Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

KEP for promoting seccomp to GA #1148

Merged
merged 10 commits into from
May 6, 2020
Merged

KEP for promoting seccomp to GA #1148

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
0e21d25
KEP for promoting seccomp to GA
tallclair Jul 17, 2019
82f393e
Add section about PSP application
tallclair Jul 18, 2019
8d37151
Address feedback
tallclair Jul 30, 2019
cc0e931
Update seccomp GA API
tallclair Sep 26, 2019
098ac44
Fill in approvers/reviewers
tallclair Sep 16, 2019
26b8a4f
Mark KEP as implementable
tallclair Oct 3, 2019
da67380
Iterate on KEP review
tallclair Jan 17, 2020
da1bbc6
revert to provisional status
tallclair May 5, 2020
81059c3
Regenerate TOC
tallclair May 5, 2020
b32550c
Update unresolved section format
tallclair May 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Update unresolved section format
  • Loading branch information
@tallclair
tallclair committed May 5, 2020
commit b32550c4ea6028b988eaeed7f51f21fc92fcb940
8 changes: 4 additions & 4 deletions keps/sig-node/20190717-seccomp-ga.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,7 @@ for new profile sources to be added in the future (e.g. Kubernetes predefined pr
profiles). The seccomp options struct leaves room for future extensions, such as defining the
behavior when a profile cannot be set.

<UNRESOLVED>
<<[UNRESOLVED]>>
What to do with the localhost profile type, given that we want to deprecate it? Alternative for
consideration:

Expand All @@ -207,17 +207,17 @@ annotation.
The one gotcha is how to handle annotation update in this case. I'm tempted to say allow the update,
and if the kubelet goes to enforce it and the annotation isn't set to localhost anymore, just treat
it as an invalid localhost path (fail the pod).
</UNRESOLVED>
<<[/UNRESOLVED]>>

<UNRESOLVED>
<<[UNRESOLVED]>>
What to do with RuntimeProfile field? There aren't any runtimes that support multiple built in
profiles, and this feature has never been requested.

If we dropped this field for now (just assume it's runtime/default), how bad would it be to add it
back at some point in the future if it was needed? As long as we defaulted the new field to
"default" and it's immutable, it doesn't seem like it would be that problematic? Or am I forgetting
something?
</UNRESOLVED>
<<[/UNRESOLVED]>>

#### PodSecurityPolicy API

Expand Down