, 2017

ericchiang reviewed Aug 31, 2017

View reviewed changes

php-coder force-pushed the psp_star_in_allowed_caps branch from 770a770 to 4b39be1 Compare September 1, 2017 14:28

k8s-github-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 1, 2017

k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 1, 2017

php-coder force-pushed the psp_star_in_allowed_caps branch from 0410914 to bfaf740 Compare September 4, 2017 13:52

liggitt reviewed Sep 5, 2017

View reviewed changes

php-coder added 2 commits September 6, 2017 12:18

PodSecurityPolicy.allowedCapabilities: add support for using * to all…

9015a82

…ow to request any capabilities. Also modify "privileged" PSP to use it and allow privileged users to use any capabilities.

Update autogenerated files.

7ab69d1

php-coder force-pushed the psp_star_in_allowed_caps branch from bfaf740 to 7ab69d1 Compare September 6, 2017 10:18

k8s-ci-robot assigned liggitt Sep 6, 2017

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 6, 2017

php-coder mentioned this pull request Sep 15, 2017

Basic GCE PodSecurityPolicy Config #52367

Merged

jdumars added this to the v1.8 milestone Sep 18, 2017

k8s-github-robot merged commit fb994df into kubernetes:master Sep 20, 2017

php-coder deleted the psp_star_in_allowed_caps branch September 20, 2017 08:36

This was referenced Sep 20, 2017

psp.yaml: add allowedCapabilities: '*' to permissive PSP kubernetes/website#5558

Merged

Update privileged PSP to allow all capabilities kubernetes/examples#99

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PodSecurityPolicy.allowedCapabilities: add support for * to allow to request any capabilities #51337

PodSecurityPolicy.allowedCapabilities: add support for * to allow to request any capabilities #51337

php-coder commented Aug 25, 2017

k8s-ci-robot commented Aug 25, 2017

mfojtik commented Aug 25, 2017

php-coder commented Aug 25, 2017 •

edited

Loading

php-coder commented Aug 28, 2017

php-coder commented Aug 30, 2017

smarterclayton commented Aug 30, 2017

ericchiang commented Aug 31, 2017

ericchiang Aug 31, 2017

php-coder Aug 31, 2017

liggitt Aug 31, 2017

gyliu513 Aug 31, 2017

php-coder commented Sep 1, 2017

liggitt commented Sep 1, 2017

smarterclayton commented Sep 1, 2017

liggitt commented Sep 1, 2017

smarterclayton commented Sep 1, 2017 via email

php-coder commented Sep 4, 2017 •

edited

Loading

php-coder commented Sep 5, 2017

liggitt Sep 5, 2017

php-coder Sep 6, 2017

liggitt commented Sep 5, 2017

liggitt commented Sep 6, 2017

k8s-github-robot commented Sep 6, 2017

fejta-bot commented Sep 11, 2017

fejta-bot commented Sep 11, 2017

wanghaoran1988 commented Sep 12, 2017

tallclair commented Sep 15, 2017

liggitt commented Sep 15, 2017

ericchiang commented Sep 15, 2017

dims commented Sep 19, 2017

dims commented Sep 19, 2017

fejta-bot commented Sep 19, 2017

k8s-github-robot commented Sep 20, 2017

PodSecurityPolicy.allowedCapabilities: add support for * to allow to request any capabilities #51337

PodSecurityPolicy.allowedCapabilities: add support for * to allow to request any capabilities #51337

Conversation

php-coder commented Aug 25, 2017

k8s-ci-robot commented Aug 25, 2017

mfojtik commented Aug 25, 2017

php-coder commented Aug 25, 2017 • edited Loading

php-coder commented Aug 28, 2017

php-coder commented Aug 30, 2017

smarterclayton commented Aug 30, 2017

ericchiang commented Aug 31, 2017

ericchiang Aug 31, 2017

Choose a reason for hiding this comment

php-coder Aug 31, 2017

Choose a reason for hiding this comment

liggitt Aug 31, 2017

Choose a reason for hiding this comment

gyliu513 Aug 31, 2017

Choose a reason for hiding this comment

php-coder commented Sep 1, 2017

liggitt commented Sep 1, 2017

smarterclayton commented Sep 1, 2017

liggitt commented Sep 1, 2017

smarterclayton commented Sep 1, 2017 via email

php-coder commented Sep 4, 2017 • edited Loading

php-coder commented Sep 5, 2017

liggitt Sep 5, 2017

Choose a reason for hiding this comment

php-coder Sep 6, 2017

Choose a reason for hiding this comment

liggitt commented Sep 5, 2017

liggitt commented Sep 6, 2017

k8s-github-robot commented Sep 6, 2017

fejta-bot commented Sep 11, 2017

fejta-bot commented Sep 11, 2017

wanghaoran1988 commented Sep 12, 2017

tallclair commented Sep 15, 2017

liggitt commented Sep 15, 2017

ericchiang commented Sep 15, 2017

dims commented Sep 19, 2017

dims commented Sep 19, 2017

fejta-bot commented Sep 19, 2017

k8s-github-robot commented Sep 20, 2017

php-coder commented Aug 25, 2017 •

edited

Loading

php-coder commented Sep 4, 2017 •

edited

Loading