Skip to content

Commit 61e6009

Browse files
author
Rohit Patil
committed
implement runAsGroup
1 parent 80d1f5c commit 61e6009

File tree

10 files changed

+477
-1
lines changed

10 files changed

+477
-1
lines changed

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 72 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37959,6 +37959,43 @@
3795937959
}
3796037960
}
3796137961
},
37962+
"com.github.openshift.api.security.v1.RunAsGroupStrategyOptions": {
37963+
"description": "RunAsGroupStrategyOptions defines the strategy type and options used to create the strategy.",
37964+
"type": "object",
37965+
"required": [
37966+
"type"
37967+
],
37968+
"properties": {
37969+
"gid": {
37970+
"description": "gid is the group id that containers must run as. Required for the MustRunAs strategy if not using namespace/service account allocated gids.",
37971+
"type": "integer",
37972+
"format": "int64"
37973+
},
37974+
"gidRangeMax": {
37975+
"description": "gidRangeMax defines the max value for a strategy that allocates by range.",
37976+
"type": "integer",
37977+
"format": "int64"
37978+
},
37979+
"gidRangeMin": {
37980+
"description": "gidRangeMin defines the min value for a strategy that allocates by range.",
37981+
"type": "integer",
37982+
"format": "int64"
37983+
},
37984+
"ranges": {
37985+
"description": "ranges are the allowed ranges of gids. If you would like to force a single gid then supply a single range with the same start and end. When omitted, any gid is allowed (equivalent to RunAsAny strategy).",
37986+
"type": "array",
37987+
"items": {
37988+
"default": {},
37989+
"$ref": "#/definitions/com.github.openshift.api.security.v1.IDRange"
37990+
},
37991+
"x-kubernetes-list-type": "atomic"
37992+
},
37993+
"type": {
37994+
"description": "type is the strategy that will dictate what RunAsGroup is used in the SecurityContext. Valid values are \"MustRunAs\", \"MustRunAsRange\", and \"RunAsAny\".",
37995+
"type": "string"
37996+
}
37997+
}
37998+
},
3796237999
"com.github.openshift.api.security.v1.SELinuxContextStrategyOptions": {
3796338000
"description": "SELinuxContextStrategyOptions defines the strategy type and any options used to create the strategy.",
3796438001
"type": "object",
@@ -38120,6 +38157,11 @@
3812038157
},
3812138158
"x-kubernetes-list-type": "atomic"
3812238159
},
38160+
"runAsGroup": {
38161+
"description": "runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext. When omitted, the RunAsGroup strategy will not be enforced and containers may run with any group ID.",
38162+
"default": {},
38163+
"$ref": "#/definitions/com.github.openshift.api.security.v1.RunAsGroupStrategyOptions"
38164+
},
3812338165
"runAsUser": {
3812438166
"description": "runAsUser is the strategy that will dictate what RunAsUser is used in the SecurityContext.",
3812538167
"default": {},

‎payload-manifests/crds/0000_03_config-operator_01_securitycontextconstraints.crd.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ spec:
3838
jsonPath: .fsGroup.type
3939
name: FSGroup
4040
type: string
41+
- description: Strategy that will dictate what RunAsGroup is used by the SecurityContext
42+
jsonPath: .runAsGroup.type
43+
name: RunAsGroup
44+
type: string
4145
- description: Strategy that will dictate what supplemental groups are used by
4246
the SecurityContext
4347
jsonPath: .supplementalGroups.type
@@ -201,6 +205,9 @@ spec:
201205
description: min is the start of the range, inclusive.
202206
format: int64
203207
type: integer
208+
required:
209+
- max
210+
- min
204211
type: object
205212
type: array
206213
x-kubernetes-list-type: atomic
@@ -256,6 +263,62 @@ spec:
256263
nullable: true
257264
type: array
258265
x-kubernetes-list-type: atomic
266+
runAsGroup:
267+
description: |-
268+
runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
269+
When omitted, the RunAsGroup strategy will not be enforced and containers may run with any group ID.
270+
properties:
271+
gid:
272+
description: |-
273+
gid is the group id that containers must run as. Required for the MustRunAs strategy if not using
274+
namespace/service account allocated gids.
275+
format: int64
276+
type: integer
277+
gidRangeMax:
278+
description: gidRangeMax defines the max value for a strategy that
279+
allocates by range.
280+
format: int64
281+
type: integer
282+
gidRangeMin:
283+
description: gidRangeMin defines the min value for a strategy that
284+
allocates by range.
285+
format: int64
286+
type: integer
287+
ranges:
288+
description: |-
289+
ranges are the allowed ranges of gids. If you would like to force a single
290+
gid then supply a single range with the same start and end.
291+
When omitted, any gid is allowed (equivalent to RunAsAny strategy).
292+
items:
293+
description: IDRange provides a min/max of an allowed range of IDs.
294+
properties:
295+
max:
296+
description: max is the end of the range, inclusive.
297+
format: int64
298+
type: integer
299+
min:
300+
description: min is the start of the range, inclusive.
301+
format: int64
302+
type: integer
303+
required:
304+
- max
305+
- min
306+
type: object
307+
maxItems: 256
308+
type: array
309+
x-kubernetes-list-type: atomic
310+
type:
311+
description: |-
312+
type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
313+
Valid values are "MustRunAs", "MustRunAsRange", and "RunAsAny".
314+
enum:
315+
- MustRunAs
316+
- MustRunAsRange
317+
- RunAsAny
318+
type: string
319+
required:
320+
- type
321+
type: object
259322
runAsUser:
260323
description: runAsUser is the strategy that will dictate what RunAsUser
261324
is used in the SecurityContext.
@@ -344,6 +407,9 @@ spec:
344407
description: min is the start of the range, inclusive.
345408
format: int64
346409
type: integer
410+
required:
411+
- max
412+
- min
347413
type: object
348414
type: array
349415
x-kubernetes-list-type: atomic

‎security/v1/types.go‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ var AllowAllCapabilities corev1.Capability = "*"
3131
// +kubebuilder:printcolumn:name="SELinux",type=string,JSONPath=.seLinuxContext.type,description="Strategy that will dictate what labels will be set in the SecurityContext"
3232
// +kubebuilder:printcolumn:name="RunAsUser",type=string,JSONPath=.runAsUser.type,description="Strategy that will dictate what RunAsUser is used in the SecurityContext"
3333
// +kubebuilder:printcolumn:name="FSGroup",type=string,JSONPath=.fsGroup.type,description="Strategy that will dictate what fs group is used by the SecurityContext"
34+
// +kubebuilder:printcolumn:name="RunAsGroup",type=string,JSONPath=.runAsGroup.type,description="Strategy that will dictate what RunAsGroup is used by the SecurityContext"
3435
// +kubebuilder:printcolumn:name="SupGroup",type=string,JSONPath=.supplementalGroups.type,description="Strategy that will dictate what supplemental groups are used by the SecurityContext"
3536
// +kubebuilder:printcolumn:name="Priority",type=string,JSONPath=.priority,description="Sort order of SCCs"
3637
// +kubebuilder:printcolumn:name="ReadOnlyRootFS",type=string,JSONPath=.readOnlyRootFilesystem,description="Force containers to run with a read only root file system"
@@ -131,6 +132,10 @@ type SecurityContextConstraints struct {
131132
// fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.
132133
// +nullable
133134
FSGroup FSGroupStrategyOptions `json:"fsGroup,omitempty" protobuf:"bytes,16,opt,name=fsGroup"`
135+
// runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
136+
// When omitted, the RunAsGroup strategy will not be enforced and containers may run with any group ID.
137+
// +optional
138+
RunAsGroup RunAsGroupStrategyOptions `json:"runAsGroup,omitzero" protobuf:"bytes,27,opt,name=runAsGroup"`
134139
// readOnlyRootFilesystem when set to true will force containers to run with a read only root file
135140
// system. If the container specifically requests to run with a non-read only root file system
136141
// the SCC should deny the pod.
@@ -268,12 +273,40 @@ type SupplementalGroupsStrategyOptions struct {
268273
Ranges []IDRange `json:"ranges,omitempty" protobuf:"bytes,2,rep,name=ranges"`
269274
}
270275

276+
// RunAsGroupStrategyOptions defines the strategy type and options used to create the strategy.
277+
type RunAsGroupStrategyOptions struct {
278+
// type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
279+
// Valid values are "MustRunAs", "MustRunAsRange", and "RunAsAny".
280+
// +required
281+
// +kubebuilder:validation:Enum=MustRunAs;MustRunAsRange;RunAsAny
282+
Type RunAsGroupStrategyType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type,casttype=RunAsGroupStrategyType"`
283+
// gid is the group id that containers must run as. Required for the MustRunAs strategy if not using
284+
// namespace/service account allocated gids.
285+
// +optional
286+
GID *int64 `json:"gid,omitempty" protobuf:"varint,2,opt,name=gid"`
287+
// gidRangeMin defines the min value for a strategy that allocates by range.
288+
// +optional
289+
GIDRangeMin *int64 `json:"gidRangeMin,omitempty" protobuf:"varint,3,opt,name=gidRangeMin"`
290+
// gidRangeMax defines the max value for a strategy that allocates by range.
291+
// +optional
292+
GIDRangeMax *int64 `json:"gidRangeMax,omitempty" protobuf:"varint,4,opt,name=gidRangeMax"`
293+
// ranges are the allowed ranges of gids. If you would like to force a single
294+
// gid then supply a single range with the same start and end.
295+
// When omitted, any gid is allowed (equivalent to RunAsAny strategy).
296+
// +optional
297+
// +listType=atomic
298+
// +kubebuilder:validation:MaxItems=256
299+
Ranges []IDRange `json:"ranges,omitempty" protobuf:"bytes,5,rep,name=ranges"`
300+
}
301+
271302
// IDRange provides a min/max of an allowed range of IDs.
272303
// TODO: this could be reused for UIDs.
273304
type IDRange struct {
274305
// min is the start of the range, inclusive.
306+
// +kubebuilder:validation:Required
275307
Min int64 `json:"min,omitempty" protobuf:"varint,1,opt,name=min"`
276308
// max is the end of the range, inclusive.
309+
// +kubebuilder:validation:Required
277310
Max int64 `json:"max,omitempty" protobuf:"varint,2,opt,name=max"`
278311
}
279312

@@ -296,6 +329,10 @@ type SupplementalGroupsStrategyType string
296329
// SecurityContext
297330
type FSGroupStrategyType string
298331

332+
// RunAsGroupStrategyType denotes strategy types for generating RunAsGroup values for a
333+
// SecurityContext
334+
type RunAsGroupStrategyType string
335+
299336
const (
300337
// NamespaceLevelAllowHost allows a pod to set `hostUsers` field to either `true` or `false`
301338
NamespaceLevelAllowHost NamespaceLevelType = "AllowHostLevel"
@@ -321,6 +358,13 @@ const (
321358
// container may make requests for any FSGroup labels.
322359
FSGroupStrategyRunAsAny FSGroupStrategyType = "RunAsAny"
323360

361+
// container must have RunAsGroup of X applied.
362+
RunAsGroupStrategyMustRunAs RunAsGroupStrategyType = "MustRunAs"
363+
// container must run with a gid in a range.
364+
RunAsGroupStrategyMustRunAsRange RunAsGroupStrategyType = "MustRunAsRange"
365+
// container may make requests for any RunAsGroup.
366+
RunAsGroupStrategyRunAsAny RunAsGroupStrategyType = "RunAsAny"
367+
324368
// container must run as a particular gid.
325369
SupplementalGroupsStrategyMustRunAs SupplementalGroupsStrategyType = "MustRunAs"
326370
// container may make requests for any gid.

0 commit comments

Comments
 (0)