Skip to content

Commit 6239abe

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#89225 from andrewsykim/apparmor-api
move apparmor annotation constants to k8s.io/api/core/v1
2 parents 3641d40 + 2e56866 commit 6239abe

File tree

25 files changed

+131
-147
lines changed

25 files changed

+131
-147
lines changed

‎pkg/api/pod/BUILD‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ go_library(
1313
deps = [
1414
"//pkg/apis/core:go_default_library",
1515
"//pkg/features:go_default_library",
16-
"//pkg/security/apparmor:go_default_library",
16+
"//staging/src/k8s.io/api/core/v1:go_default_library",
1717
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
1818
"//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
1919
],
@@ -39,7 +39,7 @@ go_test(
3939
deps = [
4040
"//pkg/apis/core:go_default_library",
4141
"//pkg/features:go_default_library",
42-
"//pkg/security/apparmor:go_default_library",
42+
"//staging/src/k8s.io/api/core/v1:go_default_library",
4343
"//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
4444
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
4545
"//staging/src/k8s.io/apimachinery/pkg/util/diff:go_default_library",

‎pkg/api/pod/util.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ package pod
1919
import (
2020
"strings"
2121

22+
"k8s.io/api/core/v1"
2223
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2324
utilfeature "k8s.io/apiserver/pkg/util/feature"
2425
api "k8s.io/kubernetes/pkg/apis/core"
2526
"k8s.io/kubernetes/pkg/features"
26-
"k8s.io/kubernetes/pkg/security/apparmor"
2727
)
2828

2929
// ContainerType signifies container type
@@ -363,7 +363,7 @@ func dropDisabledFields(
363363

364364
if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) && !appArmorInUse(oldPodAnnotations) {
365365
for k := range podAnnotations {
366-
if strings.HasPrefix(k, apparmor.ContainerAnnotationKeyPrefix) {
366+
if strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) {
367367
delete(podAnnotations, k)
368368
}
369369
}
@@ -590,7 +590,7 @@ func procMountInUse(podSpec *api.PodSpec) bool {
590590
// appArmorInUse returns true if the pod has apparmor related information
591591
func appArmorInUse(podAnnotations map[string]string) bool {
592592
for k := range podAnnotations {
593-
if strings.HasPrefix(k, apparmor.ContainerAnnotationKeyPrefix) {
593+
if strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) {
594594
return true
595595
}
596596
}

‎pkg/api/pod/util_test.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ import (
2323
"testing"
2424

2525
"github.com/google/go-cmp/cmp"
26+
27+
"k8s.io/api/core/v1"
2628
"k8s.io/apimachinery/pkg/api/resource"
2729
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2830
"k8s.io/apimachinery/pkg/util/diff"
@@ -32,7 +34,6 @@ import (
3234
featuregatetesting "k8s.io/component-base/featuregate/testing"
3335
api "k8s.io/kubernetes/pkg/apis/core"
3436
"k8s.io/kubernetes/pkg/features"
35-
"k8s.io/kubernetes/pkg/security/apparmor"
3637
)
3738

3839
func TestVisitContainers(t *testing.T) {
@@ -1026,7 +1027,7 @@ func TestDropEmptyDirSizeLimit(t *testing.T) {
10261027
func TestDropAppArmor(t *testing.T) {
10271028
podWithAppArmor := func() *api.Pod {
10281029
return &api.Pod{
1029-
ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", apparmor.ContainerAnnotationKeyPrefix + "foo": "default"}},
1030+
ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.AppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}},
10301031
Spec: api.PodSpec{},
10311032
}
10321033
}

‎pkg/apis/core/validation/BUILD‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ go_test(
5656
"//pkg/apis/core:go_default_library",
5757
"//pkg/capabilities:go_default_library",
5858
"//pkg/features:go_default_library",
59-
"//pkg/security/apparmor:go_default_library",
6059
"//staging/src/k8s.io/api/core/v1:go_default_library",
6160
"//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
6261
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",

‎pkg/apis/core/validation/validation.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ func ValidatePodSpecificAnnotationUpdates(newPod, oldPod *core.Pod, fldPath *fie
173173
if newVal, exists := newAnnotations[k]; exists && newVal == oldVal {
174174
continue // No change.
175175
}
176-
if strings.HasPrefix(k, apparmor.ContainerAnnotationKeyPrefix) {
176+
if strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) {
177177
allErrs = append(allErrs, field.Forbidden(fldPath.Key(k), "may not remove or update AppArmor annotations"))
178178
}
179179
if k == core.MirrorPodAnnotationKey {
@@ -185,7 +185,7 @@ func ValidatePodSpecificAnnotationUpdates(newPod, oldPod *core.Pod, fldPath *fie
185185
if _, ok := oldAnnotations[k]; ok {
186186
continue // No change.
187187
}
188-
if strings.HasPrefix(k, apparmor.ContainerAnnotationKeyPrefix) {
188+
if strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) {
189189
allErrs = append(allErrs, field.Forbidden(fldPath.Key(k), "may not add AppArmor annotations"))
190190
}
191191
if k == core.MirrorPodAnnotationKey {
@@ -3572,10 +3572,10 @@ func ValidateSeccompPodAnnotations(annotations map[string]string, fldPath *field
35723572
func ValidateAppArmorPodAnnotations(annotations map[string]string, spec *core.PodSpec, fldPath *field.Path) field.ErrorList {
35733573
allErrs := field.ErrorList{}
35743574
for k, p := range annotations {
3575-
if !strings.HasPrefix(k, apparmor.ContainerAnnotationKeyPrefix) {
3575+
if !strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) {
35763576
continue
35773577
}
3578-
containerName := strings.TrimPrefix(k, apparmor.ContainerAnnotationKeyPrefix)
3578+
containerName := strings.TrimPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix)
35793579
if !podSpecHasContainer(spec, containerName) {
35803580
allErrs = append(allErrs, field.Invalid(fldPath.Key(k), containerName, "container not found"))
35813581
}

‎pkg/apis/core/validation/validation_test.go‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ import (
3535
"k8s.io/kubernetes/pkg/apis/core"
3636
"k8s.io/kubernetes/pkg/capabilities"
3737
"k8s.io/kubernetes/pkg/features"
38-
"k8s.io/kubernetes/pkg/security/apparmor"
3938
utilpointer "k8s.io/utils/pointer"
4039
)
4140

@@ -7293,7 +7292,7 @@ func TestValidatePod(t *testing.T) {
72937292
Name: "123",
72947293
Namespace: "ns",
72957294
Annotations: map[string]string{
7296-
apparmor.ContainerAnnotationKeyPrefix + "ctr": apparmor.ProfileRuntimeDefault,
7295+
v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.AppArmorBetaProfileRuntimeDefault,
72977296
},
72987297
},
72997298
Spec: validPodSpec(nil),
@@ -7303,7 +7302,7 @@ func TestValidatePod(t *testing.T) {
73037302
Name: "123",
73047303
Namespace: "ns",
73057304
Annotations: map[string]string{
7306-
apparmor.ContainerAnnotationKeyPrefix + "init-ctr": apparmor.ProfileRuntimeDefault,
7305+
v1.AppArmorBetaContainerAnnotationKeyPrefix + "init-ctr": v1.AppArmorBetaProfileRuntimeDefault,
73077306
},
73087307
},
73097308
Spec: core.PodSpec{
@@ -7318,7 +7317,7 @@ func TestValidatePod(t *testing.T) {
73187317
Name: "123",
73197318
Namespace: "ns",
73207319
Annotations: map[string]string{
7321-
apparmor.ContainerAnnotationKeyPrefix + "ctr": apparmor.ProfileNamePrefix + "foo",
7320+
v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.AppArmorBetaProfileNamePrefix + "foo",
73227321
},
73237322
},
73247323
Spec: validPodSpec(nil),
@@ -8017,9 +8016,9 @@ func TestValidatePod(t *testing.T) {
80178016
Name: "123",
80188017
Namespace: "ns",
80198018
Annotations: map[string]string{
8020-
apparmor.ContainerAnnotationKeyPrefix + "ctr": apparmor.ProfileRuntimeDefault,
8021-
apparmor.ContainerAnnotationKeyPrefix + "init-ctr": apparmor.ProfileRuntimeDefault,
8022-
apparmor.ContainerAnnotationKeyPrefix + "fake-ctr": apparmor.ProfileRuntimeDefault,
8019+
v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.AppArmorBetaProfileRuntimeDefault,
8020+
v1.AppArmorBetaContainerAnnotationKeyPrefix + "init-ctr": v1.AppArmorBetaProfileRuntimeDefault,
8021+
v1.AppArmorBetaContainerAnnotationKeyPrefix + "fake-ctr": v1.AppArmorBetaProfileRuntimeDefault,
80238022
},
80248023
},
80258024
Spec: core.PodSpec{
@@ -8037,7 +8036,7 @@ func TestValidatePod(t *testing.T) {
80378036
Name: "123",
80388037
Namespace: "ns",
80398038
Annotations: map[string]string{
8040-
apparmor.ContainerAnnotationKeyPrefix + "ctr": "bad-name",
8039+
v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": "bad-name",
80418040
},
80428041
},
80438042
Spec: validPodSpec(nil),
@@ -8050,7 +8049,7 @@ func TestValidatePod(t *testing.T) {
80508049
Name: "123",
80518050
Namespace: "ns",
80528051
Annotations: map[string]string{
8053-
apparmor.ContainerAnnotationKeyPrefix + "ctr": "runtime/foo",
8052+
v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": "runtime/foo",
80548053
},
80558054
},
80568055
Spec: validPodSpec(nil),

‎pkg/apis/policy/validation/BUILD‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ go_library(
1818
"//pkg/security/apparmor:go_default_library",
1919
"//pkg/security/podsecuritypolicy/seccomp:go_default_library",
2020
"//pkg/security/podsecuritypolicy/util:go_default_library",
21+
"//staging/src/k8s.io/api/core/v1:go_default_library",
2122
"//staging/src/k8s.io/apimachinery/pkg/api/validation:go_default_library",
2223
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/validation:go_default_library",
2324
"//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
@@ -32,9 +33,9 @@ go_test(
3233
deps = [
3334
"//pkg/apis/core:go_default_library",
3435
"//pkg/apis/policy:go_default_library",
35-
"//pkg/security/apparmor:go_default_library",
3636
"//pkg/security/podsecuritypolicy/seccomp:go_default_library",
3737
"//pkg/security/podsecuritypolicy/util:go_default_library",
38+
"//staging/src/k8s.io/api/core/v1:go_default_library",
3839
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
3940
"//staging/src/k8s.io/apimachinery/pkg/util/intstr:go_default_library",
4041
"//staging/src/k8s.io/apimachinery/pkg/util/validation/field:go_default_library",

‎pkg/apis/policy/validation/validation.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"regexp"
2323
"strings"
2424

25+
"k8s.io/api/core/v1"
2526
apimachineryvalidation "k8s.io/apimachinery/pkg/api/validation"
2627
unversionedvalidation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
2728
"k8s.io/apimachinery/pkg/util/sets"
@@ -129,15 +130,15 @@ func ValidatePodSecurityPolicySpec(spec *policy.PodSecurityPolicySpec, fldPath *
129130
func ValidatePodSecurityPolicySpecificAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList {
130131
allErrs := field.ErrorList{}
131132

132-
if p := annotations[apparmor.DefaultProfileAnnotationKey]; p != "" {
133+
if p := annotations[v1.AppArmorBetaDefaultProfileAnnotationKey]; p != "" {
133134
if err := apparmor.ValidateProfileFormat(p); err != nil {
134-
allErrs = append(allErrs, field.Invalid(fldPath.Key(apparmor.DefaultProfileAnnotationKey), p, err.Error()))
135+
allErrs = append(allErrs, field.Invalid(fldPath.Key(v1.AppArmorBetaDefaultProfileAnnotationKey), p, err.Error()))
135136
}
136137
}
137-
if allowed := annotations[apparmor.AllowedProfilesAnnotationKey]; allowed != "" {
138+
if allowed := annotations[v1.AppArmorBetaAllowedProfilesAnnotationKey]; allowed != "" {
138139
for _, p := range strings.Split(allowed, ",") {
139140
if err := apparmor.ValidateProfileFormat(p); err != nil {
140-
allErrs = append(allErrs, field.Invalid(fldPath.Key(apparmor.AllowedProfilesAnnotationKey), allowed, err.Error()))
141+
allErrs = append(allErrs, field.Invalid(fldPath.Key(v1.AppArmorBetaAllowedProfilesAnnotationKey), allowed, err.Error()))
141142
}
142143
}
143144
}

‎pkg/apis/policy/validation/validation_test.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ import (
2121
"testing"
2222

2323
"github.com/stretchr/testify/assert"
24+
"k8s.io/api/core/v1"
2425
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2526
"k8s.io/apimachinery/pkg/util/intstr"
2627
"k8s.io/apimachinery/pkg/util/validation/field"
2728
api "k8s.io/kubernetes/pkg/apis/core"
2829
"k8s.io/kubernetes/pkg/apis/policy"
29-
"k8s.io/kubernetes/pkg/security/apparmor"
3030
"k8s.io/kubernetes/pkg/security/podsecuritypolicy/seccomp"
3131
psputil "k8s.io/kubernetes/pkg/security/podsecuritypolicy/util"
3232
"k8s.io/utils/pointer"
@@ -223,11 +223,11 @@ func TestValidatePodSecurityPolicy(t *testing.T) {
223223

224224
invalidAppArmorDefault := validPSP()
225225
invalidAppArmorDefault.Annotations = map[string]string{
226-
apparmor.DefaultProfileAnnotationKey: "not-good",
226+
v1.AppArmorBetaDefaultProfileAnnotationKey: "not-good",
227227
}
228228
invalidAppArmorAllowed := validPSP()
229229
invalidAppArmorAllowed.Annotations = map[string]string{
230-
apparmor.AllowedProfilesAnnotationKey: apparmor.ProfileRuntimeDefault + ",not-good",
230+
v1.AppArmorBetaAllowedProfilesAnnotationKey: v1.AppArmorBetaProfileRuntimeDefault + ",not-good",
231231
}
232232

233233
invalidAllowedUnsafeSysctlPattern := validPSP()
@@ -521,8 +521,8 @@ func TestValidatePodSecurityPolicy(t *testing.T) {
521521

522522
validAppArmor := validPSP()
523523
validAppArmor.Annotations = map[string]string{
524-
apparmor.DefaultProfileAnnotationKey: apparmor.ProfileRuntimeDefault,
525-
apparmor.AllowedProfilesAnnotationKey: apparmor.ProfileRuntimeDefault + "," + apparmor.ProfileNamePrefix + "foo",
524+
v1.AppArmorBetaDefaultProfileAnnotationKey: v1.AppArmorBetaProfileRuntimeDefault,
525+
v1.AppArmorBetaAllowedProfilesAnnotationKey: v1.AppArmorBetaProfileRuntimeDefault + "," + v1.AppArmorBetaProfileNamePrefix + "foo",
526526
}
527527

528528
withForbiddenSysctl := validPSP()

‎pkg/kubelet/dockershim/BUILD‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,6 @@ go_library(
5555
"//pkg/kubelet/types:go_default_library",
5656
"//pkg/kubelet/util/cache:go_default_library",
5757
"//pkg/kubelet/util/ioutils:go_default_library",
58-
"//pkg/security/apparmor:go_default_library",
5958
"//pkg/util/parsers:go_default_library",
6059
"//staging/src/k8s.io/api/core/v1:go_default_library",
6160
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
@@ -111,7 +110,7 @@ go_test(
111110
"//pkg/kubelet/dockershim/network/testing:go_default_library",
112111
"//pkg/kubelet/types:go_default_library",
113112
"//pkg/kubelet/util/cache:go_default_library",
114-
"//pkg/security/apparmor:go_default_library",
113+
"//staging/src/k8s.io/api/core/v1:go_default_library",
115114
"//staging/src/k8s.io/apimachinery/pkg/util/clock:go_default_library",
116115
"//staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2:go_default_library",
117116
"//vendor/github.com/blang/semver:go_default_library",
@@ -123,12 +122,6 @@ go_test(
123122
"//vendor/github.com/stretchr/testify/assert:go_default_library",
124123
"//vendor/github.com/stretchr/testify/require:go_default_library",
125124
] + select({
126-
"@io_bazel_rules_go//go/platform:android": [
127-
"//staging/src/k8s.io/api/core/v1:go_default_library",
128-
],
129-
"@io_bazel_rules_go//go/platform:linux": [
130-
"//staging/src/k8s.io/api/core/v1:go_default_library",
131-
],
132125
"@io_bazel_rules_go//go/platform:windows": [
133126
"//vendor/golang.org/x/sys/windows/registry:go_default_library",
134127
],

0 commit comments

Comments
 (0)