mirror of
https://github.com/ceph/ceph-csi.git
synced 2025-06-14 18:53:35 +00:00
rebase: update kubernetes to latest
updating the kubernetes release to the latest in main go.mod Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit is contained in:
committed by
mergify[bot]
parent
63c4c05b35
commit
5a66991bb3
11
vendor/k8s.io/pod-security-admission/policy/check_procMount.go
generated
vendored
11
vendor/k8s.io/pod-security-admission/policy/check_procMount.go
generated
vendored
@ -35,6 +35,9 @@ spec.initContainers[*].securityContext.procMount
|
||||
|
||||
**Allowed Values:** undefined/null, "Default"
|
||||
|
||||
However, if the pod is in a user namespace (`hostUsers: false`), and the
|
||||
UserNamespacesPodSecurityStandards feature is enabled, all values are allowed.
|
||||
|
||||
*/
|
||||
|
||||
func init() {
|
||||
@ -58,6 +61,14 @@ func CheckProcMount() Check {
|
||||
}
|
||||
|
||||
func procMount_1_0(podMetadata *metav1.ObjectMeta, podSpec *corev1.PodSpec) CheckResult {
|
||||
// TODO: When we remove the UserNamespacesPodSecurityStandards feature gate (and GA this relaxation),
|
||||
// create a new policy version.
|
||||
// Note: pod validation will check for well formed procMount type, so avoid double validation and allow everything
|
||||
// here.
|
||||
if relaxPolicyForUserNamespacePod(podSpec) {
|
||||
return CheckResult{Allowed: true}
|
||||
}
|
||||
|
||||
var badContainers []string
|
||||
forbiddenProcMountTypes := sets.NewString()
|
||||
visitContainers(podSpec, func(container *corev1.Container) {
|
||||
|
Reference in New Issue
Block a user