Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ConfigMap support for seccomp custom profiles #1269

Closed
wants to merge 12 commits into from
Closed

Add ConfigMap support for seccomp custom profiles #1269

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
da31c93
Initial draft
pjbgf Oct 2, 2019
ce0d940
Add Version Skew Strategy
pjbgf Oct 2, 2019
0483cd4
Add reviewers
pjbgf Oct 2, 2019
425bcc9
Fix mispelling.
pjbgf Oct 2, 2019
5cb0696
Add new seccomp profile type.
pjbgf Oct 2, 2019
3a28d21
Minor changes
pjbgf Oct 15, 2019
7bd2056
Add alternative of using CRDs instead
pjbgf Oct 17, 2019
097e699
Improvements based on feedback
pjbgf Oct 27, 2019
95c053a
Improve alternatives & add multiple files support
pjbgf Oct 29, 2019
19e9331
Add explict reference to namespace
pjbgf Oct 29, 2019
d9b66d7
Update keps/sig-node/20191002-seccomp-custom-profiles.md
pjbgf Apr 24, 2020
a94d0b8
Fix grammar mistakes
pjbgf Apr 24, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Minor changes
  • Loading branch information
@pjbgf
pjbgf committed Oct 15, 2019
commit 3a28d21da753420793391b9d27f5808bc78b1363
10 changes: 6 additions & 4 deletions keps/sig-node/20191002-seccomp-custom-profiles.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ approvers:
- "@tallclair"
editor: TBD
creation-date: 2019-10-02
last-updated: 2019-10-02
last-updated: 2019-10-15
status: provisional
see-also:
- "https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/seccomp.md"
Expand Down Expand Up @@ -119,7 +119,7 @@ jsonSeccomp, _ := json.Marshal(profile.Spec)
return []dockerOpt{{"seccomp", string(jsonSeccomp), seccompProfileName}}, nil
```

The new config profiles would be mapped to an additional Kubernetes profile type:
The new config profiles would be mapped to an additional Kubernetes profile type, which is contingent on the GA API changes proposed in [#1148](https://github.com/kubernetes/enhancements/pull/1148):
```
const (
SeccompProfileUnconfined SeccompProfileType = "Unconfined"
Expand Down Expand Up @@ -175,7 +175,8 @@ A similar approach would also be beneficial to AppArmor profiles.

#### Rollout of profile changes

Seccomp profiles are applied at container creation time, therefore updating an existing user-defined profile will not cause any changes to the running containers that are using it. They will need to be restarted in order for the changes to take effect, which users will have to manually do.
Seccomp profiles are applied at container creation time, therefore updating an existing user-defined profile will not cause any changes to the running containers that are using it.
pjbgf marked this conversation as resolved.
Show resolved Hide resolved
They will need to be restarted in order for the changes to take effect, which users will have to do manually.
pjbgf marked this conversation as resolved.
Show resolved Hide resolved


#### Starting containers with non-existent profile
Expand Down Expand Up @@ -229,11 +230,12 @@ The new configmap based profiles will only be supported from this version on. Us

## Implementation History
- 2019-10-02: Initial KEP
- 2019-10-15: Minor changes


## Alternatives

**Start deprecation process for `localhost/<path>`.** The new `ConfigMapSeccompProfile` will better support custom profiles. Starting the deprecation process would signal to users what the end goal is. However, this can be started once the new approach GA's.
**Start deprecation process for `localhost/<path>`.** The new `ConfigMapSeccompProfile` will better support custom profiles. Starting the deprecation process would signal users what the end goal is. However, this can be started once the new approach GA's.


**Downstream seccomp support awareness.** Validation could be added to assert whether the Seccomp Profile could be applied by the downstream dependencies on a _per- node_ basis, and lead to a list of available profiles for each node. This would benefit clusters with heterogeneus nodes. It would also benefit the usage of the current `localhost/<path>` profile, which an administrator has no way to tell which nodes have them and which ones don't.
Expand Down