Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

KEP for promoting seccomp to GA #1148

Merged
merged 10 commits into from
May 6, 2020
Merged

KEP for promoting seccomp to GA #1148

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
0e21d25
KEP for promoting seccomp to GA
tallclair Jul 17, 2019
82f393e
Add section about PSP application
tallclair Jul 18, 2019
8d37151
Address feedback
tallclair Jul 30, 2019
cc0e931
Update seccomp GA API
tallclair Sep 26, 2019
098ac44
Fill in approvers/reviewers
tallclair Sep 16, 2019
26b8a4f
Mark KEP as implementable
tallclair Oct 3, 2019
da67380
Iterate on KEP review
tallclair Jan 17, 2020
da1bbc6
revert to provisional status
tallclair May 5, 2020
81059c3
Regenerate TOC
tallclair May 5, 2020
b32550c
Update unresolved section format
tallclair May 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Address feedback
  • Loading branch information
@tallclair
tallclair committed Jul 30, 2019
commit 8d371516b30d8103e3bf62a209243606920fdfb1
18 changes: 14 additions & 4 deletions keps/sig-node/20190717-seccomp-ga.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ status: provisional
- [PodSecurityPolicy Update](#podsecuritypolicy-update)
- [PodSecurityPolicy Enforcement](#podsecuritypolicy-enforcement)
- [PodTemplates](#podtemplates)
- [Upgrade / Downgrade](#upgrade--downgrade)
- [Test Plan](#test-plan)
- [Graduation Criteria](#graduation-criteria)
- [Upgrade / Downgrade Strategy](#upgrade--downgrade-strategy)
Expand Down Expand Up @@ -115,7 +116,7 @@ GA will be covered by a separate KEP._

- Declare seccomp GA
- Fully document and formally spec the feature support
- Migrate the annotations to standard API fields
- Add equivalent API fields to replace seccomp annotations
- Deprecate the seccomp annotations

### Non-Goals
Expand All @@ -128,6 +129,7 @@ are out of scope, including:
- Formally speccing the seccomp profile format in Kubernetes
- Providing mechanisms for loading profiles from outside the static seccomp node directory
- Changing the semantics around seccomp support
- Windows support (seccomp is very linux-specific)

tallclair marked this conversation as resolved.
Show resolved Hide resolved
## Proposal

Expand All @@ -139,7 +141,7 @@ specifies allowed profiles & a default profile.

#### Pod API

The Pod Seccomp API is immutable.
The Pod Seccomp API is immutable, except in [`PodTemplates`](#podtemplates).

```go
type PodSecurityContext struct {
Expand Down Expand Up @@ -200,7 +202,7 @@ type PodSecurityPolicySpec struct {
}

type SeccompStrategyOptions struct {
// The default profile to set on the pod, if non is specified.
// The default profile to set on the pod, if none is specified.
// The default MUST be allowed by the allowedProfiles.
// +optional
DefaultProfile *v1.SeccompProfile
Expand Down Expand Up @@ -315,13 +317,21 @@ version running the pod.
PodTemplates (e.g. ReplaceSets, Deployments, StatefulSets, etc.) will be ignored. The
field/annotation resolution will happen on template instantiation.

#### Upgrade / Downgrade

Nodes do not currently support in-place upgrades, so pods will be recreated on node upgrade and
downgrade. No special handling or consideration is needed to support this.

On the API server side, we've already taken version skew in HA clusters into account. The same
precautions make upgrade & downgrade handling a non-issue.

### Test Plan

Seccomp already has [E2E tests][], but the tests are guarded by the `[Feature:Seccomp]` tag and not
run in the standard test suites.

Prior to being marked GA, the feature tag will be removed from the seccomp tests, and the tests will
be migrated to the new fields API.
be migrated to the new fields API. Tests will be tagged as `[LinuxOnly]`.

New tests will be added covering the annotation/field conflict cases described under
[Version Skew Strategy](#version-skew-strategy).
Expand Down