k8s: allow to disable runtime class name backend option (#7046)

Co-authored-by: Robert Kaussow <xoxys@rknet.org>

cmd/cli/app_test.go

@@ -45,7 +45,8 @@ func TestNewAppRunsDecodeBase64WithoutConfig(t *testing.T) {
 	}
 
 	command := exec.CommandContext(t.Context(), os.Args[0], "-test.run=^TestNewAppRunsDecodeBase64WithoutConfig$")
-	command.Env = append(os.Environ(),
+	command.Env = append(
+		os.Environ(),
 		"WOODPECKER_DECODE_BASE64_HELPER=1",
 		"WOODPECKER_DISABLE_UPDATE_CHECK=true",
 		"XDG_CONFIG_HOME="+t.TempDir(),

docs/docs/30-administration/10-configuration/11-backends/20-kubernetes.md

@@ -673,3 +673,12 @@ Container image used for the workspace permission init container, which is used
 - Default: `false`
 
 Determines if the Pod `serviceAccountName` can be defined from a step's backend options. Disabled by default, as it would otherwise allow any user with push access to run pods under an arbitrary service account and escalate privileges.
+
+---
+
+### BACKEND_K8S_RUNTIME_CLASS_ALLOW_FROM_STEP
+
+- Name: `WOODPECKER_BACKEND_K8S_RUNTIME_CLASS_ALLOW_FROM_STEP`
+- Default: `false`
+
+Determines if the Pod `runtimeClassName` can be defined from a step's backend options. Disabled by default, as it would otherwise allow any user with push access to run pods under an arbitrary runtime class.

pipeline/backend/kubernetes/flags.go

@@ -115,6 +115,12 @@ var Flags = []cli.Flag{
 		Usage:   "whether to allow using affinity from step's backend options",
 		Value:   false,
 	},
+	&cli.BoolFlag{
+		Sources: cli.EnvVars("WOODPECKER_BACKEND_K8S_RUNTIME_CLASS_ALLOW_FROM_STEP"),
+		Name:    "backend-k8s-runtime-class-allow-from-step",
+		Usage:   "whether to allow using runtime class name from step's backend options",
+		Value:   false,
+	},
 	&cli.BoolFlag{
 		Sources: cli.EnvVars("WOODPECKER_BACKEND_K8S_SECCTX_NONROOT"), // cspell:words secctx nonroot
 		Name:    "backend-k8s-secctx-nonroot",

pipeline/backend/kubernetes/kubernetes.go

@@ -75,6 +75,7 @@ type config struct {
 	PodTolerations                  []Toleration
 	PodAffinity                     *kube_core_v1.Affinity
 	PodAffinityAllowFromStep        bool
+	RuntimeClassAllowFromStep       bool
 	ImagePullSecretNames            []string
 	SecurityContext                 SecurityContextConfig
 	NativeSecretsAllowFromStep      bool
@@ -124,6 +125,7 @@ func configFromCliContext(ctx context.Context) (*config, error) {
 				PodNodeSelectorAllowFromStep: c.Bool("backend-k8s-pod-node-selector-allow-from-step"),
 				PodNodeSelector:              make(map[string]string), // just init empty map to prevent nil panic
 				PodAffinityAllowFromStep:     c.Bool("backend-k8s-pod-affinity-allow-from-step"),
+				RuntimeClassAllowFromStep:    c.Bool("backend-k8s-runtime-class-allow-from-step"),
 				ImagePullSecretNames:         c.StringSlice("backend-k8s-pod-image-pull-secret-names"),
 				SecurityContext: SecurityContextConfig{
 					RunAsNonRoot: c.Bool("backend-k8s-secctx-nonroot"), // cspell:words secctx nonroot

pipeline/backend/kubernetes/pod.go

@@ -184,7 +184,6 @@ func podSpec(step *types.Step, config *config, options BackendOptions, nsp nativ
 
 	spec := kube_core_v1.PodSpec{
 		RestartPolicy:     kube_core_v1.RestartPolicyNever,
-		RuntimeClassName:  options.RuntimeClassName,
 		PriorityClassName: config.PriorityClassName,
 		HostAliases:       hostAliases(step.ExtraHosts),
 		Hostname:          getHostnameOrEmpty(step.Name),
@@ -202,6 +201,10 @@ func podSpec(step *types.Step, config *config, options BackendOptions, nsp nativ
 		spec.ServiceAccountName = options.ServiceAccountName
 	}
 
+	if config.RuntimeClassAllowFromStep {
+		spec.RuntimeClassName = options.RuntimeClassName
+	}
+
 	// If there are tolerations and they are allowed
 	if config.PodTolerationsAllowFromStep && len(options.Tolerations) != 0 {
 		spec.Tolerations = tolerations(options.Tolerations)

pipeline/backend/kubernetes/pod_test.go

@@ -557,6 +557,7 @@ func TestFullPod(t *testing.T) {
 		PodNodeSelectorAllowFromStep:    true,
 		SecurityContext:                 SecurityContextConfig{RunAsNonRoot: false},
 		ServiceAccountNameAllowFromStep: true,
+		RuntimeClassAllowFromStep:       true,
 	},
 		"wp-01he8bebctabr3kgk0qj36d2me-0",
 		"linux/amd64",