Skip to content

Commit 588b8ec

Browse files
salmanyamsalmanyam
committed
Add other logic files
1 parent 1295000 commit 588b8ec

24 files changed

+2890
-2
lines changed

‎cmd/scheduler/main.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ import (
3333
"sigs.k8s.io/scheduler-plugins/pkg/podstate"
3434
"sigs.k8s.io/scheduler-plugins/pkg/preemptiontoleration"
3535
"sigs.k8s.io/scheduler-plugins/pkg/qos"
36+
"sigs.k8s.io/scheduler-plugins/pkg/sysched"
3637
"sigs.k8s.io/scheduler-plugins/pkg/trimaran/loadvariationriskbalancing"
3738
"sigs.k8s.io/scheduler-plugins/pkg/trimaran/lowriskovercommitment"
3839
"sigs.k8s.io/scheduler-plugins/pkg/trimaran/targetloadpacking"
@@ -56,6 +57,7 @@ func main() {
5657
app.WithPlugin(preemptiontoleration.Name, preemptiontoleration.New),
5758
app.WithPlugin(targetloadpacking.Name, targetloadpacking.New),
5859
app.WithPlugin(lowriskovercommitment.Name, lowriskovercommitment.New),
60+
app.WithPlugin(sysched.Name, sysched.New),
5961
// Sample plugins below.
6062
// app.WithPlugin(crossnodepreemption.Name, crossnodepreemption.New),
6163
app.WithPlugin(podstate.Name, podstate.New),

‎hack/verify-crdgen.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ CONTROLLER_GEN="${GOPATH}/bin/controller-gen"
3030
go install sigs.k8s.io/controller-tools/cmd/[email protected]
3131

3232
# Generate CRD
33-
api_paths="./apis/scheduling/v1alpha1/...;./vendor/github.com/k8stopologyawareschedwg/noderesourcetopology-api/pkg/apis/...;./vendor/github.com/diktyo-io/appgroup-api/pkg/apis/...;./vendor/github.com/diktyo-io/networktopology-api/pkg/apis/..."
33+
api_paths="./apis/scheduling/v1alpha1/...;./vendor/github.com/k8stopologyawareschedwg/noderesourcetopology-api/pkg/apis/...;./vendor/github.com/diktyo-io/appgroup-api/pkg/apis/...;./vendor/github.com/diktyo-io/networktopology-api/pkg/apis/...;./vendor/sigs.k8s.io/security-profiles-operator/api/seccompprofile/v1beta1/..."
3434

3535
${CONTROLLER_GEN} ${CRD_OPTIONS} paths="${api_paths}" output:dir="./manifests/crds"
3636

‎manifests/crds/seccompprofiles.security-profiles-operator.x-k8s.io_sysched.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../sysched/crd.yaml

‎manifests/install/all-in-one.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ rules:
1515
#- apiGroups: [ "networktopology.diktyo.k8s.io" ]
1616
# resources: [ "networktopologies" ]
1717
# verbs: [ "get", "list", "watch", "create", "delete", "update", "patch" ]
18+
#- apiGroups: ["security-profiles-operator.x-k8s.io"]
19+
# resources: ["seccompprofiles", "profilebindings"]
20+
# verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
1821
---
1922
kind: ClusterRoleBinding
2023
apiVersion: rbac.authorization.k8s.io/v1
@@ -56,6 +59,9 @@ rules:
5659
- apiGroups: [""]
5760
resources: ["events"]
5861
verbs: ["create", "patch", "update"]
62+
#- apiGroups: ["security-profiles-operator.x-k8s.io"]
63+
# resources: ["seccompprofiles", "profilebindings"]
64+
# verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
5965
---
6066
kind: ClusterRoleBinding
6167
apiVersion: rbac.authorization.k8s.io/v1

‎manifests/install/charts/as-a-second-scheduler/templates/deployment.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ spec:
4444
- /bin/kube-scheduler
4545
- --config=/etc/kubernetes/scheduler-config.yaml
4646
image: {{ .Values.scheduler.image }}
47-
imagePullPolicy: IfNotPresent
47+
imagePullPolicy: IfNotPresent
4848
livenessProbe:
4949
httpGet:
5050
path: /healthz

‎manifests/install/charts/as-a-second-scheduler/templates/rbac.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,9 @@ rules:
7373
#- apiGroups: [ "networktopology.diktyo.x-k8s.io" ]
7474
# resources: [ "networktopologies" ]
7575
# verbs: [ "get", "list", "watch", "create", "delete", "update", "patch" ]
76+
#- apiGroups: ["security-profiles-operator.x-k8s.io"]
77+
# resources: ["seccompprofiles", "profilebindings"]
78+
# verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
7679
---
7780
kind: ClusterRoleBinding
7881
apiVersion: rbac.authorization.k8s.io/v1
@@ -108,6 +111,9 @@ rules:
108111
- apiGroups: ["scheduling.x-k8s.io"]
109112
resources: ["podgroups", "elasticquotas", "podgroups/status", "elasticquotas/status"]
110113
verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
114+
#- apiGroups: ["security-profiles-operator.x-k8s.io"]
115+
# resources: ["seccompprofiles", "profilebindings"]
116+
# verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
111117
---
112118
kind: ClusterRoleBinding
113119
apiVersion: rbac.authorization.k8s.io/v1

‎manifests/install/charts/as-a-second-scheduler/values.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,7 @@ pluginConfig:
3232
# args:
3333
# scoringStrategy:
3434
# type: MostAllocated # default is LeastAllocated
35+
#- name: SySched
36+
# args:
37+
# defaultProfileNamespace: "default"
38+
# defaultProfileName: "full-seccomp"

‎manifests/sysched/crd.yaml

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.5.0
7+
creationTimestamp: null
8+
name: seccompprofiles.security-profiles-operator.x-k8s.io
9+
spec:
10+
group: security-profiles-operator.x-k8s.io
11+
names:
12+
kind: SeccompProfile
13+
listKind: SeccompProfileList
14+
plural: seccompprofiles
15+
shortNames:
16+
- sp
17+
singular: seccompprofile
18+
scope: Namespaced
19+
versions:
20+
- additionalPrinterColumns:
21+
- jsonPath: .status.status
22+
name: Status
23+
type: string
24+
- jsonPath: .metadata.creationTimestamp
25+
name: Age
26+
type: date
27+
- jsonPath: .status.localhostProfile
28+
name: LocalhostProfile
29+
priority: 10
30+
type: string
31+
name: v1beta1
32+
schema:
33+
openAPIV3Schema:
34+
description: SeccompProfile is a cluster level specification for a seccomp
35+
profile. See https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#seccomp
36+
properties:
37+
apiVersion:
38+
description: 'APIVersion defines the versioned schema of this representation
39+
of an object. Servers should convert recognized schemas to the latest
40+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
41+
type: string
42+
kind:
43+
description: 'Kind is a string value representing the REST resource this
44+
object represents. Servers may infer this from the endpoint the client
45+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
46+
type: string
47+
metadata:
48+
type: object
49+
spec:
50+
description: SeccompProfileSpec defines the desired state of SeccompProfile.
51+
properties:
52+
architectures:
53+
description: the architecture used for system calls
54+
items:
55+
enum:
56+
- SCMP_ARCH_NATIVE
57+
- SCMP_ARCH_X86
58+
- SCMP_ARCH_X86_64
59+
- SCMP_ARCH_X32
60+
- SCMP_ARCH_ARM
61+
- SCMP_ARCH_AARCH64
62+
- SCMP_ARCH_MIPS
63+
- SCMP_ARCH_MIPS64
64+
- SCMP_ARCH_MIPS64N32
65+
- SCMP_ARCH_MIPSEL
66+
- SCMP_ARCH_MIPSEL64
67+
- SCMP_ARCH_MIPSEL64N32
68+
- SCMP_ARCH_PPC
69+
- SCMP_ARCH_PPC64
70+
- SCMP_ARCH_PPC64LE
71+
- SCMP_ARCH_S390
72+
- SCMP_ARCH_S390X
73+
- SCMP_ARCH_PARISC
74+
- SCMP_ARCH_PARISC64
75+
- SCMP_ARCH_RISCV64
76+
type: string
77+
type: array
78+
baseProfileName:
79+
description: name of base profile (in the same namespace) what will
80+
be unioned into this profile
81+
type: string
82+
defaultAction:
83+
description: the default action for seccomp
84+
enum:
85+
- SCMP_ACT_KILL
86+
- SCMP_ACT_KILL_PROCESS
87+
- SCMP_ACT_KILL_THREAD
88+
- SCMP_ACT_TRAP
89+
- SCMP_ACT_ERRNO
90+
- SCMP_ACT_TRACE
91+
- SCMP_ACT_ALLOW
92+
- SCMP_ACT_LOG
93+
type: string
94+
flags:
95+
description: list of flags to use with seccomp(2)
96+
items:
97+
enum:
98+
- SECCOMP_FILTER_FLAG_TSYNC
99+
- SECCOMP_FILTER_FLAG_LOG
100+
- SECCOMP_FILTER_FLAG_SPEC_ALLOW
101+
- SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
102+
type: string
103+
type: array
104+
syscalls:
105+
description: match a syscall in seccomp. While this property is OPTIONAL,
106+
some values of defaultAction are not useful without syscalls entries.
107+
For example, if defaultAction is SCMP_ACT_KILL and syscalls is empty
108+
or unset, the kernel will kill the container process on its first
109+
syscall
110+
items:
111+
description: Syscall defines a syscall in seccomp.
112+
properties:
113+
action:
114+
description: the action for seccomp rules
115+
enum:
116+
- SCMP_ACT_KILL
117+
- SCMP_ACT_KILL_PROCESS
118+
- SCMP_ACT_KILL_THREAD
119+
- SCMP_ACT_TRAP
120+
- SCMP_ACT_ERRNO
121+
- SCMP_ACT_TRACE
122+
- SCMP_ACT_ALLOW
123+
- SCMP_ACT_LOG
124+
type: string
125+
args:
126+
description: the specific syscall in seccomp
127+
items:
128+
description: Arg defines the specific syscall in seccomp.
129+
properties:
130+
index:
131+
description: the index for syscall arguments in seccomp
132+
minimum: 0
133+
type: integer
134+
op:
135+
description: the operator for syscall arguments in seccomp
136+
enum:
137+
- SCMP_CMP_NE
138+
- SCMP_CMP_LT
139+
- SCMP_CMP_LE
140+
- SCMP_CMP_EQ
141+
- SCMP_CMP_GE
142+
- SCMP_CMP_GT
143+
- SCMP_CMP_MASKED_EQ
144+
type: string
145+
value:
146+
description: the value for syscall arguments in seccomp
147+
format: int64
148+
minimum: 0
149+
type: integer
150+
valueTwo:
151+
description: the value for syscall arguments in seccomp
152+
format: int64
153+
minimum: 0
154+
type: integer
155+
required:
156+
- index
157+
- op
158+
type: object
159+
maxItems: 6
160+
type: array
161+
errnoRet:
162+
description: the errno return code to use. Some actions like
163+
SCMP_ACT_ERRNO and SCMP_ACT_TRACE allow to specify the errno
164+
code to return
165+
type: string
166+
names:
167+
description: the names of the syscalls
168+
items:
169+
type: string
170+
type: array
171+
required:
172+
- action
173+
- names
174+
type: object
175+
type: array
176+
required:
177+
- defaultAction
178+
type: object
179+
status:
180+
description: SeccompProfileStatus contains status of the deployed SeccompProfile.
181+
properties:
182+
activeWorkloads:
183+
items:
184+
type: string
185+
type: array
186+
conditions:
187+
description: Conditions of the resource.
188+
items:
189+
description: A Condition that may apply to a resource.
190+
properties:
191+
lastTransitionTime:
192+
description: LastTransitionTime is the last time this condition
193+
transitioned from one status to another.
194+
format: date-time
195+
type: string
196+
message:
197+
description: A Message containing details about this condition's
198+
last transition from one status to another, if any.
199+
type: string
200+
reason:
201+
description: A Reason for this condition's last transition from
202+
one status to another.
203+
type: string
204+
status:
205+
description: Status of this condition; is it currently True,
206+
False, or Unknown?
207+
type: string
208+
type:
209+
description: Type of this condition. At most one of each condition
210+
type may apply to a resource at any point in time.
211+
type: string
212+
required:
213+
- lastTransitionTime
214+
- reason
215+
- status
216+
- type
217+
type: object
218+
type: array
219+
localhostProfile:
220+
description: The path that should be provided to the `securityContext.seccompProfile.localhostProfile`
221+
field of a Pod or container spec
222+
type: string
223+
path:
224+
type: string
225+
status:
226+
description: ProfileState defines the state that the profile is in.
227+
A profile in this context refers to a SeccompProfile or a SELinux
228+
profile, the states are shared between them as well as the management
229+
API.
230+
type: string
231+
type: object
232+
type: object
233+
served: true
234+
storage: true
235+
subresources:
236+
status: {}
237+
status:
238+
acceptedNames:
239+
kind: ""
240+
plural: ""
241+
conditions: []
242+
storedVersions: []
243+

0 commit comments

Comments
 (0)