mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-09-04 07:07:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add the ability to set the allowPrivilegeEscalation property on the Restic restore helper via plugin ConfigMap (#2792)

Browse Source 
* Add the ability to set the `allowPrivilegeEscalation` security context attribute on the Restic restore helper init container.

Signed-off-by: Piper Dougherty <doughertypiper@gmail.com>

* Add changelog.

Signed-off-by: Piper Dougherty <doughertypiper@gmail.com>

* Fix old tests and add tests for new allowPrivilegeEscalation config option.

Signed-off-by: Piper Dougherty <doughertypiper@gmail.com>

* Correct spelling in changelog.

Signed-off-by: Piper Dougherty <doughertypiper@gmail.com>

* Switch to boolptr type.

Signed-off-by: Piper Dougherty <doughertypiper@gmail.com>

* Reorder imports for sanity.

Signed-off-by: Piper Dougherty <doughertypiper@gmail.com>
This commit is contained in:
Piper Dougherty
2020-08-06 13:08:36 -04:00
committed by GitHub
parent 6ac0398c7b
commit 19e65689ef
5 changed files with 42 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changelogs/unreleased/2792-doughepi
+1
View File
@@ -0,0 +1 @@
Add the ability to set the allowPrivilegeEscalation flag in the securityContext for the Restic restore helper.
pkg/restore/restic_restore_action.go
+6 -6
View File
@@ -130,9 +130,9 @@ func (a *ResticRestoreAction) Execute(input *velero.RestoreItemActionExecuteInpu
)
}
runAsRoot, runAsGroup := getSecurityContext(log, config)
runAsRoot, runAsGroup, allowPrivilegeEscalation := getSecurityContext(log, config)
securityContext, err := kube.ParseSecurityContext(runAsRoot, runAsGroup)
securityContext, err := kube.ParseSecurityContext(runAsRoot, runAsGroup, allowPrivilegeEscalation)
if err != nil {
log.Errorf("Using default resource values, couldn't parse resource requirements: %s.", err)
}
@@ -219,14 +219,14 @@ func getResourceLimits(log logrus.FieldLogger, config *corev1.ConfigMap) (string
return config.Data["cpuLimit"], config.Data["memLimit"]
}
// getSecurityContext extracts securityContext runAsUser and runAsGroup from a ConfigMap.
func getSecurityContext(log logrus.FieldLogger, config *corev1.ConfigMap) (string, string) {
// getSecurityContext extracts securityContext runAsUser, runAsGroup, and allowPrivilegeEscalation from a ConfigMap.
func getSecurityContext(log logrus.FieldLogger, config *corev1.ConfigMap) (string, string, string) {
if config == nil {
log.Debug("No config found for plugin")
return "", ""
return "", "", ""
}
return config.Data["secCtxRunAsUser"], config.Data["secCtxRunAsGroup"]
return config.Data["secCtxRunAsUser"], config.Data["secCtxRunAsGroup"], config.Data["secCtxAllowPrivilegeEscalation"]
}
// TODO eventually this can move to pkg/plugin/framework since it'll be used across multiple
pkg/restore/restic_restore_action_test.go
+1 -1
View File
@@ -111,7 +111,7 @@ func TestResticRestoreActionExecute(t *testing.T) {
defaultCPURequestLimit, defaultMemRequestLimit, // limits
)
securityContext, _ := kube.ParseSecurityContext("", "")
securityContext, _ := kube.ParseSecurityContext("", "", "")
var (
restoreName = "my-restore"
pkg/util/kube/security_context.go
+10 -1
View File
@@ -23,7 +23,7 @@ import (
corev1 "k8s.io/api/core/v1"
)
func ParseSecurityContext(runAsUser string, runAsGroup string) (corev1.SecurityContext, error) {
func ParseSecurityContext(runAsUser string, runAsGroup string, allowPrivilegeEscalation string) (corev1.SecurityContext, error) {
securityContext := corev1.SecurityContext{}
if runAsUser != "" {
@@ -44,5 +44,14 @@ func ParseSecurityContext(runAsUser string, runAsGroup string) (corev1.SecurityC
securityContext.RunAsGroup = &parsedRunAsGroup
}
if allowPrivilegeEscalation != "" {
parsedAllowPrivilegeEscalation, err := strconv.ParseBool(allowPrivilegeEscalation)
if err != nil {
return securityContext, errors.WithStack(errors.Errorf(`Security context allowPrivilegeEscalation "%s" is not a boolean`, allowPrivilegeEscalation))
}
securityContext.AllowPrivilegeEscalation = &parsedAllowPrivilegeEscalation
}
return securityContext, nil
}
pkg/util/kube/security_context_test.go
+24 -11
View File
@@ -21,12 +21,15 @@ import (
"github.com/stretchr/testify/assert"
corev1 "k8s.io/api/core/v1"
"github.com/vmware-tanzu/velero/pkg/util/boolptr"
)
func TestParseSecurityContext(t *testing.T) {
type args struct {
runAsUser string
runAsGroup string
runAsUser string
runAsGroup string
allowPrivilegeEscalation string
}
tests := []struct {
name string
@@ -34,23 +37,33 @@ func TestParseSecurityContext(t *testing.T) {
wantErr bool
expected *corev1.SecurityContext
}{
{"valid security context", args{"1001", "999"}, false, &corev1.SecurityContext{
RunAsUser: pointInt64(1001),
RunAsGroup: pointInt64(999),
{"valid security context", args{"1001", "999", "true"}, false, &corev1.SecurityContext{
RunAsUser: pointInt64(1001),
RunAsGroup: pointInt64(999),
AllowPrivilegeEscalation: boolptr.True(),
}},
{"security context without runAsGroup", args{"1001", ""}, false, &corev1.SecurityContext{
{
"another valid security context",
args{"1001", "999", "false"}, false, &corev1.SecurityContext{
RunAsUser: pointInt64(1001),
RunAsGroup: pointInt64(999),
AllowPrivilegeEscalation: boolptr.False(),
},
},
{"security context without runAsGroup", args{"1001", "", ""}, false, &corev1.SecurityContext{
RunAsUser: pointInt64(1001),
}},
{"security context without runAsUser", args{"", "999"}, false, &corev1.SecurityContext{
{"security context without runAsUser", args{"", "999", ""}, false, &corev1.SecurityContext{
RunAsGroup: pointInt64(999),
}},
{"empty context without runAsUser", args{"", ""}, false, &corev1.SecurityContext{}},
{"invalid security context runAsUser", args{"not a number", ""}, true, nil},
{"invalid security context runAsGroup", args{"", "not a number"}, true, nil},
{"empty context without runAsUser", args{"", "", ""}, false, &corev1.SecurityContext{}},
{"invalid security context runAsUser", args{"not a number", "", ""}, true, nil},
{"invalid security context runAsGroup", args{"", "not a number", ""}, true, nil},
{"invalid security context allowPrivilegeEscalation", args{"", "", "not a bool"}, true, nil},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := ParseSecurityContext(tt.args.runAsUser, tt.args.runAsGroup)
got, err := ParseSecurityContext(tt.args.runAsUser, tt.args.runAsGroup, tt.args.allowPrivilegeEscalation)
if tt.wantErr {
assert.Error(t, err)
return