Sascha Grunert 44dfc921ce Add the OCI seccomp profile type behind SecurityProfileOCI ...

Add seccompProfile.type OCI with the oci field (a digest-pinned ref and an
optional RuntimeDefault or Localhost baseProfile) and the alpha
SecurityProfileOCI feature gate, as described in KEP-6061. The oci field
is validated declaratively, with custom validators for the reference and
the base profile path; the gate check and the rule that privileged
containers cannot use an OCI profile stay handwritten. While the gate is
disabled the type is rejected unless the old object already uses it.
PodSecurity baseline and restricted keep rejecting OCI. The
SecurityProfileOCI node declared feature keeps pods with OCI profiles on
nodes whose kubelet has the gate enabled and a runtime that supports OCI
seccomp profiles. The field is named ref instead of the KEP's reference,
following the kube-api-linter naming convention for new fields.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

2026-11-04 07:21:35 +01:00

..

exceptions.yaml

Add the OCI seccomp profile type behind SecurityProfileOCI

2026-11-04 07:21:35 +01:00

kube-api-linter.yaml

kube-api-linter: forbid +k8s:customValidation in API types

2026-10-29 22:22:16 +00:00

OWNERS

…