github/k3k
1
0
Fork 0
mirror of https://github.com/rancher/k3k.git synced 2026-08-23 22:36:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add PodSecurityContext and Security Context to helm chart and cluster spec (#1058)

Browse Source 
* Add securityContext and podSecurityContext to the chart and cluster pods

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
This commit is contained in:
Hussein Galal
2026-07-28 13:53:11 +03:00
committed by GitHub
parent 97e243f480
commit 11bf7a2dc4
12 changed files with 625 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/controller/cluster/agent/shared.go
+10
View File
@@ -251,6 +251,16 @@ func (s *SharedAgent) podSpec(ctx context.Context) corev1.PodSpec {
podSpec.ImagePullSecrets = append(podSpec.ImagePullSecrets, corev1.LocalObjectReference{Name: imagePullSecret})
}
// pod security context
podSecurityContext := s.cluster.Spec.PodSecurityContext
if s.cluster.Status.Policy != nil && s.cluster.Status.Policy.PodSecurityContext != nil {
log.V(1).Info("Using container pod securityContext configuration from policy", "policyName", s.cluster.Status.PolicyName, "clusterName", s.cluster.Name)
podSecurityContext = s.cluster.Status.Policy.PodSecurityContext
}
podSpec.SecurityContext = podSecurityContext
// container security context
securityContext := s.cluster.Spec.SecurityContext
if s.cluster.Status.Policy != nil && s.cluster.Status.Policy.SecurityContext != nil {
log.V(1).Info("Using securityContext configuration from policy", "policyName", s.cluster.Status.PolicyName, "clusterName", s.cluster.Name)
pkg/controller/cluster/agent/virtual.go
+9
View File
@@ -299,6 +299,15 @@ func (v *VirtualAgent) podSpec(ctx context.Context, image, name string) corev1.P
podSpec.ImagePullSecrets = append(podSpec.ImagePullSecrets, corev1.LocalObjectReference{Name: imagePullSecret})
}
// pod security context
podSecurityContext := v.cluster.Spec.PodSecurityContext
if v.cluster.Status.Policy != nil && v.cluster.Status.Policy.PodSecurityContext != nil {
log.V(1).Info("Using container pod securityContext configuration from policy", "policyName", v.cluster.Status.PolicyName, "clusterName", v.cluster.Name)
podSecurityContext = v.cluster.Status.Policy.PodSecurityContext
}
podSpec.SecurityContext = podSecurityContext
securityContext := v.cluster.Spec.SecurityContext
if v.cluster.Status.Policy != nil && v.cluster.Status.Policy.SecurityContext != nil {
log.V(1).Info("Using securityContext configuration from policy", "policyName", v.cluster.Status.PolicyName, "clusterName", v.cluster.Name)
pkg/controller/cluster/cluster.go
+23 -17
View File
@@ -422,7 +422,7 @@ func (c *ClusterReconciler) reconcile(ctx context.Context, cluster *v1beta1.Clus
serviceIP := service.Spec.ClusterIP
if err := c.createClusterConfigs(ctx, cluster, s, serviceIP); err != nil {
if err := c.ensureClusterConfigs(ctx, cluster, s, serviceIP); err != nil {
return err
}
@@ -534,37 +534,43 @@ func (c *ClusterReconciler) ensureKubeconfigSecret(ctx context.Context, cluster
return err
}
func (c *ClusterReconciler) createClusterConfigs(ctx context.Context, cluster *v1beta1.Cluster, server *server.Server, serviceIP string) error {
// create init node config
func (c *ClusterReconciler) ensureClusterConfigs(ctx context.Context, cluster *v1beta1.Cluster, server *server.Server, serviceIP string) error {
// init node config
initServerConfig, err := server.Config(true, serviceIP)
if err != nil {
return err
}
if err := controllerutil.SetControllerReference(cluster, initServerConfig, c.Client.Scheme()); err != nil {
currentInitServerConfig := initServerConfig.DeepCopy()
if _, err := controllerutil.CreateOrUpdate(ctx, c.Client, currentInitServerConfig, func() error {
if err := controllerutil.SetControllerReference(cluster, currentInitServerConfig, c.Client.Scheme()); err != nil {
return err
}
currentInitServerConfig.Data = initServerConfig.Data
return nil
}); err != nil {
return err
}
if err := c.Client.Create(ctx, initServerConfig); err != nil {
if !apierrors.IsAlreadyExists(err) {
return err
}
}
// create servers configuration
// servers configuration
serverConfig, err := server.Config(false, serviceIP)
if err != nil {
return err
}
if err := controllerutil.SetControllerReference(cluster, serverConfig, c.Client.Scheme()); err != nil {
return err
}
if err := c.Client.Create(ctx, serverConfig); err != nil {
if !apierrors.IsAlreadyExists(err) {
currentServerConfig := serverConfig.DeepCopy()
if _, err := controllerutil.CreateOrUpdate(ctx, c.Client, currentServerConfig, func() error {
if err := controllerutil.SetControllerReference(cluster, currentServerConfig, c.Client.Scheme()); err != nil {
return err
}
currentServerConfig.Data = serverConfig.Data
return nil
}); err != nil {
return err
}
return nil
pkg/controller/cluster/server/server.go
+13 -3
View File
@@ -11,7 +11,6 @@ import (
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/utils/ptr"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -249,18 +248,29 @@ func (s *Server) podSpec(ctx context.Context, image, name string, persistent boo
},
},
}
// virtual mode runs an embedded kubelet inside the server pod and therefore
// requires Privileged. shared and hcp modes are agentless (no kubelet) and
// run unprivileged.
if s.mode == string(v1beta1.VirtualClusterMode) {
podSpec.Containers[0].SecurityContext = &corev1.SecurityContext{
Privileged: ptr.To(true),
Privileged: new(true),
}
}
// pod security context
podSecurityContext := s.cluster.Spec.PodSecurityContext
if s.cluster.Status.Policy != nil && s.cluster.Status.Policy.PodSecurityContext != nil {
log.V(1).Info("Using container pod securityContext configuration from policy", "policyName", s.cluster.Status.PolicyName, "clusterName", s.cluster.Name)
podSecurityContext = s.cluster.Status.Policy.PodSecurityContext
}
podSpec.SecurityContext = podSecurityContext
// container security context
securityContext := s.cluster.Spec.SecurityContext
if s.cluster.Status.Policy != nil && s.cluster.Status.Policy.SecurityContext != nil {
log.V(1).Info("Using securityContext configuration from policy", "policyName", s.cluster.Status.PolicyName, "clusterName", s.cluster.Name)
log.V(1).Info("Using container securityContext configuration from policy", "policyName", s.cluster.Status.PolicyName, "clusterName", s.cluster.Name)
securityContext = s.cluster.Status.Policy.SecurityContext
}