Skip to content

Commit 61c7667

Browse files
author
Rohit Patil
committed
implement runAsGroup
1 parent 80d1f5c commit 61c7667

File tree

10 files changed

+262
-1
lines changed

10 files changed

+262
-1
lines changed

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 50 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37959,6 +37959,25 @@
3795937959
}
3796037960
}
3796137961
},
37962+
"com.github.openshift.api.security.v1.RunAsGroupStrategyOptions": {
37963+
"description": "RunAsGroupStrategyOptions defines the strategy type and options used to create the strategy.",
37964+
"type": "object",
37965+
"properties": {
37966+
"ranges": {
37967+
"description": "ranges are the allowed ranges of gids. If you would like to force a single gid then supply a single range with the same start and end.",
37968+
"type": "array",
37969+
"items": {
37970+
"default": {},
37971+
"$ref": "#/definitions/com.github.openshift.api.security.v1.IDRange"
37972+
},
37973+
"x-kubernetes-list-type": "atomic"
37974+
},
37975+
"type": {
37976+
"description": "type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.",
37977+
"type": "string"
37978+
}
37979+
}
37980+
},
3796237981
"com.github.openshift.api.security.v1.SELinuxContextStrategyOptions": {
3796337982
"description": "SELinuxContextStrategyOptions defines the strategy type and any options used to create the strategy.",
3796437983
"type": "object",
@@ -38120,6 +38139,11 @@
3812038139
},
3812138140
"x-kubernetes-list-type": "atomic"
3812238141
},
38142+
"runAsGroup": {
38143+
"description": "runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext.",
38144+
"default": {},
38145+
"$ref": "#/definitions/com.github.openshift.api.security.v1.RunAsGroupStrategyOptions"
38146+
},
3812338147
"runAsUser": {
3812438148
"description": "runAsUser is the strategy that will dictate what RunAsUser is used in the SecurityContext.",
3812538149
"default": {},

‎payload-manifests/crds/0000_03_config-operator_01_securitycontextconstraints.crd.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ spec:
3838
jsonPath: .fsGroup.type
3939
name: FSGroup
4040
type: string
41+
- description: Strategy that will dictate what RunAsGroup is used by the SecurityContext
42+
jsonPath: .runAsGroup.type
43+
name: RunAsGroup
44+
type: string
4145
- description: Strategy that will dictate what supplemental groups are used by
4246
the SecurityContext
4347
jsonPath: .supplementalGroups.type
@@ -256,6 +260,34 @@ spec:
256260
nullable: true
257261
type: array
258262
x-kubernetes-list-type: atomic
263+
runAsGroup:
264+
description: runAsGroup is the strategy that will dictate what RunAsGroup
265+
is used in the SecurityContext.
266+
nullable: true
267+
properties:
268+
ranges:
269+
description: |-
270+
ranges are the allowed ranges of gids. If you would like to force a single
271+
gid then supply a single range with the same start and end.
272+
items:
273+
description: IDRange provides a min/max of an allowed range of IDs.
274+
properties:
275+
max:
276+
description: max is the end of the range, inclusive.
277+
format: int64
278+
type: integer
279+
min:
280+
description: min is the start of the range, inclusive.
281+
format: int64
282+
type: integer
283+
type: object
284+
type: array
285+
x-kubernetes-list-type: atomic
286+
type:
287+
description: type is the strategy that will dictate what RunAsGroup
288+
is used in the SecurityContext.
289+
type: string
290+
type: object
259291
runAsUser:
260292
description: runAsUser is the strategy that will dictate what RunAsUser
261293
is used in the SecurityContext.

‎security/v1/types.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ var AllowAllCapabilities corev1.Capability = "*"
3131
// +kubebuilder:printcolumn:name="SELinux",type=string,JSONPath=.seLinuxContext.type,description="Strategy that will dictate what labels will be set in the SecurityContext"
3232
// +kubebuilder:printcolumn:name="RunAsUser",type=string,JSONPath=.runAsUser.type,description="Strategy that will dictate what RunAsUser is used in the SecurityContext"
3333
// +kubebuilder:printcolumn:name="FSGroup",type=string,JSONPath=.fsGroup.type,description="Strategy that will dictate what fs group is used by the SecurityContext"
34+
// +kubebuilder:printcolumn:name="RunAsGroup",type=string,JSONPath=.runAsGroup.type,description="Strategy that will dictate what RunAsGroup is used by the SecurityContext"
3435
// +kubebuilder:printcolumn:name="SupGroup",type=string,JSONPath=.supplementalGroups.type,description="Strategy that will dictate what supplemental groups are used by the SecurityContext"
3536
// +kubebuilder:printcolumn:name="Priority",type=string,JSONPath=.priority,description="Sort order of SCCs"
3637
// +kubebuilder:printcolumn:name="ReadOnlyRootFS",type=string,JSONPath=.readOnlyRootFilesystem,description="Force containers to run with a read only root file system"
@@ -131,6 +132,9 @@ type SecurityContextConstraints struct {
131132
// fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.
132133
// +nullable
133134
FSGroup FSGroupStrategyOptions `json:"fsGroup,omitempty" protobuf:"bytes,16,opt,name=fsGroup"`
135+
// runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
136+
// +nullable
137+
RunAsGroup RunAsGroupStrategyOptions `json:"runAsGroup,omitempty" protobuf:"bytes,27,opt,name=runAsGroup"`
134138
// readOnlyRootFilesystem when set to true will force containers to run with a read only root file
135139
// system. If the container specifically requests to run with a non-read only root file system
136140
// the SCC should deny the pod.
@@ -268,6 +272,16 @@ type SupplementalGroupsStrategyOptions struct {
268272
Ranges []IDRange `json:"ranges,omitempty" protobuf:"bytes,2,rep,name=ranges"`
269273
}
270274

275+
// RunAsGroupStrategyOptions defines the strategy type and options used to create the strategy.
276+
type RunAsGroupStrategyOptions struct {
277+
// type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
278+
Type RunAsGroupStrategyType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type,casttype=RunAsGroupStrategyType"`
279+
// ranges are the allowed ranges of gids. If you would like to force a single
280+
// gid then supply a single range with the same start and end.
281+
// +listType=atomic
282+
Ranges []IDRange `json:"ranges,omitempty" protobuf:"bytes,2,rep,name=ranges"`
283+
}
284+
271285
// IDRange provides a min/max of an allowed range of IDs.
272286
// TODO: this could be reused for UIDs.
273287
type IDRange struct {
@@ -296,6 +310,10 @@ type SupplementalGroupsStrategyType string
296310
// SecurityContext
297311
type FSGroupStrategyType string
298312

313+
// RunAsGroupStrategyType denotes strategy types for generating RunAsGroup values for a
314+
// SecurityContext
315+
type RunAsGroupStrategyType string
316+
299317
const (
300318
// NamespaceLevelAllowHost allows a pod to set `hostUsers` field to either `true` or `false`
301319
NamespaceLevelAllowHost NamespaceLevelType = "AllowHostLevel"
@@ -321,6 +339,11 @@ const (
321339
// container may make requests for any FSGroup labels.
322340
FSGroupStrategyRunAsAny FSGroupStrategyType = "RunAsAny"
323341

342+
// container must have RunAsGroup of X applied.
343+
RunAsGroupStrategyMustRunAs RunAsGroupStrategyType = "MustRunAs"
344+
// container may make requests for any RunAsGroup.
345+
RunAsGroupStrategyRunAsAny RunAsGroupStrategyType = "RunAsAny"
346+
324347
// container must run as a particular gid.
325348
SupplementalGroupsStrategyMustRunAs SupplementalGroupsStrategyType = "MustRunAs"
326349
// container may make requests for any gid.

‎security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints.crd.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ spec:
3838
jsonPath: .fsGroup.type
3939
name: FSGroup
4040
type: string
41+
- description: Strategy that will dictate what RunAsGroup is used by the SecurityContext
42+
jsonPath: .runAsGroup.type
43+
name: RunAsGroup
44+
type: string
4145
- description: Strategy that will dictate what supplemental groups are used by
4246
the SecurityContext
4347
jsonPath: .supplementalGroups.type
@@ -256,6 +260,34 @@ spec:
256260
nullable: true
257261
type: array
258262
x-kubernetes-list-type: atomic
263+
runAsGroup:
264+
description: runAsGroup is the strategy that will dictate what RunAsGroup
265+
is used in the SecurityContext.
266+
nullable: true
267+
properties:
268+
ranges:
269+
description: |-
270+
ranges are the allowed ranges of gids. If you would like to force a single
271+
gid then supply a single range with the same start and end.
272+
items:
273+
description: IDRange provides a min/max of an allowed range of IDs.
274+
properties:
275+
max:
276+
description: max is the end of the range, inclusive.
277+
format: int64
278+
type: integer
279+
min:
280+
description: min is the start of the range, inclusive.
281+
format: int64
282+
type: integer
283+
type: object
284+
type: array
285+
x-kubernetes-list-type: atomic
286+
type:
287+
description: type is the strategy that will dictate what RunAsGroup
288+
is used in the SecurityContext.
289+
type: string
290+
type: object
259291
runAsUser:
260292
description: runAsUser is the strategy that will dictate what RunAsUser
261293
is used in the SecurityContext.

‎security/v1/zz_generated.deepcopy.go‎

Lines changed: 22 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎security/v1/zz_generated.featuregated-crd-manifests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ securitycontextconstraints.security.openshift.io:
3636
jsonPath: .fsGroup.type
3737
name: FSGroup
3838
type: string
39+
- description: Strategy that will dictate what RunAsGroup is used by the SecurityContext
40+
jsonPath: .runAsGroup.type
41+
name: RunAsGroup
42+
type: string
3943
- description: Strategy that will dictate what supplemental groups are used by the
4044
SecurityContext
4145
jsonPath: .supplementalGroups.type

‎security/v1/zz_generated.featuregated-crd-manifests/securitycontextconstraints.security.openshift.io/AAA_ungated.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ spec:
3939
jsonPath: .fsGroup.type
4040
name: FSGroup
4141
type: string
42+
- description: Strategy that will dictate what RunAsGroup is used by the SecurityContext
43+
jsonPath: .runAsGroup.type
44+
name: RunAsGroup
45+
type: string
4246
- description: Strategy that will dictate what supplemental groups are used by
4347
the SecurityContext
4448
jsonPath: .supplementalGroups.type
@@ -257,6 +261,34 @@ spec:
257261
nullable: true
258262
type: array
259263
x-kubernetes-list-type: atomic
264+
runAsGroup:
265+
description: runAsGroup is the strategy that will dictate what RunAsGroup
266+
is used in the SecurityContext.
267+
nullable: true
268+
properties:
269+
ranges:
270+
description: |-
271+
ranges are the allowed ranges of gids. If you would like to force a single
272+
gid then supply a single range with the same start and end.
273+
items:
274+
description: IDRange provides a min/max of an allowed range of IDs.
275+
properties:
276+
max:
277+
description: max is the end of the range, inclusive.
278+
format: int64
279+
type: integer
280+
min:
281+
description: min is the start of the range, inclusive.
282+
format: int64
283+
type: integer
284+
type: object
285+
type: array
286+
x-kubernetes-list-type: atomic
287+
type:
288+
description: type is the strategy that will dictate what RunAsGroup
289+
is used in the SecurityContext.
290+
type: string
291+
type: object
260292
runAsUser:
261293
description: runAsUser is the strategy that will dictate what RunAsUser
262294
is used in the SecurityContext.

0 commit comments

Comments
 (0)