Skip to content

policy: improve pod namespace validation #10593

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Dec 9, 2024
Merged

policy: improve pod namespace validation #10593

merged 1 commit into from
Dec 9, 2024

Conversation

Redent0r
Copy link
Contributor

@Redent0r Redent0r commented Nov 27, 2024 •
edited
Loading

  • Remove the need for specifying default_namespace from settings
  • Ensure container namespaces in a pod match each other in case no namespace is specified in the YAML

@katacontainersbot katacontainersbot added the size/medium Average sized task label Nov 27, 2024
@sprt
Copy link
Contributor

sprt commented Nov 27, 2024

Could you include this commit in #10591 instead? Unless there's a strong reason to have separate PRs

@Redent0r
Copy link
Contributor Author

Could you include this commit in #10591 instead? Unless there's a strong reason to have separate PRs

No strong reason, it's just a small (yet important) fix I noticed we needed while working on this

@Redent0r Redent0r force-pushed the saulparedes/improve_namespace_validation branch from f87d429 to 4bbb953 Compare November 27, 2024 21:41
@Redent0r Redent0r mentioned this pull request Nov 27, 2024
Closed
@Redent0r Redent0r force-pushed the saulparedes/improve_namespace_validation branch 2 times, most recently from 63c12d5 to 47602d0 Compare December 2, 2024 16:34
@3u13r 3u13r mentioned this pull request Dec 2, 2024
Merged
@Redent0r Redent0r force-pushed the saulparedes/improve_namespace_validation branch 2 times, most recently from 3640968 to d3d8996 Compare December 2, 2024 23:17
Redent0r
Redent0r commented Dec 3, 2024
View reviewed changes
src/tools/genpolicy/rules.rego

allow_by_container_types(p_oci, i_oci, s_name, p_namespace)
allow_by_container_types(p_oci, i_oci, s_name, i_namespace)
Copy link
Contributor Author

@Redent0r Redent0r Dec 3, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now we need to get the namespace from the input for the case where we set the default namespace using kubectl config set-context --current --namespace=kata-containers-k8s-tests (this is what we do in the tests)

@Redent0r
policy: improve pod namespace validation
84a411d 
- Remove default_namespace from settings
- Ensure container namespaces in a pod match each other in case no namespace is specified in the YAML

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
@Redent0r Redent0r force-pushed the saulparedes/improve_namespace_validation branch from d3d8996 to 84a411d Compare December 4, 2024 18:20
@Redent0r Redent0r marked this pull request as ready for review December 4, 2024 21:39
@danmihai1 danmihai1 requested a review from sprt December 6, 2024 16:14
@sprt sprt merged commit 037281d into kata-containers:main Dec 9, 2024
575 of 637 checks passed
@Redent0r Redent0r deleted the saulparedes/improve_namespace_validation branch December 9, 2024 18:34
@Redent0r Redent0r mentioned this pull request Dec 16, 2024
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sprt sprt sprt approved these changes

@danmihai1 danmihai1 danmihai1 approved these changes

Assignees
No one assigned
Labels
ok-to-test size/medium Average sized task
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@Redent0r @sprt @danmihai1 @katacontainersbot