Make Restricted PSS security context work together with agent injection #1624
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Vlatombe
commented
Dec 2, 2024
Comment on lines
+30
to
+33
| assertEquals(name + "-before.yaml is not normalized", Serialization.asYaml(before), beforeYAML); | ||
| var afterYAML = loadFileAsStream(name + "-after.yaml"); | ||
| var after = decorator.decorate(cloud, before); | ||
| assertEquals(name + "-after.yaml processed", afterYAML, Serialization.asYaml(after)); | ||
| assertEquals(name + "-after.yaml processed", Serialization.asYaml(after), afterYAML); |
There was a problem hiding this comment.
expected and actual were inverted.
There was a problem hiding this comment.
Maybe clearer to use assertThat(actual, is(expected))
amuniz
approved these changes
Dec 2, 2024
jglick
reviewed
Dec 2, 2024
| } | ||
|
|
||
| private static void secure(@NonNull Container container) { | ||
| var securityContext = container.getSecurityContext(); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When using both
agentInjection: trueand the checkbox "Inject restricted PSS security context in agent container definition" in an environment using restricted PSS, then the resulting pod can't be scheduled because the init container doesn't have the proper security context set.This modifies the existing PSS logic to decorate as well init containers.
Testing done
Submitter checklist